← Docs

API reference

Every route this deployment answers. Generated from the running server, so it describes this deployment and not a published example. The same list is available as JSON at /v1/routes.

Base URL and authentication

This deployment requires a signed-in session. Send the session token as Authorization: Bearer <token>. Requests that change something must also come from the dashboard's configured origin.

https://app.tansohq.com

Contents

Public evidence

Inspect a product the way an agent would discover it. These consume credits when a workspace is metered.

POST/v1/interface

Read public evidence and save an inspection in your workspace.

curl -X POST https://app.tansohq.com/v1/interface \
  -H 'Content-Type: application/json' \
  -d '{ "url": "https://example.com" }'

POST/v1/evaluate

Inspect and assess a task from public evidence. Does not run a live agent.

curl -X POST https://app.tansohq.com/v1/evaluate \
  -H 'Content-Type: application/json' \
  -d '{ "url": "https://example.com", "task": "Create a test project" }'

GET/v1/schema

Field-level description of the interface document.

curl https://app.tansohq.com/v1/schema

Workspace

Your account, its balance, and everything it has saved. Reading costs nothing.

GET/v1/account

Your workspace, credit balance, and recent credit transactions.

curl https://app.tansohq.com/v1/account

GET/v1/runs

Your saved inspections, assessments, and usability requests.

curl https://app.tansohq.com/v1/runs

GET/v1/runs/:id

One of your saved results or usability requests.

curl https://app.tansohq.com/v1/runs/<id>

GET/v1/execution

Available agent execution, test access, and configured cost.

curl https://app.tansohq.com/v1/execution

POST/v1/runs/:id/resume

Continue an assessment after its expected human handoff, at its original quoted price.

curl -X POST https://app.tansohq.com/v1/runs/<id>/resume

POST/v1/runs/:id/cancel

Cancel an assessment and release its reserved credits.

curl -X POST https://app.tansohq.com/v1/runs/<id>/cancel

Flows

A saved customer task with the conditions it starts from and the result that counts as success.

GET/v1/flows

Your reusable onboarding flows.

curl https://app.tansohq.com/v1/flows

POST/v1/flows

Save a flow for repeat checks. Free; starts no agent.

curl -X POST https://app.tansohq.com/v1/flows \
  -H 'Content-Type: application/json' \
  -d '{ "name": "Create first project", "url": "https://example.com", "task": "Create a project", "successCriteria": "A project exists", "access": "public" }'

GET/v1/flows/:id/quote

Review the scope and credit cost of a saved flow.

curl https://app.tansohq.com/v1/flows/<id>/quote

POST/v1/flows/:id/run

Start an agent assessment using the accepted quote. Requires Idempotency-Key.

curl -X POST https://app.tansohq.com/v1/flows/<id>/run \
  -H 'Content-Type: application/json' \
  -d '{ "fingerprint": "accepted-quote-fingerprint" }' \
  -H 'Idempotency-Key: <unique-key>'

Assessments

Starting, continuing, and cancelling a bounded agent run.

POST/v1/run-requests

Save a usability request awaiting setup with the team. No agent starts and no credits are charged.

curl -X POST https://app.tansohq.com/v1/run-requests \
  -H 'Content-Type: application/json' \
  -d '{ "flowId": "flow_..." }'

POST/v1/run-requests/:id/cancel

Cancel a request before execution.

curl -X POST https://app.tansohq.com/v1/run-requests/<id>/cancel

Issues and updates

Verified failures, the fixes recorded against them, and workspace notifications.

GET/v1/issues

Evidence-backed failures and fixes awaiting verification.

curl https://app.tansohq.com/v1/issues

PATCH/v1/issues/:id

Record a fix ready for a comparable retest. Passing verification closes the issue.

curl -X PATCH https://app.tansohq.com/v1/issues/<id> \
  -H 'Content-Type: application/json' \
  -d '{ "status": "fix_ready", "note": "What changed" }'

GET/v1/notifications

Workspace updates about regressions, fixes, and handoffs.

curl https://app.tansohq.com/v1/notifications

POST/v1/notifications/:id/read

Mark a workspace update as read.

curl -X POST https://app.tansohq.com/v1/notifications/<id>/read

Other

POST/v1/signup

Create a workspace and receive an API key, with no account and no person. The key is returned once. Unclaimed workspaces have a smaller daily run allowance.

curl -X POST https://app.tansohq.com/v1/signup \
  -H 'Content-Type: application/json' \
  -d '{ "label": "my agent" }'

GET/v1/routes

This route list as JSON, including any route added after this page was written.

curl https://app.tansohq.com/v1/routes

Errors

Every failure returns JSON with a stable error code and a message written for a person. Read the code, not the message. Codes raised only by the worker or an operator command are omitted; a caller does not receive them.

