<!-- generated by src/lib/agentSkills/generator.ts; manual edits will be overwritten -->

# Endpoint reference

## Table of contents

- [`GET /api/providers`](#get-apiproviders)
- [`POST /api/providers`](#post-apiproviders)
- [`GET /api/providers/{id}`](#get-apiprovidersid)
- [`PATCH /api/providers/{id}`](#patch-apiprovidersid)
- [`DELETE /api/providers/{id}`](#delete-apiprovidersid)
- [`POST /api/providers/{id}/test`](#post-apiprovidersidtest)
- [`GET /api/providers/{id}/test-message`](#get-apiprovidersidtest-message)
- [`POST /api/providers/{id}/test-message`](#post-apiprovidersidtest-message)
- [`PUT /api/providers/{id}/test-message`](#put-apiprovidersidtest-message)
- [`GET /api/providers/{id}/models`](#get-apiprovidersidmodels)
- [`GET /api/providers/cursor/agent-availability`](#get-apiproviderscursoragent-availability)
- [`POST /api/providers/test-batch`](#post-apiproviderstest-batch)
- [`POST /api/providers/validate`](#post-apiprovidersvalidate)
- [`GET /api/providers/client`](#get-apiprovidersclient)
- [`POST /api/providers/agy-auth/import`](#post-apiprovidersagy-authimport)
- [`POST /api/providers/agy-auth/import-bulk`](#post-apiprovidersagy-authimport-bulk)
- [`POST /api/providers/agy-auth/zip-extract`](#post-apiprovidersagy-authzip-extract)
- [`POST /api/providers/agy-auth/apply-local`](#post-apiprovidersagy-authapply-local)
- [`GET /api/provider-nodes`](#get-apiprovider-nodes)
- [`POST /api/provider-nodes`](#post-apiprovider-nodes)
- [`PATCH /api/provider-nodes/{id}`](#patch-apiprovider-nodesid)
- [`DELETE /api/provider-nodes/{id}`](#delete-apiprovider-nodesid)
- [`POST /api/provider-nodes/validate`](#post-apiprovider-nodesvalidate)
- [`GET /api/provider-models`](#get-apiprovider-models)
- [`PUT /api/provider-models`](#put-apiprovider-models)
- [`POST /api/provider-models/validate-and-add`](#post-apiprovider-modelsvalidate-and-add)
- [`GET /api/providers/{id}/cc-alias`](#get-apiprovidersidcc-alias)
- [`PUT /api/providers/{id}/cc-alias`](#put-apiprovidersidcc-alias)
- [`GET /api/providers/{id}/chatgpt-web-codex-doctor`](#get-apiprovidersidchatgpt-web-codex-doctor)
- [`POST /api/providers/{id}/claude-auth/apply-local`](#post-apiprovidersidclaude-authapply-local)
- [`POST /api/providers/{id}/claude-auth/export`](#post-apiprovidersidclaude-authexport)
- [`POST /api/providers/{id}/codex-auth/apply-local`](#post-apiprovidersidcodex-authapply-local)
- [`POST /api/providers/{id}/codex-auth/export`](#post-apiprovidersidcodex-authexport)
- [`GET /api/providers/{id}/interception-rules`](#get-apiprovidersidinterception-rules)
- [`PUT /api/providers/{id}/interception-rules`](#put-apiprovidersidinterception-rules)
- [`DELETE /api/providers/{id}/interception-rules`](#delete-apiprovidersidinterception-rules)
- [`POST /api/providers/{id}/login`](#post-apiprovidersidlogin)
- [`GET /api/providers/{id}/param-filters`](#get-apiprovidersidparam-filters)
- [`PUT /api/providers/{id}/param-filters`](#put-apiprovidersidparam-filters)
- [`DELETE /api/providers/{id}/param-filters`](#delete-apiprovidersidparam-filters)
