Skip to content

HTTP_API.md

Latest commit

 

History

History
63 lines (46 loc) · 1.76 KB

HTTP_API.md

File metadata and controls

63 lines (46 loc) · 1.76 KB
Raw

HTTP API

Start the repository graph service:

./codegraph.exe serve --graph .codegraph --listen 127.0.0.1:7777

Endpoints

Method Path Result
GET / Browser query UI
GET /api/graph graph_info result
GET /api/queries Canonical query registry
POST /api/query One query result
POST /mcp One MCP JSON-RPC request

Example query:

$body = @{
  kind = 'callees'
  arguments = @{ symbol = 'app.entry.run'; depth = 3; limit = 100 }
} | ConvertTo-Json -Depth 4

Invoke-RestMethod `
  -Uri 'http://127.0.0.1:7777/api/query' `
  -Method Post `
  -ContentType 'application/json' `
  -Body $body

Request bodies are capped at 1 MiB. Unknown queries and invalid arguments return HTTP 400. Non-POST requests to query and MCP endpoints return 405.

Authentication

Loopback is the default trust boundary. CodeGraph refuses a non-loopback listen address unless a token is supplied:

./codegraph.exe serve --graph .codegraph --listen 0.0.0.0:7777 --token $env:CODEGRAPH_TOKEN
$headers = @{ Authorization = "Bearer $env:CODEGRAPH_TOKEN" }
Invoke-RestMethod 'http://server:7777/api/graph' -Headers $headers

Token comparison is constant-time. The server does not provide TLS, token rotation, user roles, or rate limiting; put a trusted TLS reverse proxy and network policy in front of any non-loopback deployment.

Responses use Cache-Control: no-store. Server timeouts bound headers, reads, writes, and idle connections.

Machine API

Machine graphs use a separate service and schema. Their endpoints are documented in Machine graphs; do not send repository query kinds to a machine service and assume semantic equivalence.