API Reference

API 入口

完整字段与响应模型以启动后的 OpenAPI 为准：

http://127.0.0.1:8000/docs

健康与可观测性

GET /health
GET /metrics

运行

POST /runs/deterministic
POST /runs/graybox/deterministic
POST /runs/adaptive
POST /runs/stateful
GET  /runs/{run_id}
POST /runs/{run_id}/resume
POST /runs/{run_id}/control

审批

GET  /runs/{run_id}/approvals
POST /runs/{run_id}/approvals/{approval_id}

报告与 Replay

GET  /runs/{run_id}/report.json
GET  /runs/{run_id}/report.md
POST /runs/{source_run_id}/replay
GET  /runs/{run_id}/replay

持久化 Job

POST /jobs
GET  /jobs/{job_id}

示例：

curl -X POST http://127.0.0.1:8000/jobs \
  -H "X-API-Key: $ATTACKER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"request_id":"stateful-001","kind":"stateful","payload":{"profile":"hardened"}}'

Durable Job 不接受 password、token、API key 等原始 Secret 字段。敏感执行配置必须通过 Provider Instance Secret 引用绑定。

装备目录

GET  /equipment/provider-packages
GET  /equipment/provider-instances
GET  /equipment/skills
GET  /equipment/casepacks
GET  /equipment/contracts
POST /equipment/reload

装备校验、启停、健康检查和 dry-run 端点均位于 /equipment/*。

鉴权

设置 SECURITY__API_KEY 后，业务、审批、Replay、Job 与装备管理接口需要 X-API-Key。生产环境还应为 metrics 配置独立访问密钥。