Bernstein Hooks API

openapi: 3.2.0
info:
  title: Bernstein Task Server Hooks API
  description: 'Bernstein REST API - the open-source governance layer for AI agents, one git worktree per task.


    ## Authentication


    Authentication is ENABLED by default. Include a Bearer token in all requests:


    ```

    Authorization: Bearer

    ```


    To run without auth (development only), set `BERNSTEIN_AUTH_DISABLED=1` - this logs a loud warning and passes every request through.


    Public endpoints (no auth required): `/health`, `/health/ready`, `/health/live`, `/ready`, `/alive`, `/.well-known/agent.json`, `/docs`, `/openapi.json`, and the auth-flow endpoints (`/auth/login`, `/auth/oidc/callback`, etc.).


    Webhook and hook endpoints (`/webhook`, `/webhooks/*`, `/hooks/{session_id}`) authenticate via HMAC-SHA256 signatures - they do NOT accept Bearer tokens.


    ## Base URL


    Default: `http://127.0.0.1:8052`. Override with env vars `BERNSTEIN_HOST` and `BERNSTEIN_PORT`.


    ## Error Format


    All errors return JSON with a `detail` field:


    ```json

    {"detail": "Task not found: task-xyz"}

    ```


    | Status | Meaning |

    |--------|---------|

    | 400 | Bad request (validation error) |

    | 401 | Unauthorized (missing/invalid token) |

    | 403 | Forbidden (IP not in allowlist) |

    | 404 | Resource not found |

    | 409 | Conflict (task already in terminal state) |

    | 429 | Rate limited - respect the `Retry-After` header |

    | 500 | Internal server error |'
  version: 3.22.0
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  contact:
    name: Alex Chernysh
    url: https://github.com/sipyourdrink-ltd/bernstein
servers:
- url: http://{host}:{port}
  description: Task server started by the Bernstein CLI on the operator's own machine. There is no hosted instance; substitute the host and port of your install.
  variables:
    host:
      default: 127.0.0.1
      description: Interface the task server binds to. Loopback by default.
    port:
      default: '8052'
      description: Task server port. Override with BERNSTEIN_PORT.
tags:
- name: Hooks
paths:
  /hooks/{session_id}:
    post:
      summary: Receive Hook
      description: 'Receive a hook event from Claude Code.


        Claude Code sends structured JSON with at minimum a ``hook_event_name``

        field. The event is parsed, persisted to a JSONL sidecar, and triggers

        side effects (heartbeat touch, completion markers, etc.).


        The request body is verified against

        ``X-Bernstein-Hook-Signature-256`` (HMAC-SHA256 over the raw body,

        keyed with ``BERNSTEIN_HOOK_SECRET``) *before* any parsing or

        filesystem work - this is the authentication boundary for the

        endpoint. The ``session_id`` is then validated against

        a strict allowlist to prevent path traversal.


        Args:

        session_id: Agent session identifier from the URL path.

        request: The incoming FastAPI request.


        Returns:

        JSON response with status and action taken, 401 if signature

        verification fails, or 400 if ``session_id`` is unsafe / body

        is not valid JSON.'
      operationId: receive_hook_hooks__session_id__post
      parameters:
      - name: session_id
        in: path
        required: true
        schema:
          type: string
          title: Session Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - Hooks
  /api/v1/hooks/{session_id}:
    post:
      summary: Receive Hook
      description: 'Receive a hook event from Claude Code.


        Claude Code sends structured JSON with at minimum a ``hook_event_name``

        field. The event is parsed, persisted to a JSONL sidecar, and triggers

        side effects (heartbeat touch, completion markers, etc.).


        The request body is verified against

        ``X-Bernstein-Hook-Signature-256`` (HMAC-SHA256 over the raw body,

        keyed with ``BERNSTEIN_HOOK_SECRET``) *before* any parsing or

        filesystem work - this is the authentication boundary for the

        endpoint. The ``session_id`` is then validated against

        a strict allowlist to prevent path traversal.


        Args:

        session_id: Agent session identifier from the URL path.

        request: The incoming FastAPI request.


        Returns:

        JSON response with status and action taken, 401 if signature

        verification fails, or 400 if ``session_id`` is unsafe / body

        is not valid JSON.'
      operationId: receive_hook_api_v1_hooks__session_id__post
      parameters:
      - name: session_id
        in: path
        required: true
        schema:
          type: string
          title: Session Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - Hooks
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError