HTTP API

All responses use Connection: close. Protected endpoints require:

Authorization: Bearer <token>

GET /health

Unauthenticated liveness endpoint.

{"status":"ok","version":"1.0.0"}

GET /v1/actions

Returns sorted action metadata and parameter schemas. Executable paths, fixed arguments, environment variables, and working directories are deliberately not exposed.

POST /v1/run/{action}

Content type must be application/json.

{
  "arguments": {
    "name": "value",
    "count": 3,
    "enabled": true
  }
}

The response contains:

Field	Meaning
request_id	UUID shared with the audit record
action	Action name
exit_code	Native process exit status
stdout, stderr	UTF-8 decoded output; invalid sequences are replaced
stdout_truncated, stderr_truncated	Whether the retained output hit its configured cap
timed_out	Whether Cmdveil terminated the action after its timeout
duration_ms	Wall-clock duration

A launched process with a non-zero exit status still returns HTTP 200. This distinguishes an application-level process result from a gateway failure.

Исходник