API
API
The full Handoff REST API, covering OpenAPI spec, auth, and the route clusters.
Every registry publishes a full OpenAPI 3.1 spec describing its REST surface, the three-surfaces principle applied to any script or service that isn't a browser or an MCP client. See OpenAPI spec for where it lives and how to browse it.
Route clusters
| Cluster | Auth | Covers |
|---|---|---|
/api/registry/* | Sync bearer (write); public (read) | The singleton config/theme/tokens/icons/etc. a workspace pushes via push:all. |
/api/sync/* | Sync bearer | The component/pattern/page push-pull pipeline (push/pull/sync-status). |
/api/handoff/* | Session cookie | The registry's own app surface: content CRUD, AI, Figma, admin, account. |
/api/oauth/* | — | Device-code and OAuth 2.1 connector flows that issue the bearer tokens everything else uses. |
/api/mcp | Sync bearer / OAuth JWT | The MCP server endpoint — full tool surface documented in the MCP pillar. |
A few smaller, public read-only routes sit outside these clusters, GET /api/components (flat
component list) and GET /api/component/{path} (serves a single built artifact file), see
/api/handoff.
See Auth & scopes for how each of the three credential types works across every cluster above.