- [`POST /api/providers/{id}/refresh`](#post-apiprovidersidrefresh)
- [`POST /api/providers/{id}/refresh-cursor`](#post-apiprovidersidrefresh-cursor)
- [`POST /api/providers/{id}/refresh-token`](#post-apiprovidersidrefresh-token)
- [`POST /api/providers/{id}/sync-models`](#post-apiprovidersidsync-models)
- [`POST /api/providers/bulk`](#post-apiprovidersbulk)
- [`POST /api/providers/bulk-web-session`](#post-apiprovidersbulk-web-session)
- [`POST /api/providers/claude-auth/import`](#post-apiprovidersclaude-authimport)
- [`POST /api/providers/claude-auth/import-bulk`](#post-apiprovidersclaude-authimport-bulk)
- [`POST /api/providers/claude-auth/zip-extract`](#post-apiprovidersclaude-authzip-extract)
- [`POST /api/providers/codex-auth/import`](#post-apiproviderscodex-authimport)
- [`POST /api/providers/codex-auth/import-bulk`](#post-apiproviderscodex-authimport-bulk)
- [`POST /api/providers/codex-auth/zip-extract`](#post-apiproviderscodex-authzip-extract)
- [`POST /api/providers/command-code/auth/apply`](#post-apiproviderscommand-codeauthapply)
- [`POST /api/providers/command-code/auth/callback`](#post-apiproviderscommand-codeauthcallback)
- [`POST /api/providers/command-code/auth/start`](#post-apiproviderscommand-codeauthstart)
- [`GET /api/providers/command-code/auth/status`](#get-apiproviderscommand-codeauthstatus)
- [`POST /api/providers/command-code/auth/status`](#post-apiproviderscommand-codeauthstatus)
- [`GET /api/providers/expiration`](#get-apiprovidersexpiration)
- [`GET /api/providers/free-onboarding`](#get-apiprovidersfree-onboarding)
- [`POST /api/providers/free-onboarding`](#post-apiprovidersfree-onboarding)
- [`GET /api/providers/health-autopilot`](#get-apiprovidershealth-autopilot)
- [`POST /api/providers/health-autopilot/actions`](#post-apiprovidershealth-autopilotactions)
- [`GET /api/providers/health-matrix`](#get-apiprovidershealth-matrix)
- [`POST /api/providers/import`](#post-apiprovidersimport)
- [`GET /api/providers/openrouter-stats`](#get-apiprovidersopenrouter-stats)
- [`GET /api/providers/quota-windows`](#get-apiprovidersquota-windows)
- [`POST /api/providers/volcengine-plan/connect`](#post-apiprovidersvolcengine-planconnect)
- [`POST /api/providers/volcengine-plan/connect/{sessionId}/cancel`](#post-apiprovidersvolcengine-planconnectsessionidcancel)
- [`POST /api/providers/volcengine-plan/connect/{sessionId}/code`](#post-apiprovidersvolcengine-planconnectsessionidcode)
- [`POST /api/providers/volcengine-plan/connect/{sessionId}/identity`](#post-apiprovidersvolcengine-planconnectsessionididentity)
- [`POST /api/providers/volcengine-plan/connect/{sessionId}/resend`](#post-apiprovidersvolcengine-planconnectsessionidresend)
- [`GET /api/providers/volcengine-plan/connect/{sessionId}/status`](#get-apiprovidersvolcengine-planconnectsessionidstatus)
- [`GET /api/providers/web-session-contract`](#get-apiprovidersweb-session-contract)
- [`POST /api/providers/zed/discover`](#post-apiproviderszeddiscover)
- [`POST /api/providers/zed/import`](#post-apiproviderszedimport)
- [`POST /api/providers/zed/manual-import`](#post-apiproviderszedmanual-import)

