OpenAPI 3.1 · Version 2026.4.0-local

Iron Gorilla API

Checked-in OpenAPI snapshot for the external Iron Gorilla developer API surface.

Servers

http://localhost:3001 — Local dev

Auth

Authentication and session management

GET /.well-known/oauth-authorization-server

Get OAuth authorization server metadata

Get OAuth authorization server metadata.

Responses

Response status codes and payloads
Status	Description	Payload
`200`	OAuth authorization server and OpenID Connect discovery metadata	object

GET /.well-known/openid-configuration

Get OpenID Connect discovery metadata

Get OpenID Connect discovery metadata.

Responses

Response status codes and payloads
Status	Description	Payload
`200`	OAuth authorization server and OpenID Connect discovery metadata	object

GET /.well-known/oauth-protected-resource

Get OAuth protected resource metadata

Get OAuth protected resource metadata.

Responses

Response status codes and payloads
Status	Description	Payload
`200`	OAuth protected resource metadata	object

GET /.well-known/jwks.json

Get JSON Web Key Set

Get JSON Web Key Set.

Responses

Response status codes and payloads
Status	Description	Payload
`200`	JSON Web Key Set	object

GET /auth.md

Get Auth.md agent registration instructions

Get Auth.md agent registration instructions.

Responses

Response status codes and payloads
Status	Description	Payload
`200`	Agent authentication registration instructions	string

GET /oauth/authorize

Start OAuth authorization for reviewed agent integrations

Start OAuth authorization for reviewed agent integrations.

Responses

Response status codes and payloads
Status	Description	Payload
`400`	Agent registration is required before OAuth credentials are issued	object

POST /oauth/token

Request an OAuth token for reviewed agent integrations

Request an OAuth token for reviewed agent integrations. See the request schema and example payload for the expected JSON body.

Request body

application/x-www-form-urlencoded schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "grant_type": {
      "type": "string"
    },
    "code": {
      "type": "string"
    },
    "redirect_uri": {
      "type": "string",
      "format": "uri"
    }
  }
}

Responses

Response status codes and payloads
Status	Description	Payload
`400`	Agent registration is required before OAuth credentials are issued	object

Agents

Agent CRUD, editor, lifecycle, and analytics

GET /api/v1/agents/{id}/runs

List recent runs for one agent

List recent runs for one agent. Requires an authenticated session. Supports cursor-based pagination with `cursor` and `limit`.

Authentication required

Request parameters
Name	Location	Type	Description
`id`Required	path	string	Agent ID
`cursor`	query	string	Opaque pagination cursor returned by a previous response.
`limit`	query	integer	Maximum number of items to return.

Responses

Response status codes and payloads
Status	Description	Payload
`200`	Paginated agent run list	PaginatedAgentRuns
`401`	Unauthenticated	ProblemResponse
`403`	Forbidden	ProblemResponse

GET /api/v1/agents/{id}/runs/{jobId}

Get one agent run detail payload

Get one agent run detail payload. Requires an authenticated session.

Authentication required

Request parameters
Name	Location	Type	Description
`id`Required	path	string	Agent ID
`jobId`Required	path	string	Job identifier

Responses

Response status codes and payloads
Status	Description	Payload
`200`	Expanded agent run detail	AgentRunDetail
`401`	Unauthenticated	ProblemResponse
`403`	Forbidden	ProblemResponse

POST /api/v1/agent-webhooks/{pathToken}

Deliver a signed webhook event to a deployed agent trigger

Accepts a provider webhook for a deployed webhook trigger. The client must send a JSON body plus signature headers. The server verifies the HMAC signature, timestamp skew, and replay protection before enqueueing a normal agent job.

Request parameters
Name	Location	Type	Description
`pathToken`Required	path	string	Opaque webhook path token returned by the trigger registration API.
`X-Forge-Delivery-Id`Required	header	string	Unique delivery identifier used for replay protection.
`X-Forge-Webhook-Timestamp`Required	header	string	Unix timestamp in milliseconds included in the webhook signature payload. Requests outside the allowed skew window are rejected.
`X-Forge-Webhook-Signature`Required	header	string	Base64url-encoded HMAC SHA-256 signature for `<timestamp>.<deliveryId>.<rawBody>`.

Request bodyRequired

application/json schema

{
  "description": "Provider-defined JSON payload forwarded into the trigger envelope as `payload` after signature verification succeeds.",
  "type": "object",
  "additionalProperties": true
}

Responses

Response status codes and payloads
Status	Description	Payload
`202`	Webhook accepted	AgentTriggerWebhookDelivery
`400`	Validation error	ProblemResponse
`404`	Resource not found	ProblemResponse
`409`	Webhook trigger disabled	ProblemResponse

Proxy

LLM proxy providers, routing rules, overview, and traces

GET /v1/models

List OpenAI-compatible models available to a proxy key

List OpenAI-compatible models available to a proxy key.

Authentication required

Responses

Response status codes and payloads
Status	Description	Payload
`200`	OpenAI-compatible model list	OpenAiModelListResponse
`401`	Unauthenticated	ProblemResponse
`403`	Forbidden	ProblemResponse

POST /v1/responses

Create an OpenAI-compatible Responses API call

Create an OpenAI-compatible Responses API call. See the request schema and example payload for the expected JSON body.

Authentication required

Request bodyRequired

application/json schema

{
  "$ref": "#/components/schemas/OpenAiResponsesCreateRequest"
}

Responses

Response status codes and payloads
Status	Description	Payload
`200`	OpenAI-compatible response	OpenAiResponsesCreateResponse
`400`	Validation error	ProblemResponse
`401`	Unauthenticated	ProblemResponse
`403`	Forbidden	ProblemResponse

POST /v1/chat/completions

Create an OpenAI-compatible chat completion

Create an OpenAI-compatible chat completion. See the request schema and example payload for the expected JSON body.

Authentication required

Request bodyRequired

application/json schema

{
  "$ref": "#/components/schemas/OpenAiChatCompletionsCreateRequest"
}

Responses

Response status codes and payloads
Status	Description	Payload
`200`	OpenAI-compatible chat completion	OpenAiChatCompletionsCreateResponse
`400`	Validation error	ProblemResponse
`401`	Unauthenticated	ProblemResponse
`403`	Forbidden	ProblemResponse

Health

Service health

GET /api/v1/health

Health check

Returns the API health status used by local tooling, containers, and load balancers.

Responses

Response status codes and payloads
Status	Description	Payload
`200`	Service is healthy	object

GET /api/v1/ready

Readiness check

Checks that the API can acquire a database connection before Cloudflare or deployment automation sends traffic to the instance.

Responses

Response status codes and payloads
Status	Description	Payload
`200`	Service is ready to receive traffic	object
`503`	Service cannot acquire a database connection	object