REST API reference

The REST API powers the Wicket dashboard and is available for automation. It is distinct from the MCP proxy endpoint (/mcp, Bearer member key) — REST calls authenticate with your dashboard session cookie (magic-link sign-in, plus MFA where required).

Note

All endpoints return JSON. Agent-scoped routes (/api/agents/:id/...) require that you are a member of that agent. Beyond that, authorization is per-route: some mutations are owner-only (e.g. member approval, service config, status), while others are open to any approved member (e.g. creating policies, disconnecting a service) or to the affected member themselves (e.g. rotating or revoking your own key). Each route below notes when it is restricted.

Agents

Method	Path	Description
GET	/api/agents	List agents (owned and member-of). Supports search, status, role, sortBy, sortDir, limit, offset
POST	/api/agents	Create an agent
GET	/api/agents/:id	Agent detail
PUT	/api/agents/:id	Update name/tags (owner)
DELETE	/api/agents/:id	Delete the agent (owner)
PUT	/api/agents/:id/status	Toggle active/disabled (owner) — disabling blocks all proxy calls immediately
PUT	/api/agents/:id/services	Set enabled connectors (owner)

Members and keys

Method	Path	Description
POST	/api/agents/:id/invite	Create a signed invite link (7-day validity; owner)
POST	/api/agents/:id/join	Join with an invite token (invited email must match)
GET	/api/agents/:id/members	List members with status
PUT	/api/agents/:id/members/:memberId/status	Approve a pending member (owner)
POST	/api/agents/:id/members/:memberId/reject	Reject a pending member (owner)
DELETE	/api/agents/:id/members/:memberId	Remove a member — invalidates their key (owner)
PUT	/api/agents/:id/members/:memberId/key	Generate or rotate the member key (self)
DELETE	/api/agents/:id/members/:memberId/key	Revoke the key
POST	/api/agents/:id/members/:memberId/key/reset-lost	Reset a lost key — clears connections that can no longer be decrypted so the member can reconnect
GET	/api/agents/:id/members/:memberId/connections	The member’s service connections (metadata only — never tokens)
GET	/api/agents/:id/onboarding	Member onboarding status (connections, key state)

Connectors and credentials

Method	Path	Description
GET	/api/connectors/meta	Display metadata for all connectors
GET	/api/tools/catalog	Aggregated tool catalog; filter per service
PUT	/api/agents/:id/services/:service/credentials	Set the agent’s OAuth app credentials for a connector (owner). Slack, Linear, Stripe, and Hugging Face also accept a webhookSecret, or a clearWebhookSecret: true flag to remove a stored secret
GET	/api/agents/:id/services/credentials	Which connectors have credentials configured
DELETE	/api/agents/:id/services/:service/credentials	Remove credentials
DELETE	/api/agents/:id/connect/:service	Disconnect your own OAuth connection for a service
GET	/api/agents/:id/entities/:service/:type	Harvested entities (repos, channels, teams, …) for policy pickers

Policies

All policy routes are agent-scoped:

Method	Path	Description
GET	/api/agents/:id/policies	List policies. Supports search, service, effect, enabled, sorting, pagination
POST	/api/agents/:id/policies	Create a policy
PUT	/api/agents/:id/policies/:policyId	Update a policy
DELETE	/api/agents/:id/policies/:policyId	Delete a policy
POST	/api/agents/:id/policies/:policyId/toggle	Enable/disable without deleting
GET	/api/agents/:id/policies/:policyId/versions	Version history with snapshots
POST	/api/agents/:id/policies/preview	Compile a draft to Cedar without saving
POST	/api/agents/:id/policies/simulate	Replay recent audit traffic against a draft — see Preview and simulation

Audit

Method	Path	Description
GET	/api/audit	Query audit entries — see Audit event schema for parameters
GET	/api/audit/export	CSV export. Same filters, plus exportAll and max (cap 500 per request)
GET	/api/audit/members	Member identities appearing in your audit data (for filter dropdowns)

Sessions

Method	Path	Description
GET	/api/agents/:id/sessions	Tool sessions for the agent (owner)
GET	/api/agents/:id/my-sessions	Your own tool sessions
GET	/api/agents/:id/sessions/:sessionId/activity	Per-session tool usage and policy hit counts
POST	/api/agents/:id/sessions/:sessionId/reset	Terminate a session — session-condition counters start fresh

Dashboard and account

Method	Path	Description
GET	/api/dashboard/stats	Aggregate counters (calls, allow/deny, agents, policies)
GET	/api/dashboard/member-stats	Per-member activity breakdown
GET	/api/auth/status	Current session state
POST	/api/auth/logout	End the session
GET	/api/users/me/sessions	Active dashboard sessions for your account
GET	/api/status	Service health

Examples

List your agents:

GET /api/agents?status=active&role=owner&limit=20

{
  "agents": [
    {
      "id": "a1b2c3d4-…",
      "name": "my-first-agent",
      "tags": ["eng"],
      "type": "trusted",
      "status": "active",
      "allowedServices": ["github", "slack"],
      "key": { "displaySuffix": "…k4Qz", "lastUsedAt": "2026-06-12T14:02:11.000Z" },
      "membership": { "id": "m9z8…", "role": "owner", "status": "approved", "memberCount": 4 },
      "connections": [{ "service": "github", "identityInfo": { "login": "alice" } }],
      "policyCount": 6,
      "createdAt": "2026-05-02T09:12:00.000Z"
    }
  ],
  "total": 1
}

List an agent’s policies (filtered):

GET /api/agents/a1b2c3d4-…/policies?service=github&effect=forbid&enabled=true

{
  "policies": [
    {
      "id": "p_31xy…",
      "policyKey": "block-github-destructive-tools",
      "name": "Block GitHub destructive tools",
      "service": "github",
      "effect": "forbid",
      "tools": ["delete_file", "merge_pull_request"],
      "principal": { "type": "all_members" },
      "enabled": true,
      "triggerCount": 17,
      "lastTriggered": "2026-06-11T22:40:09.000Z",
      "denyMessage": "Destructive GitHub operations are blocked."
    }
  ],
  "total": 1
}

Query denied audit entries:

GET /api/audit?result=DENY&service=github&limit=50

{
  "entries": [
    {
      "timestamp": "2026-06-12T15:21:43.000Z",
      "agentName": "my-first-agent",
      "user": "bob@example.com",
      "service": "github",
      "tool": "delete_file",
      "decision": "DENY",
      "reason": "Destructive GitHub operations are blocked.",
      "matchedPolicyNames": ["Block GitHub destructive tools"],
      "durationMs": 12
    }
  ],
  "total": 1
}

See Audit event schema for every entry field.

Related

• Errors — status codes and error shapes
• Rate limits — platform thresholds