Endpoint reference¶
Every endpoint the API serves, grouped by the product area that owns it. All of them live under
https://api.trilocore.ai, and all but the four public
attestation and report endpoints take an Authorization: Bearer header:
New to the API? Start with the overview and authentication — this section assumes both.
How the reference is organised¶
363 endpoints across 22 pages. Pages are split by resource area rather than by URL prefix, so a large group like the auditing tools becomes several focused pages instead of one unreadable one.
Within a page, endpoints are listed alphabetically by path, each with a method badge. Every entry carries the same four-row table:
| Row | What it tells you |
|---|---|
| Authentication | which credential is accepted |
| Idempotency-Key | whether the header is required — see Idempotency |
| Success | the status code a successful call returns |
| Upstream | the service that ultimately handles the request |
Where a machine-readable schema exists, a Request body table follows, listing each field with its type, whether it is required, and any length or size constraints. Some entries do not have one yet; their request shape is not published in a machine-readable form, and the curl example shows the call without a body. That is a gap in the documentation, not a statement that the endpoint takes no body.
A few entries carry a "Not available" warning. Those belong to the AI plane, which is not currently running: the call is routed but fails at the service behind the front door. They are listed rather than hidden so that the reference matches what the API actually advertises.
Anything not listed here returns 404
The API answers only the paths in this reference. There is no undocumented surface to
discover, and older RPC-style paths from previous versions of these tools have been removed —
a call to one is a 404, not a redirect. If you are porting an old integration, re-derive
every path from this reference rather than adjusting the ones you have.
Remember that an unauthenticated request to a non-existent path answers 401, not 404.
Authenticate before concluding that a path is missing.
Auditing tools¶
Fork-backed analysis of deployed contracts: sessions, targets, execution, state, findings.
Served under /api/v1/bevm/sessions and its siblings.
| Page | Endpoints | Covers |
|---|---|---|
| Sessions and forks | 6 | Opening a fork, snapshots, mining blocks |
| Targets and contracts | 39 | Targets, contracts, compilation, graphs, mindmaps, invariants |
| Execution | 16 | Transactions, executions, operations, path recovery |
| State and storage | 7 | Storage slots, balances, MorphVM |
| Analysis and findings | 31 | Scans, analysis jobs, findings, differentials, asset flow |
| Bytecode and decoding | 8 | Disassembly, decompilation, selector and calldata decoding |
| Fuzzing | 10 | Fuzz runs and wordlists |
| Artifacts, recordings and provenance | 9 | Artifacts, recordings, provenance seals, deployments, fundings |
| Audit records and exports | 24 | Audit events, exports, retention, legal holds, destinations |
| Service | 3 | Health, plus two AI-plane endpoints marked not available |
Architecture¶
| Page | Endpoints | Covers |
|---|---|---|
| Architecture | 24 | Architecture documents, builds, analyses, snapshots, diffs, threats, traces |
Architecture is the one auditing surface with its own top-level prefix, /api/v1/arch. It
paginates with page_size and page_token.
Contract IDE¶
The developer surface: git-native workspaces, compilation, review and publishing.
| Page | Endpoints | Covers |
|---|---|---|
| Workspaces and files | 39 | Workspaces, files, branches, tags, members, publishing bindings |
| Review, audits and evidence | 26 | Annotations, merge requests, audits, evidence |
| Compilation and integrations | 10 | Compilation, toolchains, templates, integrations |
Workspaces and engagements¶
Organisation-level structure: teams, workspaces, projects, contract inventory, findings, and the Audit Passport attestation chain.
| Page | Endpoints | Covers |
|---|---|---|
| Workspaces | 64 | Members, teams, contracts, audits, reports, attestations, access reviews |
| Projects | 13 | Projects, members, invitations, audit logs |
| Contract index | 2 | Cross-workspace contract inventory |
| Audit index | 2 | Cross-workspace audit index and publications |
| Activity | 1 | The activity feed |
| Invitations | 1 | Accepting an invitation |
Notes¶
| Page | Endpoints | Covers |
|---|---|---|
| Notes | 24 | Note workspaces, notes, comments, status, invites, images |
Public endpoints¶
| Page | Endpoints | Covers |
|---|---|---|
| Public (unauthenticated) | 4 | Attestation verification, the signing key set, shared reports |
These four are the only endpoints that need no credential — they exist so that a third party can verify an attestation or open a shared report without a Trilocore account. They are rate limited per client IP; see Rate limits.
A note on completeness¶
This reference is generated from the API's own routing tables and the owning services'
schemas, rather than hand-maintained — so it is complete by construction rather than by anyone
remembering to add a page. It is a snapshot, though, not a live view: it is regenerated
deliberately, so a route added to the gateway since the last regeneration would not appear here.
It is broader than the machine-readable specification at
/api/v1/meta/openapi.json, which expands the auditing group only — roughly 153 of these 363
operations. If you are generating a client, this reference is the complete surface; the
specification file is not.