API reference

Fastify REST API served at NEXT_PUBLIC_API_URL (default http://localhost:3001). Most dashboard routes proxy through Next.js BFF handlers.

Base URL

# Local
http://localhost:3001

# Health
GET /health

Public endpoints

Method	Path	Description
POST	/api/v1/public/repositories/open	Register + start indexing a public GitHub repo
GET	/api/v1/public/repositories/browse	Search public repos for the Browse page

Repository endpoints

All paths below are prefixed with /api/v1/repositories/:repoId.

Method	Path suffix	Description
GET	/revisions	List indexed revisions
GET	/revisions/:sha	Revision status and counts
GET	/index/status	Current index job state
GET	/index/stream	SSE stream of index progress
POST	/index	Enqueue full re-index
POST	/graph/rebuild	Rebuild dependency graph
POST	/search	Hybrid code search ({ query, topK })
POST	/ask	Ask with citations ({ query, revisionSha })
GET	/graph	Context graph (+ op=shortestPath\|neighborhood\|cycles)
GET	/architecture	Architecture layout payload
GET	/dependencies	Symbol/module traversal queries
GET	/impact	Impact for filePath, symbolName, or pullNumber
GET	/hotspots	Hotspot rankings (?topK=&windowDays=7\|30\|90\|365)
GET	/co-change	Files that change together
POST	/search/history	Search commit messages and PR titles
GET	/similar-changes	Find similar historical diffs (?pullNumber= or ?file=)
GET	/findings	Latest-review findings across PRs (?limit=)
GET	/wiki	Indexed markdown / ADR pages (?path=&revisionSha=&limit=)
GET	/ownership	CODEOWNERS rules + owners for ?path=
GET	/pulls	List pull requests
GET	/pulls/:number	PR details + review
POST	/pulls/:number/review	Trigger PR review
GET	/reviews/history	Past review runs
GET	/analytics	Repository analytics summary
POST	/history/ingest	Ingest git history
GET	/symbols/:name/history	Symbol change timeline

Webhooks

POST /webhook
# GitHub push/PR events (requires GITHUB_WEBHOOK_SECRET)

Example: search

curl -X POST http://localhost:3001/api/v1/repositories/$REPO_ID/search \
  -H 'Content-Type: application/json' \
  -d '{"query":"authenticate user","topK":5}'

Authentication

Dashboard pages call Next.js API routes under /pages/api/repositories/[repoId]/, which attach the internal secret. Direct API access in production should go through the same BFF or supply INTERNAL_API_SECRET as configured in api/.env.

See Development for env setup.