Developers / REST API

REST API

Everything the apps do is an API call you can make too.

Base URL#

https://api.slink.w9li.dev

Interactive reference: https://api.slink.w9li.dev/docs · schema: openapi.json. 226 endpoints: chat, automations, integrations, vault, devices, screens, network, fleet, console.

Authentication#

Bearer tokens issued by POST /auth/login (accounts) or POST /auth/guest (per-device guests). Send the device id with every call so per-device isolation and skills work.

Authorization: Bearer slk_…
X-Device: d0123456789abcdef0123456
X-Client: ios | android | web

Chat with streaming#

POST /chat
{ "messages": [{ "role": "user", "content": "ذكّرني بكرا ٩ أرسل العرض" }],
  "conversation_id": "…" }

# Server-sent events
event: round   data: 0
event: tool    data: {"name":"web_search","label":"بحث بالإنترنت","state":"start"}
event: delta   data: "أبشر، "
event: done    data: {"reply":"…","model":"…","usage":{…}}

Other stream events: memory (facts about to be saved), secret (open a secure input sheet), device (ask the device for a skill), open_account and browse (owner browser).

Try it#

These buttons call the live API from your browser. No token needed for these two.

the live health check

downloads openapi.json and counts paths

More examples#

GET  /automations                 # my automations
POST /assist  → POST /confirm     # natural language → confirmed automation
GET  /catalog                     # services with live/setup/soon states
GET  /me/integrations             # capability toggles per service
PUT  /me/vault                    # write-only secrets
GET  /signage/screens             # screens (manager role)
GET  /fleet/devices               # PCs (IT role)

API reference#

Endpoint	Method	Auth	Notes
`/auth/guest`	POST	none	Per-device guest token; daily cap per IP
`/auth/login` · `/auth/signup`	POST	none	Accounts; invite codes carry consent levels
`/chat`	POST	bearer	Streams SSE: round, tool, delta, memory, secret, device, done
`/assist` → `/confirm`	POST	bearer	Natural language → confirmed automation
`/automations`	GET · PUT · DELETE	bearer	List, pause, delete
`/catalog` · `/integrations`	GET	bearer	Services with states; what is linked
`/me/vault`	GET · PUT · DELETE	bearer	Write-only secrets (names + masked hints)
`/me/accounts`	GET · PUT · DELETE	owner	Site logins for the SLINK browser
`/signage/*`	various	manager	Screens, assets, playlists, overrides
`/fleet/*`	various	IT role	PC fleet: checks, cleanup, messages, power
`/net/*`	various	bearer	Private network: devices, pulse, exit nodes
`/admin/*`	various	admin	Console, dev agent, settings

Headers#

Header	Type	Default
`Authorization`	`Bearer slk_…`	required
`X-Device`	24-hex device id	required for skills and isolation
`X-Client`	`ios · android · web`	`web`
`Accept`	`text/event-stream` for streams	`application/json`

Stream events#

Event	Payload	When
`round`	round number	each model round
`tool`	name, label, state	a tool starts / finishes
`delta`	text	every streamed token
`memory`	items	facts the assistant wants to keep
`secret`	name, label, why	open the secure input sheet
`device`	rid, capability, query	ask the device for a skill
`open_account` · `browse`	id, site, url (+rid)	owner browser
`done`	reply, model, usage	end of the reply
`error`	detail	something failed