HTTP API

The local endpoints behind the dashboard.

Base URL: http://127.0.0.1:4141. Garcon defaults to loopback access and has no app login. Read endpoints generally accept GET and HEAD; individual mutation routes enforce local Host, client, and Origin checks. Don't expose this API as a public service.

Requests and sessions

GET /api/connections: Saved harness connection status. Codex returns connected: true when the selected provider in its user configuration points to this Garcon endpoint, false when it does not, or null if the configuration cannot be read. This checks saved defaults, not per-launch overrides or current request activity.
GET /api/sessions: Up to 1,000 saved assignments, in-flight first, then most recently used. Includes session_id, account, model, counts, timestamps, active_reviews, active_since, and last request state/status/error, tool_calls, subagents (child agent threads and child sessions), and parent_session_id when another session started this one. Local clients may receive task with title, cwd, and archived. Missing task metadata is omitted.
GET /api/sessions/timeline?harness=&session_id=: One session's requests in time order (the newest 5,000), plus requests of child sessions whose parent_session_id is this session. Returns requests, total, truncated, parent_session_id, and children: one summary per subagent (key, session_id, thread_id, subagent, agent_name, models, calls, tool_calls, tokens, first, last). session_id is required.
GET /api/logs: Paginated request ledger: requests, total, offset, limit. Query with q, errors=true, limit (1–200; default 50), and offset. Search matches account, session, model, path, or request ID.
GET /api/events: System diagnostics, with the same limit/offset pagination.
GET /api/analytics?since=<unix-ms>: Hourly model/account aggregates: requests, errors, tokens, and duration.
GET /api/usage: Non-streaming completion records, including failed completions.
GET /api/usage/recent: The latest 30 arrivals from this server run, oldest first, plus total_requests. Each row has a sequence; history isn't loaded into the arrival feed.

Accounts and settings

GET /api/routing/codex · PUT: Read routing status or change enrollment. PUT accepts accounts to select IDs; an empty array clears the pool. Routing is automatic. Legacy enabled and priorities are accepted but no longer affect selection. Routing rules.
GET /api/limits · POST /api/limits/refresh: Cached subscription snapshots; POST requests background collection and returns 202. Fields and refresh behavior.
POST /api/accounts/login: Start browser sign-in with {"provider":"codex"} or {"provider":"claude"}. Poll GET ?id=…; cancel with DELETE and the same ID. Only one attempt runs at a time. States include starting, waiting, discovering, connected, error, and cancelled.
GET /api/providers/openrouter · PUT · DELETE: Read configured, save {"key":"…"}, or remove the local key. Reads never return it. Saving doesn't validate it upstream.
GET /api/nickname?account=… · PUT: Read a local nickname or save {"nickname":"…"} for that account.
GET /api/prices · POST: Cached API list prices. GET refreshes an old or missing catalog; POST requests a refresh. Prices come from OpenRouter's public catalog and are cached in SQLite.
GET /api/config: Listen address, data path, row count, uptime start, version, provider endpoints, and implicit harnesses.

Record conventions

Times are Unix milliseconds; duration fields use milliseconds except queue_us. Records carry request/session/account IDs, harness, provider, model, path, method, status, and state. States include streaming, complete, failed, and interrupted. Tokens are split into input, cache_read, cache_write, and output.

Optional connection timings include connect, DNS, TCP, TLS, and first byte. Missing timing means unmeasured. Prompts, reply bodies, and credential headers aren't part of the ledger.

Optional call details place a model call in its session: tools (the tool calls the model asked for, each a name and kind, up to 64), tool_results (tool results the request returned), effort, reasoning_tokens, turn_id, request_kind, subagent (such as thread_spawn, review, compact, guardian, or sidechain for Claude Code), agent_name, thread_id (a child agent thread within the session), and parent_session_id. Tool arguments, inputs, and outputs are never decoded or saved. Rows recorded before these fields existed omit them.