{ "error": "insufficient_credits", "message": "...", "required": 10, "balance": 3 }
400 credentials_not_allowedA password or key appeared in a flow or run request. Test access is configured separately.
400 flow_url_mismatchThe request names a flow whose product URL differs from the one supplied.
400 invalid_accessaccess must be public or test_account.
400 invalid_fieldA required field is missing, empty, or longer than its limit.
400 invalid_flow_optionsOnboarding, verification, schedule, or profile setup is not a permitted combination.
400 invalid_idAn identifier is not in the expected format.
400 invalid_jsonThe body was not a JSON object.
400 invalid_noteA fix note is empty or longer than its limit.
400 invalid_quoteThe accepted quote fingerprint is missing or malformed. Read the quote first.
400 invalid_request_keyThe Idempotency-Key header is missing or malformed.
400 invalid_statusAn issue can only be moved to fix_ready.
400 invalid_urlThe URL is not a public HTTP or HTTPS address, or carries credentials.
400 request_abortedThe connection closed before the body arrived.
400 unexpected_fieldThe body carried a field this route does not accept.
401 invalid_keyThe API key is malformed, unknown, or revoked. Create a workspace with POST /v1/signup.
401 sign_in_requiredThe session is missing, expired, or has an unfinished sign-up step.
402 insufficient_creditsNothing started and the setup is saved. Carries the required amount and the available balance.
403 origin_not_allowedA change was requested from somewhere other than the configured origin.
404 account_not_foundThe account must sign in before it can be credited.
404 not_foundNo such route, or no such record in this workspace. Records are never visible across accounts.
405 method_not_allowedThat route does not accept this method.
409 cannot_cancelThe run has already finished or is not cancellable.
409 cannot_resumeOnly a run waiting for a person can continue.
409 execution_unavailableAgent execution is not configured, or the flow is not ready to run.
409 flow_busyThe flow has an active or paused run. Resume or cancel it first.
409 idempotency_conflictThe request key was already used for different input.
409 invalid_issue_statusOnly an open issue can be marked ready for a retest.
409 quote_changedThe flow or its price changed. Read a fresh quote.
409 resume_unavailableThe flow cannot run in its current setup, so the paused attempt cannot continue.
409 schedule_unavailableThe flow cannot be scheduled until it is ready to run.
409 wrong_run_typeThat route does not apply to this kind of run.
413 request_too_largeThe body must be at most 32 KB.
429 run_limit_reachedThis workspace reached its daily agent-run limit. Nothing started and no credits were reserved. Carries the limit, when it resets, and where to ask for more.
503 authentication_not_configuredRemote access needs account authentication configured.
503 hosting_not_configuredThe deployment is missing a database, sign-in, origin, or cron secret. Nothing was charged.
503 runner_busyThe agent runner is at capacity. The flow is saved; try again shortly.
503 signup_unavailableThis deployment has agent signup turned off, so a workspace cannot be created without a person.
503 workspace_busyThe workspace is locked by another write. Retry; nothing was charged.

Inspection document

Returned by /v1/interface as agent-ready/interface@1. Every string is either fetched or produced by a named rule; no model-generated text is included.

Conventions

observationOne HTTP fetch: id, role, url, status, contentType, bytes, sha256, fetchedAt, discoveredVia (well_known | link from another observation | sitemap), excerpt. Never judged.
fact{ value, method: 'extracted', evidence: [{ obs, quote }] }. Deterministically pulled from an observation. null when not found.
evaluation{ verdict: yes|partial|no|unknown, reason, rule, basedOn: [obs ids], method: 'rule' }. A named rule applied to facts. unknown = not enough observed.
interpretationNot present in this version. No model-generated text is included; every string is either fetched or produced by a named rule.

Fields

generatortool name, version, and the run id
targeturl and host that was inspected
startedAt_finishedAtISO timestamps for the run; each observation has its own fetchedAt
productname, description, category as facts or null
observationsevery fetch made, in order
interfaceswebsite, api, mcp, cli: existence and discoverability as evaluations
capabilitiesderived from OpenAPI tags, untagged operation summaries/IDs, or llms.txt sections; each with evidence and, for OpenAPI, operationDetails preserving summaries and descriptions
authenticationmethods declared in securitySchemes (not necessarily used), separate text mentions, requirement, agentCanUnderstandSetup, friction; none of these establishes live access
authentication_requirement{ value: none|required|mixed|not_declared|unknown, reason, basedOn, rule, operations: [{ operation, value, reason, basedOn, rule, source: operation|global|absent, schemeNames }] }; operation security overrides global security; none requires an explicit operation [] or anonymous {} alternative; absent or empty global security is not_declared; unresolved declarations or incomplete operation coverage are unknown
pricingmodel, plans, observedPrices, agentCanDetermineCost, ambiguities
machineAccessrobots, llms.txt, agent.json facts plus aiCrawlersAllowed and hasAgentReadableIndex
agentJourneysempty in this version; see POST /v1/evaluate
unknownsevery field whose verdict is unknown or whose fact is null, with the reason
limitswhat this run could not do (no JS rendering, no login, no model interpretation)