### GET /api/providers

List provider connections

```bash
curl http://localhost:20128/api/providers \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers

Create provider connection

```bash
curl -X POST http://localhost:20128/api/providers \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/{id}

Get provider connection

```bash
curl http://localhost:20128/api/providers/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### PATCH /api/providers/{id}

Update provider connection

```bash
curl -X PATCH http://localhost:20128/api/providers/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### DELETE /api/providers/{id}

Delete provider connection

```bash
curl -X DELETE http://localhost:20128/api/providers/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/{id}/test

Test provider connection

```bash
curl -X POST http://localhost:20128/api/providers/{id}/test \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/{id}/test-message

Read an account's saved test model and the global test message

Requires management authentication. Returns modelId and prompt without credentials.

```bash
curl http://localhost:20128/api/providers/{id}/test-message \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/{id}/test-message

Send one real test message through the selected account

Requires management authentication. Uses the account's saved model and the global connectionTestPrompt setting (default: What is 1 + 1? Reply with only the number.). The prompt is configurable through PATCH /api/settings and limited to 500 characters. This manual request bypasses the response cache, uses only this connection and never falls back to another account. It consumes quota; usage-window behavior is determined by the provider. Saving settings does not schedule requests.

```bash
curl -X POST http://localhost:20128/api/providers/{id}/test-message \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### PUT /api/providers/{id}/test-message

Save the chat model used by this account's test-message button

Requires management authentication. Saving never sends an inference request.

```bash
curl -X PUT http://localhost:20128/api/providers/{id}/test-message \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/{id}/models

List models for a provider

```bash
curl http://localhost:20128/api/providers/{id}/models \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### GET /api/providers/cursor/agent-availability

Check cursor-agent availability

Credential-free, informational check for whether cursor-agent is installed and authenticated on this host — backs the dashboard's dismissible install-nudge banner. Returns only cursorAgentAvailable (boolean); never tokens or machineId.

```bash
curl http://localhost:20128/api/providers/cursor/agent-availability \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/test-batch

Test multiple providers at once

```bash
curl -X POST http://localhost:20128/api/providers/test-batch \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/validate

Validate provider credentials

Validates provider credentials over HTTP. The devin CLI-spawn fallback is call-site gated on the trusted peer-locality header (loopback/LAN only, Hard Rules #15/#17, audit #15159 S-01, #15766 shape); the route itself is management-auth remote-reachable.

```bash
curl -X POST http://localhost:20128/api/providers/validate \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/client

Get client-side provider info

```bash
curl http://localhost:20128/api/providers/client \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/agy-auth/import

Import an Antigravity CLI (agy) token file as an `agy` connection

```bash
curl -X POST http://localhost:20128/api/providers/agy-auth/import \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/agy-auth/import-bulk

Bulk-import multiple Antigravity CLI (agy) token files (up to 50)

```bash
curl -X POST http://localhost:20128/api/providers/agy-auth/import-bulk \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/agy-auth/zip-extract

Extract `.json` token files from an uploaded ZIP for agy bulk import

```bash
curl -X POST http://localhost:20128/api/providers/agy-auth/zip-extract \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/agy-auth/apply-local

Auto-detect and import the local Antigravity CLI (agy) login from disk

```bash
curl -X POST http://localhost:20128/api/providers/agy-auth/apply-local \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/provider-nodes

List provider nodes

```bash
curl http://localhost:20128/api/provider-nodes \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/provider-nodes

Create provider node

Optional `providerIdSuffix` (letters, digits, `-`, `_`, `.`; max 64; must start with a letter or digit) replaces the random UUID in the generated node id (`openai-compatible-<apiType>-<suffix>`, `anthropic-compatible-<suffix>`, `anthropic-compatible-cc-<suffix>`). Blank keeps the UUID.

```bash
curl -X POST http://localhost:20128/api/provider-nodes \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### PATCH /api/provider-nodes/{id}

Update provider node

```bash
curl -X PATCH http://localhost:20128/api/provider-nodes/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### DELETE /api/provider-nodes/{id}

Delete provider node

```bash
curl -X DELETE http://localhost:20128/api/provider-nodes/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/provider-nodes/validate

Validate a provider node

```bash
curl -X POST http://localhost:20128/api/provider-nodes/validate \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/provider-models

List provider models

With a provider query parameter, includes modelOutputOverrides for manual output-token caps, including synced models without a custom-model row.

```bash
curl http://localhost:20128/api/provider-models \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### PUT /api/provider-models

Update model metadata or per-model overrides

Requires management authentication. maxOutputTokenOverride sets a manual max_output_tokens capability without creating a custom-model row when it is the only change. A null value clears that override. Existing metadata fields remain available on this operation.

```bash
curl -X PUT http://localhost:20128/api/provider-models \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/provider-models/validate-and-add

Validate and add a custom chat model on one exact connection

Always requires management authentication and explicit inference consent. Runs bounded generation, streamed synthetic tool-call and continuation proofs through the chat core; no real tool is executed. Configuration changes, alternate connections, retries and proxy executor fallback fail closed. Only after all proofs pass is a previously absent custom model inserted and read back atomically. Every response is Cache-Control no-store. Requests can incur upstream charges. The validation receipt is informational, not redeemable. Initial strict support is limited to native Base/Default execution for OpenAI and canonical OpenAI-compatible nodes using a single Bearer credential and an exact JSON model field. Specialized executors and other providers are unsupported; session pools, extra-key rotation, HTTP redirects and credential refresh are refused. Active runtime plugins also fail closed; plugin policies are not silently skipped.

