REST: /api. WebSocket: /ws. /api/health stays public even with token authentication. The server checks Origin on WebSocket connections and state-changing requests that include that header.
curl http://127.0.0.1:4000/api/health
curl -H "Authorization: Bearer $COCKPIT_TOKEN" http://127.0.0.1:4000/api/missions
curl -H "Authorization: Bearer $COCKPIT_TOKEN" http://127.0.0.1:4000/api/agents
Methods, paths, and schemas are defined in:
| Area | Implementation |
|---|---|
| Missions and topology | src/server/routes/mission-routes.ts |
| Projects and clones | src/server/routes/project-routes.ts |
| Files, Git, memory, and skills | src/server/routes/workspace-routes.ts |
| Agent discovery | src/server/routes/agent-routes.ts |
| Panels and team | src/server/routes/pane-routes.ts, src/server/routes/team-routes.ts |
| Tasks, dispatch, and waits | src/server/routes/task-routes.ts |
| Runs, evidence, and results | src/server/routes/execution-routes.ts |
| Review | src/server/routes/review-routes.ts |
| Race | src/server/routes/race-routes.ts |
| Marketplace | src/server/routes/marketplace-routes.ts |
| Compliance | src/server/routes/compliance-routes.ts |
| Voice and media | src/server/routes/voice-routes.ts, src/server/routes/media-routes.ts |
| Remote access and Companion | src/server/routes/remote-routes.ts, src/server/routes/companion-routes.ts |
The WS multiplexer distributes terminal, orchestration, and review messages. See web/src/services/ws-client.ts for the interface protocol.