<!-- https://avertgate.com/docs/api · Reference -->

# API reference

The main endpoints used by the gateway and the dashboard. All requests are JSON.

## Authentication

For programmatic access use the `Authorization: Bearer ag_live_…` header. For the dashboard, a session cookie.

## Gateway

### GET /api/gateway/resolve

Returns an agent's policy.

<!-- request -->
```
GET /api/gateway/resolve
Authorization: Bearer ag_live_xxx
X-Agent-Key: agk_xxx
```

<!-- 200 OK -->
```
{
  "agentId": "…",
  "agentKey": "agk_xxx",
  "name": "support-agent-v1",
  "orgId": "…",
  "policyYaml": "agent: support-agent-v1\n…"
}
```

| Code | Meaning |
| --- | --- |
| 400 | `agentKey` missing. |
| 404 | No such agent (or it belongs to another tenant). |
| 403 | The agent is paused. |

### POST /api/events/ingest

Sends redacted audit events. Body: `{ "events": [...] }`, `{ "event": {...} }` or a bare array. At most **100** events per request.

## Events

| Endpoint | Description |
| --- | --- |
| `GET /api/events` | Event list (filterable). |
| `GET /api/events/stats` | Summary counts. |
| `GET /api/events/sessions` | Session summaries. |
| `GET /api/events/timeseries` | Time series. |
| `GET /api/events/insights` | Insights. |
| `GET /api/events/:correlationId` | Full detail of a single call. |

## Policy

| Endpoint | Description |
| --- | --- |
| `GET /api/policy` | The current policy. |
| `POST /api/policy/validate` | Validate YAML without saving. |
| `PUT /api/policy` | Save the policy. |

## Management

| Endpoint | Description |
| --- | --- |
| `GET/POST/PUT/DELETE /api/agents` | Agent registry. |
| `GET/POST/DELETE /api/settings/keys` | API keys. |
| `GET /api/status` | System status. |

> **Note**: Endpoints are scoped per tenant and rate limited.