API reference

The Reflex API is a RESTful JSON API available at https://reflex.expertweb.tools/api/v1.

Sanctum personal-access tokens authenticate dashboard/CI calls. Agent install tokens authenticate host callbacks. The lists below match laravel-backend/routes/api.php — if a path is not listed here, it is not a public contract.

Authentication

All Sanctum requests require a Bearer token. Generate an API token from your dashboard under Settings → API Tokens.

Authorization: Bearer <your-api-token>

Include this header in every request. Example:

curl -H "Authorization: Bearer $REFLEX_API_TOKEN" \
  https://reflex.expertweb.tools/api/v1/deployments/TRIGGER_ID

Replace TRIGGER_ID with a real deployment UUID after you create one. Tokens are scoped to a team. Each token can be given a name and revoked individually.

Base URL

https://reflex.expertweb.tools/api/v1

Rate limits

Authenticated Sanctum routes use Laravel's default API throttling unless a route declares a tighter limiter (for example throttle:120,1 on deployment markers). Agent callbacks use a separate per-server limiter (REFLEX_AGENT_API_RATE_LIMIT_PER_MINUTE, default 600).

Rate-limit headers are included when a named limiter is applied:

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 118
X-RateLimit-Reset: 1714834200

Common endpoints (Sanctum)

There is no GET /servers or GET /servers/{id}/metrics list API for dashboard tokens. Host metrics are posted by the agent (POST /api/v1/metrics). Provisioned cloud servers use the Terraform routes below.

Deployments

Method	Endpoint	Description
POST	/deployments/trigger	Trigger a deployment
GET	/deployments/{id}	Get deployment status
GET	/deployments/{id}/preview	Preview a deployment
POST	/deployments/{id}/rollback	Rollback a deployment

Incidents

Method	Endpoint	Description
GET	/incidents	List incidents
PATCH	/incidents/{id}	Update an incident

There is no incident-detail GET or incident timeline route.

Other Sanctum routes

Method	Endpoint	Description
GET	/servers/{id}/deployment-markers	Deployment markers for a server
GET	/sites/{id}/deployment-environments	Environments for a site
GET	/metrics/export	Export metrics
GET	/infra/map	Infrastructure map
GET	/request-flow	Request flow
GET	/backup-restore-drills	Backup restore drills
GET	/on-call/schedules	On-call schedules
POST	/on-call/schedules	Create an on-call schedule
GET	/terraform/servers	List Terraform-managed servers
POST	/mcp	MCP JSON-RPC

Response format

Successful JSON responses are typically resource objects or { "data": ... } wrappers. Do not assume a uniform meta.request_id envelope on every route.

Error format

Validation and authorization failures return Laravel JSON error payloads (often { "message": "..." } plus errors on 422). Treat HTTP status as the contract.

Webhooks (outbound)

Reflex can notify Settings → Notification channels on deployment lifecycle events. Configure channels in the dashboard.

See Webhooks for event names and verification.

OpenAPI specification

The OpenAPI 3.1 specification (generated from the Laravel route list) is available at:

https://reflex.expertweb.tools/openapi/v1.json

Interactive API documentation is available at /api/docs.