API Reference

Authentication

Plus and Max use JWT bearer auth with refresh-token rotation. Obtain a token from the login endpoint, then send it on every request.

curl -X POST http://localhost:8787/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@acme.dev","password":"••••••"}'
# → { "access_token": "eyJ…", "refresh_token": "…" }

curl http://localhost:8787/search \
  -H 'Authorization: Bearer eyJ…'

Ingest from the proxy/extension uses a separate workspace ingestToken. Passwords are hashed with PBKDF2-SHA256 (390,000 iterations).

Ingest

The capture layer POSTs provenance records to /ingest. The extension and proxy do this for you; you rarely call it directly.

POST /ingest
{
  "tool": "claude-code",
  "model": "claude-opus-4-8",
  "prompt": "add rate limiting to /api/login",
  "filePath": "src/routes/auth.py",
  "linesAdded": 47,
  "status": "applied",
  "confidence": 0.92
}

Search

Query records by keyword (all tiers) or by meaning (Plus/Max pgvector). Filter by tool, developer, file, risk, and date range.

GET /search?q=authentication&risk=high&tool=cursor&limit=50
GET /search?semantic=true&q=where+did+we+add+retry+logic

Integrity & AI-BOM

On Plus/Max each record is SHA-256 hash-chained to its predecessor.

GET  /integrity/verify        # walks the chain, reports first tampered record
POST /integrity/aibom         # HMAC-signed AI Bill of Materials
     ?workspace=core&from=2026-05-01&to=2026-06-01

The AI-BOM summarizes percent AI-authored, per-model breakdown, disclosure coverage, and chain status — built for EU AI Act-style documentation requests.

Export & interchange

Your provenance data is portable. Export the open cursor/agent-trace 0.1.0 format, or CSV (Plus/Max).

GET  /export/agent-trace      # JSONL / JSON / CSV
POST /import/agent-trace      # move data between instances
GET  /export/csv?view=timeline

MCP server

Plus/Max ship an MCP server exposing provenance to Claude Code, Cursor, or any MCP client — 10 tools:

• search_provenance · get_record · get_insights · explain_record
• list_recent · check_file_risk · usage_report · list_workspaces
• list_incidents · get_incident_provenance