本文へ移動

Endpoint reference

All under https://api.mithril.fund. auth: pat = the connection-token bearer; cookie = the browser session (same-origin POST); public = none. Wires that are not served (/v1/messages, /v1/responses, Gemini) answer 405.

method path auth Body and answer
GET /v1/models public The model catalog (team, route, availability).
POST /v1/chat/completions pat / cookie OpenAI-compatible completion. tools, stream (emulated), max_tokens ≤ 32768. Answer carries billing / receiptId (+ usage, chargedMicroUSD).
POST /x402/v1/chat/completions none (X-PAYMENT) x402 machine payment (ADR-2609190100). No auth — payment is the authentication. No X-PAYMENT header → 402 with an x402 challenge (scheme exact, network base, USDC, payTo, maxAmountRequired). task is fixed to code-review, tools/tool_choice are ignored, max_tokens ≤ 4096. Price is the same reservation-maximum calculation as /v1/chat/completions. An invalid payment is 402; the facilitator (x402.nexus) being unreachable is 503.
GET /v1/research/status pat / cookie {status: eligible|pending, reason, freeTier, trust, scopes}.
POST /v1/research/jobs pat / cookie Create a job. Header idempotency-key (uuid v4). Strict body {model, task, scopeId, max_tokens, messages}. 202 queued.
GET /v1/research/job?jobId= pat / cookie {jobId, status, billing, model, receiptId, pollAfterMs, content?, toolCalls?, finishReason?}. 202 while queued/running.
POST /v1/research/applications pat / cookie Researcher application {verificationMode, policyVersion, consent, authorizedResearch, purpose, scope}. 202.
POST /v1/research/ekyc/start pat / cookie Start verification {scopeId, tasks} → a Stripe URL.
GET /v1/research/ekyc/status pat / cookie Verification state.
GET /v1/billing/catalog public Plans, rates, checkoutEnabled, purchasable.
GET /v1/billing/status pat / cookie {status, plan, balances[{scope, grantedMicroUSD, spentMicroUSD, reservedMicroUSD, availableMicroUSD}], autoRecharge?{enabled, thresholdMicroUSD, quantity, monthlyCapMicroUSD, spentThisMonthMicroUSD, capReached, disabledReason, lastAttempt}}.
POST /v1/billing/auto-recharge cookie {enabled, thresholdMicroUSD, quantity, monthlyCapMicroUSD} — the rule that charges the saved card quantity × $25 when the AI balance falls below the threshold (off by default, monthly cap). 403 browser-session-required with a PAT.
POST /v1/billing/checkout cookie {sku, requestId} → a Stripe Checkout URL. 403 with a PAT.
POST /v1/billing/portal cookie The Customer Portal URL (invoices, cancellation).
GET /v1/secure public Guardrail / firewall / compliance versions and rules.
GET /v1/account/secure cookie This account's switches: on / off for each optional guardrail rule and each compliance framework ({guardrails[{id, action, mandatory, on, requiredBy?}], compliance[{id, label, requires, on}]}).
POST /v1/account/secure/toggle cookie Move one switch {kind: guardrail|compliance, id, on}. An AUP block rule is 403 rule-mandatory; a rule an enabled framework requires is 409 required-by-framework (with frameworks).
GET /v1/session cookie {valid, username, principalId}.
POST /v1/account/api-token cookie Issue a connection token (shown once).
GET /v1/account/api-tokens cookie Issued tokens (id, label).
POST /v1/account/api-token/revoke cookie Revoke one token.
GET /v1/security/services public The public security-services catalog.
POST /v1/security/govern public GRC (CSF 2.0 GV): profile gaps, risk register, supplier register (nothing stored). GET gives a worked example.
POST /v1/security/respond public IR (CSF 2.0 RS): priority, playbook, notification deadlines, recovery criteria (nothing stored). GET gives a worked example.
POST /v1/security/recover public DR (CSF 2.0 RC): restore waves, backup checks, end criteria, communications (nothing stored). GET gives a worked example.
GET /v1/security/{edr,cmdb,email,vm,cspm,ztna,mdm,siem,grc,backup-dr} public Each product's description (rules, limits, CSF).
POST /v1/security/vm/findings public VM: the deduped, scored findings ledger (GET gives a worked example).
POST /v1/security/vm/match public VM: components / SBOM × OSV advisories × VEX, with CVSS (GET gives a worked example).
POST /v1/security/cspm/assess public CSPM: cloud resources or raw AWS/Azure/GCP/Kubernetes responses → posture findings, attack paths, coverage (GET gives a worked example).
POST /v1/security/ztna/authorize public ZTNA: identity × device posture × resource → allow / deny with each check (the Worker's clock).
POST /v1/security/ztna/netmap public ZTNA: per-node reachability (unsigned).
POST /v1/security/mdm/compliance public MDM: device compliant / non-compliant / unmeasured and planned remediation.
POST /v1/security/mdm/plan public MDM: a command plan and whether it needs approval.
POST /v1/security/siem/correlate public SIEM: multi-source correlation → alerts, incidents, notifications, silent sources.
POST /v1/security/siem/playbook public SOAR: the next state of an approval-gated playbook.
POST /v1/security/siem/respond public IR: priority, playbook, deadlines (same as /v1/security/respond).
POST /v1/security/grc/govern public GRC: profile, risks, suppliers (same as /v1/security/govern).
POST /v1/security/grc/audit public GRC: execution-log deviations and evidence gaps against a BPMN process (no verdict).
POST /v1/security/backup-dr/recover public DR: recovery plan (same as /v1/security/recover).
POST /v1/security/backup-dr/jobs public Backup: job records × policies → age, failures, restore tests, 3-2-1-1-0.
GET /v1/security/solutions/spear-phishing public Public catalog entry of the spear-phishing defence solution (first-party composition, attack chain, CSF/ATT&CK references).
GET /v1/control-plane public The service-discovery profile.

Common to all: errors are {"error":{"code":…}} (see Errors). POST bodies are capped at 2 MiB and must be application/json.