Apollia OS Runtime API
Host driving contract for the Apollia OS sovereign agent runtime. Stable under /api/v1; breaking changes ship under /api/v2.
Authentication
- HTTP: Bearer Auth
Token read from <data_dir>/api-token, generated on first start and sent as Authorization: Bearer <token>. Enforced on the TCP listener by TokenAuthLayer, on every route except two: GET /api/v1/health, which reveals the product marker and the version only, and POST /webhooks/{id}, which authenticates its caller with an HMAC-SHA256 signature instead. Requests arriving on the Unix socket bypass the check: the socket file is mode 0600, so its permissions carry the same rule. Setting [api] require_token = false in apollia.toml removes the layer from the TCP listener altogether.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
License
MIT OR Apache-2.0