```bash
curl -X POST http://localhost:20128/api/provider-models/validate-and-add \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/{id}/cc-alias

GET providers › <id> › cc alias

```bash
curl http://localhost:20128/api/providers/{id}/cc-alias \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### PUT /api/providers/{id}/cc-alias

PUT providers › <id> › cc alias

```bash
curl -X PUT http://localhost:20128/api/providers/{id}/cc-alias \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/{id}/chatgpt-web-codex-doctor

GET providers › <id> › chatgpt web codex doctor

```bash
curl http://localhost:20128/api/providers/{id}/chatgpt-web-codex-doctor \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/{id}/claude-auth/apply-local

POST providers › <id> › claude auth › apply local

```bash
curl -X POST http://localhost:20128/api/providers/{id}/claude-auth/apply-local \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/{id}/claude-auth/export

POST providers › <id> › claude auth › export

```bash
curl -X POST http://localhost:20128/api/providers/{id}/claude-auth/export \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/{id}/codex-auth/apply-local

POST providers › <id> › codex auth › apply local

```bash
curl -X POST http://localhost:20128/api/providers/{id}/codex-auth/apply-local \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/{id}/codex-auth/export

POST providers › <id> › codex auth › export

```bash
curl -X POST http://localhost:20128/api/providers/{id}/codex-auth/export \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/{id}/interception-rules

GET providers › <id> › interception rules

```bash
curl http://localhost:20128/api/providers/{id}/interception-rules \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### PUT /api/providers/{id}/interception-rules

PUT providers › <id> › interception rules

```bash
curl -X PUT http://localhost:20128/api/providers/{id}/interception-rules \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### DELETE /api/providers/{id}/interception-rules

DELETE providers › <id> › interception rules

```bash
curl -X DELETE http://localhost:20128/api/providers/{id}/interception-rules \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/{id}/login

POST providers › <id> › login

```bash
curl -X POST http://localhost:20128/api/providers/{id}/login \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/{id}/param-filters

GET providers › <id> › param filters

```bash
curl http://localhost:20128/api/providers/{id}/param-filters \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### PUT /api/providers/{id}/param-filters

PUT providers › <id> › param filters

```bash
curl -X PUT http://localhost:20128/api/providers/{id}/param-filters \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### DELETE /api/providers/{id}/param-filters

DELETE providers › <id> › param filters

```bash
curl -X DELETE http://localhost:20128/api/providers/{id}/param-filters \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/{id}/refresh

POST providers › <id> › refresh

```bash
curl -X POST http://localhost:20128/api/providers/{id}/refresh \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/{id}/refresh-cursor

POST providers › <id> › refresh cursor

```bash
curl -X POST http://localhost:20128/api/providers/{id}/refresh-cursor \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/{id}/refresh-token

POST providers › <id> › refresh token

```bash
curl -X POST http://localhost:20128/api/providers/{id}/refresh-token \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/{id}/sync-models

POST providers › <id> › sync models

```bash
curl -X POST http://localhost:20128/api/providers/{id}/sync-models \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/bulk

POST providers › bulk

The devin CLI-spawn fallback (webProvidersB.ts) is call-site gated on the trusted peer-locality header — loopback/LAN only (Hard Rules #15/#17, audit #15159 S-01, #15766 shape); the route is management-auth remote-reachable.

```bash
curl -X POST http://localhost:20128/api/providers/bulk \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/bulk-web-session

POST providers › bulk web session

```bash
curl -X POST http://localhost:20128/api/providers/bulk-web-session \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/claude-auth/import

POST providers › claude auth › import

```bash
curl -X POST http://localhost:20128/api/providers/claude-auth/import \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/claude-auth/import-bulk

POST providers › claude auth › import bulk

