The API…

One token guards all of it, in an Authorization: Bearer … header, or a ?token= query for the places a header cannot go — a WebSocket, an <img>, a page opened directly. Anyone holding it can run anything you can, so treat it like an SSH key.

Everything lives under /api, this document included, so a single rule guards the lot. The one exception is /proxy/…, which is a service of yours being passed through.

The most useful thing to build against first is POST /api/bell — how an agent says it has finished, or wants you. It needs nothing but curl:

curl -s -X POST http://your-server:8090/api/bell \
  -H "Authorization: Bearer $ARGUS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"session":"build","why":"done","text":"the tests passed"}'

The machine-readable description is openapi.json — point Swagger UI, Postman or a client generator at it. A running server serves its own at /api/openapi.json, behind the token.