API reference
The web workspace and native gateway use separate APIs.
Start here
- Use the web session for workspace requests.
- Use the native gateway only with a configured endpoint and credentials.
What you get
- Known request limits and retry behaviour.
- Report formats appropriate to each API.
Web workspace
- POST /api/jobs/decoder requires a signed-in session and accepts up to 2,000,000 bytes of UTF-8 text.
- Reuse the Idempotency-Key with an identical request to retrieve the same result without another debit.
- GET /api/jobs/{id} returns a job owned by the signed-in account. Browser exports are JSON and Markdown.
- POST /api/jobs/constructor does not accept jobs. Build estimates and graph exports are separate.
Native gateway
- The separately deployed gateway defines POST /v1/error-decoder/messages and POST /v1/toolchain/explain-error. Use the endpoint supplied by your operator; these routes are not part of the web workspace.
- Report fields include confidence, evidence, sources, tool_results, warnings, limitations, repro_steps and next_actions.
- Gateway integrations include JSON, SARIF and JUnit exports. Availability depends on the gateway configuration.
- The gateway log limit defaults to 10 MiB. Web workspace and bot limits are separate.
Authentication and retries
- Gateway feedback and heartbeat messages have public rate and payload limits. Analysis, reports and administration require the gateway credentials.
- Keep session cookies and service tokens private. Debounce feedback submissions.
- A failed request must not be treated as a completed analysis. Check the response before displaying success.