Authentication
Authorization: Bearer cb_…
A token only reaches the one repository it was made for, and you can revoke it any time. The dashboard's own endpoints use your signed-in session instead and aren't meant for scripts.
POST /api/cli/preflight
Checks a change against your decisions and architecture rules and returns a verdict: whether it's safe to commit, which decisions it breaks, and instructions an agent can act on. This is what slovey preflight calls.
{
"diff": "diff --git a/src/... ",
"changedFiles": ["src/charges/retry.ts"],
"files": [{ "path": "src/charges/retry.ts", "content": "..." }],
"branch": "feature/retries",
"commitSha": null
}
POST /api/cli/knowledge
Queries the decision graph. Send an op and its args:
{ "op": "can_i", "args": { "intent": "add Redis caching to the auth service" } }
| op | args | Returns |
|---|
| what_applies_here | { paths?, services?, domains?, languages?, frameworks? } | The decisions that govern the code you're about to touch. |
| can_i | { intent } | Whether a change is allowed under your decisions, with what was tried before. |
| ask | { question } | A cited answer about why the code is the way it is. |
| plan | { request } | A step-by-step plan that stays inside your decisions. |
| rejected | { query?, limit? } | Approaches your team already tried and turned down. |
| search | { query } | Search every decision by meaning. |
POST /api/mcp
The same memory as a remote MCP server (Streamable HTTP, stateless, JSON responses) at https://slovey.ai/api/mcp. Clients sign in with OAuth 2.1 (PKCE, dynamic client registration, discovery through /.well-known/oauth-protected-resource), or send the Bearer header above. Tools: what_applies_here, plan, can_i, ask, get_rejected and check_change, which takes a unified diff and says whether it is safe to commit.
New here? Start with the docs.
