Auth: Authorization: Bearer <token> (or X-Imara-Token). Lifecycle and policy mutations additionally require X-Admin-Token. Endpoints marked [admin] are control-plane operations.
| Method |
Path |
Description |
GET |
/status |
Health check (public — exempt from token auth) |
POST |
/syscall |
Dispatch a natural-language intent through the kernel |
POST |
/v1/chat/completions |
OpenAI-compatible policy-enforced model gateway |
GET |
/v1/models |
Available models |
POST |
/agents/spawn |
Spawn a governed child agent |
POST |
/vfs/write · GET /vfs/read · POST /vfs/search |
Agent memory (vector-indexed) |
| Method |
Path |
Description |
POST |
/v1/x402/fetch |
Paid fetch — kernel meets 402 challenges under governance |
POST |
/v1/x402/authorize |
Authorization oracle for out-of-band (A2A) quotes, payee-bound |
POST |
/v1/x402/settle |
Settle + signed receipt |
GET |
/v1/x402/budget |
Remaining spend for the caller |
POST |
/v1/proxy/fetch |
Rail-neutral spend proxy (idempotent) |
| Method |
Path |
Description |
GET/POST |
/v1/agents |
List / register agents (register creates PENDING) |
PUT |
/v1/agents/{id}/activate | suspend | reinstate | revoke |
Lifecycle [admin] |
GET |
/v1/agents/{id}/verify |
Verify identity + capabilities (hot path) |
GET/POST |
/v1/orgs · /v1/orgs/{id}/zones |
Organisations and delegated zones [admin] for writes |
GET |
/v1/dna/resolve/{id} |
Resolve the full identity chain (agent → zone → org) |
POST |
/v1/approvers/credentials |
Enrol an approver passkey [admin] |
POST |
/v1/mandates · POST /v1/mandates/{id}/revoke |
Issue / withdraw payment visas [admin] |
GET/POST |
/v1/payees |
List / register payees (register creates PENDING) [admin] for writes |
POST |
/v1/payees/{id}/approve · /v1/payees/{id}/update |
Maker-checker approval; edits reset to PENDING [admin] |
POST |
/v1/workload/attest |
Workload identity attestation |
| Method |
Path |
Description |
GET |
/admin/policy |
Current snapshot (roles, tokens, default role) |
POST/DELETE |
/admin/policy/roles · /admin/policy/tokens |
Manage roles and token mappings |
GET |
/v1/policy-templates |
Template catalog for org/zone ceiling documents |
POST |
/v1/policy-templates/{id}/apply |
Render + attach ceilings (dry_run previews) |
GET |
/v1/agents/{id}/policy-chain |
Effective policy chain for one agent (ceilings + leaf, with hashes) |
POST |
/v1/policies/evaluate |
Dry-run a policy document against a hypothetical action |
POST |
/admin/policy/observe |
Observation mode: record freely, then… |
GET |
/admin/policy/build/{sessionID} |
…synthesise a least-privilege role from the trace |
| Method |
Path |
Description |
GET |
/ledger |
Query entries (limit, offset, status, session) |
GET |
/ledger/verify · /ledger/chain-head |
Hash-chain integrity |
GET |
/ledger/stream |
SSE real-time stream |
GET |
/ledger/mesh |
Agent-to-agent traffic graph (window=1h|6h|24h|7d|all) |
GET |
/v1/traces · /v1/traces/{id} |
Policy VERDICT spans |
POST |
/v1/otel/v1/traces |
OTLP/HTTP JSON ingest for agent-reported spans |
GET |
/metrics/prometheus |
Prometheus metrics |