API

0.1.0

Team credential wallet for servers. Secrets are envelope-encrypted at rest; POST /credentials/{id}/reveal is the only endpoint returning plaintext and every reveal is audit-logged.

API key

Create one in Settings → API keys. Send Authorization: Bearer sw_… — full read/write or fine-grained scopes like env:read or credentials:reveal.

Session

Signed-in browser sessions use the sw_session cookie automatically.

MCP server

Agents can connect natively over the Model Context Protocol — point your MCP client at POST /api/mcp with the same Bearer key. Stateless JSON-RPC 2.0: initialize → tools/list → tools/call. Fourteen tools (list_servers, reveal_credential, upsert_env, verify_integration, …); write tools need a write-scoped key, reveals are audited. Agent skill file: /skill/SKILL.md.

Endpoints

get/api/v1/health

Health check (no auth)

get/api/v1/me

Who am I? Validates your key/session

get/api/v1/me/2fa

2FA status for the session user (enabled, recovery codes left)

post/api/v1/me/2fa

Start 2FA setup: returns { secret, otpauthUri } (session only)

post/api/v1/me/2fa/enable

Activate 2FA with a valid code. Body: { code }. Returns recovery codes once

post/api/v1/me/2fa/disable

Turn off 2FA. Body: { password }

get/api/v1/servers

List servers (credentials attached, never plaintext secrets)(q, environment, tag)

post/api/v1/servers

Create server (write scope)

get/api/v1/servers/{id}

Get server with credentials

patch/api/v1/servers/{id}

Update server (write scope)

delete/api/v1/servers/{id}

Delete server + credentials (write scope)

post/api/v1/credentials

Create credential (write scope). `secret` is encrypted before storage.

get/api/v1/credentials/{id}

Get credential metadata (no secret)

patch/api/v1/credentials/{id}

Update credential; pass new `secret` to re-encrypt (write scope)

delete/api/v1/credentials/{id}

Delete credential (write scope)

post/api/v1/credentials/{id}/reveal

Reveal plaintext secret — audited

get/api/v1/env

List env vars (metadata only, never values)(environment, app)

post/api/v1/env

Bulk upsert: { vars: [{ environment?, app?, name, value, description? }] } (write scope). Old values archived as versions

get/api/v1/env/export

Plain dotenv text — eval $(curl …). Audited (count only)(environment, app)

get/api/v1/env/diff

Compare two environments by (app, name) + value fingerprint — only-in-A / only-in-B / differ / same. Values never leave(environment, compareTo)

get/api/v1/env/{id}

Env var metadata

delete/api/v1/env/{id}

Delete env var + version history (write scope)

post/api/v1/env/{id}/reveal

Reveal plaintext value — audited, rate-limited (60/min/org). Body: { reason? }

get/api/v1/env/{id}/versions

Previous values (metadata, newest first, max 20)

post/api/v1/env/{id}/rollback

Restore a previous value (write scope). Body: { versionId }

get/api/v1/integrations

Stored third-party service keys (metadata only)

post/api/v1/integrations

Upsert a service key: { service, label, secret, meta? } (write scope)

get/api/v1/integrations/catalog

Services ServersWallet can store & live-verify keys for

delete/api/v1/integrations/{id}

Delete a service key (write scope)

post/api/v1/integrations/{id}/reveal

Plaintext service key — audited, rate-limited. Body: { reason? }

post/api/v1/integrations/{id}/verify

Live-check the key against the vendor API (result stored, never the key)

post/api/mcp

MCP server (JSON-RPC 2.0): initialize, tools/list, tools/call — 14 tools, same auth as REST

get/api/v1/audit

Recent audit log entries(limit)

Machine-readable spec: /api/v1/openapi.json · Liveness: /api/v1/health