```bash
curl -X POST http://localhost:20128/api/providers/claude-auth/import-bulk \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/claude-auth/zip-extract

POST providers › claude auth › zip extract

```bash
curl -X POST http://localhost:20128/api/providers/claude-auth/zip-extract \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/codex-auth/import

POST providers › codex auth › import

```bash
curl -X POST http://localhost:20128/api/providers/codex-auth/import \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/codex-auth/import-bulk

POST providers › codex auth › import bulk

```bash
curl -X POST http://localhost:20128/api/providers/codex-auth/import-bulk \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/codex-auth/zip-extract

POST providers › codex auth › zip extract

```bash
curl -X POST http://localhost:20128/api/providers/codex-auth/zip-extract \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/command-code/auth/apply

POST providers › command code › auth › apply

```bash
curl -X POST http://localhost:20128/api/providers/command-code/auth/apply \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/command-code/auth/callback

POST providers › command code › auth › callback

```bash
curl -X POST http://localhost:20128/api/providers/command-code/auth/callback \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/command-code/auth/start

POST providers › command code › auth › start

```bash
curl -X POST http://localhost:20128/api/providers/command-code/auth/start \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/command-code/auth/status

GET providers › command code › auth › status

```bash
curl http://localhost:20128/api/providers/command-code/auth/status \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/command-code/auth/status

POST providers › command code › auth › status

```bash
curl -X POST http://localhost:20128/api/providers/command-code/auth/status \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/expiration

GET providers › expiration

```bash
curl http://localhost:20128/api/providers/expiration \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### GET /api/providers/free-onboarding

GET providers › free onboarding

```bash
curl http://localhost:20128/api/providers/free-onboarding \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/free-onboarding

POST providers › free onboarding

```bash
curl -X POST http://localhost:20128/api/providers/free-onboarding \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/health-autopilot

GET providers › health autopilot

```bash
curl http://localhost:20128/api/providers/health-autopilot \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/health-autopilot/actions

POST providers › health autopilot › actions

```bash
curl -X POST http://localhost:20128/api/providers/health-autopilot/actions \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/health-matrix

GET providers › health matrix

```bash
curl http://localhost:20128/api/providers/health-matrix \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/import

POST providers › import

The devin CLI-spawn fallback (webProvidersB.ts) is call-site gated on the trusted peer-locality header — loopback/LAN only (Hard Rules #15/#17, audit #15159 S-01, #15766 shape); the route is management-auth remote-reachable.

```bash
curl -X POST http://localhost:20128/api/providers/import \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/openrouter-stats

GET providers › openrouter stats

```bash
curl http://localhost:20128/api/providers/openrouter-stats \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### GET /api/providers/quota-windows

GET providers › quota windows

```bash
curl http://localhost:20128/api/providers/quota-windows \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/volcengine-plan/connect

POST providers › volcengine plan › connect

```bash
curl -X POST http://localhost:20128/api/providers/volcengine-plan/connect \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/volcengine-plan/connect/{sessionId}/cancel

POST providers › volcengine plan › connect › <sessionId> › cancel

```bash
curl -X POST http://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/cancel \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/volcengine-plan/connect/{sessionId}/code

POST providers › volcengine plan › connect › <sessionId> › code

```bash
curl -X POST http://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/code \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/volcengine-plan/connect/{sessionId}/identity

POST providers › volcengine plan › connect › <sessionId> › identity

```bash
curl -X POST http://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/identity \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/volcengine-plan/connect/{sessionId}/resend

POST providers › volcengine plan › connect › <sessionId> › resend

```bash
curl -X POST http://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/resend \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/providers/volcengine-plan/connect/{sessionId}/status

GET providers › volcengine plan › connect › <sessionId> › status

```bash
curl http://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/status \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### GET /api/providers/web-session-contract

GET providers › web session contract

```bash
curl http://localhost:20128/api/providers/web-session-contract \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/providers/zed/discover

POST providers › zed › discover

```bash
curl -X POST http://localhost:20128/api/providers/zed/discover \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/zed/import

POST providers › zed › import

```bash
curl -X POST http://localhost:20128/api/providers/zed/import \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### POST /api/providers/zed/manual-import

POST providers › zed › manual import

```bash
curl -X POST http://localhost:20128/api/providers/zed/manual-import \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```