DocsReference

REST API

Automate approvals, access requests, tools, policies and audit exports.

The API lives under /api. Authenticate with a personal token from Connect an agent → Tokens:

curl -H "Authorization: Bearer $GATEHOUSE_TOKEN" https://gatehouse.yourcompany.com/api/me

Requests and responses are JSON. Errors return {"error": "…"} with a 4xx status. What you can do depends on your role: endpoints marked admin need an admin or owner, and viewer also allows auditors.

Endpoints

Method and path	Access	What it does
`GET /api/me`	anyone	Your id, email, name, role and groups (`teams`).
`GET /api/approvals?status=pending`	anyone	Approvals. `status` is `pending`, `approved`, `rejected` or `expired`.
`POST /api/approvals/<id>/decide`	approvers	Body `{"approve": true, "note": "…"}`.
`GET /api/access-requests`	anyone	Your requests, or everyone's for admins and auditors.
`POST /api/access-requests`	anyone	Body `{"tools": ["…"], "reason": "…"}`. The reason needs at least 8 characters.
`POST /api/access-requests/<id>/decide`	admin	Body `{"approve": true, "grant": "allow" or "approve", "approverTeam": "…", "note": "…"}`.
`GET /api/tools`	viewer	Every tool with its status.
`POST /api/tools/<name>/status`	admin	Body `{"status": "enabled"}` or `"disabled"`.
`GET /api/policies`	viewer	All policies.
`PUT /api/policies`	admin	Replace every policy. Body `{"policies": [ … ]}`.
`GET /api/audit?limit=100&before=<seq>`	anyone	Audit entries, newest first. Members get their own. Up to 1000 per page.
`GET /api/audit/verify`	viewer	Checks the hash chain.
`POST /api/upstreams/<name>/refresh`	admin	Reconnect a server and re-read its tools.

The policy format is shown in Policies.

Other endpoints

/mcp is the MCP endpoint for agents. See Connect an agent.
/scim/v2 is for identity providers. See SCIM.
/healthz returns {"ok": true} for load balancer health checks.
OAuth discovery metadata for agents is served under /.well-known/, for example /.well-known/oauth-authorization-server.