This is the current local daemon HTTP surface exposed by src/Adit.Daemon/Program.cs.
GET /GET /v1/infoGET /v1/statusGET /v1/runtimeGET /v1/capabilitiesGET /v1/doctor
GET /v1/setup/guidePOST /v1/setup/checkGET /v1/agent/context
POST /v1/sync/nowGET /v1/eventsGET /v1/events/recentGET /v1/thread-chooser/statusGET /v1/ws
GET /v1/devicesPOST /v1/notifications/checkPOST /v1/notifications/enablePOST /v1/notifications/disablePOST /v1/bootstrap/notifications/checkPOST /v1/bootstrap/notifications/enablePOST /v1/bootstrap/notifications/disableGET /v1/contactsGET /v1/contacts/searchGET /v1/notificationsPOST /v1/notifications/{notificationUid:long}/actions/{action}GET /v1/messages/foldersGET /v1/messagesGET /v1/cache/messagesGET /v1/conversationsGET /v1/conversations/{conversationId}POST /v1/messages/resolvePOST /v1/messages/send
These routes exist only when ADIT_ENABLE_EXPERIMENTAL_PAIRING_API=true:
GET /v1/pairing/candidatesPOST /v1/pairing/pairPOST /v1/pairing/unpair
- The daemon only accepts loopback bind URLs.
- Browser-origin checks reject cross-site access to:
GET /v1/ws
GET /v1/events- all state-changing browser requests (
POST,PUT,PATCH,DELETE) - If
ADIT_AUTH_TOKENis set, API clients must sendAuthorization: Bearer <token>. - The hosted browser UI prompts for the token after a
401response and stores it in browser local storage on that machine. - For websocket or SSE clients that cannot set headers during connection setup, the daemon also accepts
access_tokenas a query parameter on/v1/wsand/v1/events.