Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
openapi: 3.2.0
info:
title: Fluid Recall Admin API
version: 0.0.0
description: 'System of record for spaced recall. One service with four doors: MCP at POST /mcp (also /api/mcp), Markdown /api/v1/agent and /api/v1/dev, and JSON /api/v1. Agents may use whatever works best. None is deprecated. JSON operations sit at the /api/v1 root (/due, /decks, /reviews). Request bodies are JSON. Markdown responses use Content-Type text/plain; the body is Markdown. MCP is stateless Streamable HTTP. Send Authorization: Bearer . No Mcp-Session-Id. The same MCP door speaks the ChatGPT MCP Events subset (events/list, events/subscribe, events/unsubscribe) with webhook-only delivery. Muse bootstraps a personal API token with POST /accounts or POST /bootstrap and keeps drilling. The bearer token is the tenant. This API decides what is due and when it is due next. Bootstrap, reviews, and unauthenticated reads are rate limited. HTTP 429 is retryable. ---'
servers:
- url: /api/v1
security:
- bearerAuth: []
- poppyDpop: []
tags:
- name: Admin
paths:
/admin/metrics:
get:
operationId: adminMetrics
summary: Read traffic counters
description: Operator only. Authorization is the FR_API_TOKEN secret, not a personal API token. Returns increment-only counters, hour/day snapshots, and per-crawler hits. Does not return decks, cards, answers, or user ids. Muse must not call this.
x-muse-action-class: read
responses:
'200':
description: Live counters and retained snapshots.
content:
application/json:
schema:
type: object
'401':
description: Missing or wrong break-glass secret.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'503':
description: Counter storage is unavailable.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
tags:
- Admin
/admin/tokens/{tokenId}/revoke:
post:
operationId: adminRevokeToken
summary: Break-glass revoke
description: Operator only. Authorization is the FR_API_TOKEN secret, not a personal API token. Revokes one token by id. Does not return decks, cards, or answers. Muse must not call this.
x-muse-action-class: write
parameters:
- name: tokenId
in: path
required: true
schema:
type: string
format: uuid
responses:
'200':
description: The token is revoked.
content:
application/json:
schema:
type: object
'401':
description: Missing or wrong break-glass secret.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: No active token with that id.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
tags:
- Admin
/admin/feedback:
get:
operationId: adminListFeedback
summary: List submitted feedback
description: Operator only. Authorization is the FR_API_TOKEN secret, not a personal API token. Returns Kanban cards with account identity and server-derived data-state. Muse must not call this.
x-muse-action-class: read
responses:
'200':
description: Submitted issues, newest first.
content:
application/json:
schema:
type: object
'401':
description: Missing or wrong break-glass secret.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
tags:
- Admin
/admin/feedback/{feedbackId}:
patch:
operationId: adminUpdateFeedback
summary: Set a feedback card status
description: Operator only. Authorization is the FR_API_TOKEN secret. Status is new, investigating, fixed, or closed. Muse must not call this.
x-muse-action-class: write
parameters:
- name: feedbackId
in: path
required: true
schema:
type: string
format: uuid
requestBody:
required: true
content:
application/json:
schema:
type: object
additionalProperties: false
required:
- status
properties:
status:
type: string
enum:
- new
- investigating
- fixed
- closed
responses:
'200':
description: The updated card.
content:
application/json:
schema:
type: object
'400':
description: Invalid status.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Missing or wrong break-glass secret.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: No feedback with that id.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
tags:
- Admin
components:
schemas:
Error:
type: object
additionalProperties: false
required:
- code
- message
- retryable
properties:
code:
type: string
enum:
- BAD_REQUEST
- UNAUTHORIZED
- FORBIDDEN
- NOT_FOUND
- CONFLICT
- UNAVAILABLE
- RATE_LIMITED
message:
type: string
retryable:
type: boolean
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: Personal Fluid Recall API token from POST /accounts (or POST /bootstrap). Save it for API calls. The operator break-glass secret is a different credential and cannot call drill operations.
poppyDpop:
type: http
scheme: DPoP
description: 'Personal Agent Protocol (Poppy v0.1) Session Token from POST https://fluidrecall.com/oauth/token, sent as Authorization: DPoP <token> with a DPoP proof header on every call. poppy:read allows reads and poppy:write allows changes; personal API token management is not available. See https://fluidrecall.com/.well-known/poppy.json and https://fluidrecall.com/docs/personal-agent-protocol.'