usewrit-app Selectors API

openapi: 3.2.0
info:
  title: Writ Agent Selectors API
  version: 0.1.0
  license:
    name: MIT
    identifier: MIT
  description: 'Loopback HTTP API of the Writ local agent (`writ-agentd`), the daemon embedded in the

    Writ desktop app and the self-host build. This document is generated against the Rust

    daemon source (`writ-agent/src/local/`), which is the wire truth.


    ## Transport


    - Plain HTTP on `127.0.0.1:8131` (default; `WRIT_PORT` env overrides).

    - Optional HTTPS twin on `127.0.0.1:8132`, served with a certificate minted by a

    per-install, name-constrained local CA (`~/.writ/tls/ca.pem`). Clients must trust that

    CA file (or pin it) to use the TLS port; the payloads are identical on both ports.

    - The daemon enforces a DNS-rebind guard: `Host`/`Origin` must be loopback. Talk to

    `127.0.0.1`, not `localhost`.


    ## Errors


    Domain errors are JSON `{"error": "", "code": ""}` (see the

    `Error` schema). Codes include `bad_request`, `unauthorized`, `forbidden`, `not_found`,

    `vault_locked` (HTTP 423), `too_many_requests`, `device_capacity` (HTTP 409),

    `captcha_required` (HTTP 402), `internal`.


    **Caveat:** some 4xx bodies are `text/plain`, not JSON — axum framework rejections

    (e.g. a JSON body that fails to deserialize returns

    `Failed to deserialize the JSON body into the target type: missing field ''url''` as

    plain text with a 4xx status). Clients must tolerate non-JSON error bodies.


    ## List envelopes


    The wire is deliberately documented as-is (SDKs normalize; this spec does not):


    - `{"data": [...], "count": n}` — workflows, personas, persona runs, secrets, files, keys

    - `{"data": [...], "count": n, "total": n}` — runs

    - **bare JSON array** — monitors, monitor selectors, extractors, automations,

    `/v1/changes/recent`

    - bespoke objects — `/v1/monitors/{id}/changes`, `/v1/data`, the workflow-data table'
servers:
- url: http://127.0.0.1:8131
  description: Plain-HTTP loopback listener (default port; WRIT_PORT overrides).
- url: https://127.0.0.1:8132
  description: HTTPS twin of the same API, terminated with a certificate from the per-install local CA at ~/.writ/tls/ca.pem. Trust that CA (or pin it) in your HTTP client.
security:
- bearerAuth: []
tags:
- name: selectors
  description: Per-monitor content selectors (text / html / visual) nested under monitors.
paths:
  /v1/monitors/{id}/selectors:
    parameters:
    - $ref: '#/components/parameters/MonitorId'
    get:
      operationId: listSelectors
      tags:
      - selectors
      summary: List a monitor's selectors
      description: The monitor's content selectors (all, or `?enabled_only=true`). **Returns a bare JSON array** (capped at 500 rows).
      parameters:
      - name: enabled_only
        in: query
        description: Only selectors with `enabled = 1`.
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: Bare array of selectors.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Selector'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: createSelector
      tags:
      - selectors
      summary: Add a selector to a monitor
      description: Requires a non-empty `selector`; `name` defaults to the selector string. The monitor id comes from the path, not the body.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SelectorCreate'
      responses:
        '200':
          description: The created selector row.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Selector'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /v1/monitors/{id}/selectors/{selector_id}:
    parameters:
    - $ref: '#/components/parameters/MonitorId'
    - $ref: '#/components/parameters/SelectorId'
    get:
      operationId: getSelector
      tags:
      - selectors
      summary: Get one selector
      description: One selector. A valid selector id under the wrong monitor is a 404 (ownership is enforced on every selector-scoped route).
      responses:
        '200':
          description: The selector row.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Selector'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: updateSelector
      tags:
      - selectors
      summary: Update a selector
      description: Partial update; returns the refreshed row.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SelectorUpdate'
      responses:
        '200':
          description: The refreshed selector row.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Selector'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: deleteSelector
      tags:
      - selectors
      summary: Delete a selector
      description: Hard-delete (cascades to its extractors).
      responses:
        '200':
          description: Deletion acknowledgement.
          content:
            application/json:
              schema:
                type: object
                required:
                - deleted
                - selector_id
                properties:
                  deleted:
                    type: boolean
                  selector_id:
                    type: integer
                    format: int64
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /v1/monitors/{id}/selectors/{selector_id}/toggle:
    post:
      operationId: toggleSelector
      tags:
      - selectors
      summary: Toggle a selector's enabled flag
      description: Flips `enabled` and returns the new state.
      parameters:
      - $ref: '#/components/parameters/MonitorId'
      - $ref: '#/components/parameters/SelectorId'
      responses:
        '200':
          description: The new enabled state.
          content:
            application/json:
              schema:
                type: object
                required:
                - selector_id
                - enabled
                properties:
                  selector_id:
                    type: integer
                    format: int64
                  enabled:
                    type: boolean
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /v1/monitors/{id}/selectors/{selector_id}/test:
    post:
      operationId: testSelector
      tags:
      - selectors
      summary: Probe a selector against the live page
      description: Fetches the page now and reports what this selector resolves to, without persisting anything. Explicit user action — skips the scheduler's anti-detection floor.
      parameters:
      - $ref: '#/components/parameters/MonitorId'
      - $ref: '#/components/parameters/SelectorId'
      responses:
        '200':
          description: The live probe result.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SelectorProbe'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /v1/monitors/{id}/selectors/{selector_id}/set-baseline:
    post:
      operationId: setSelectorBaseline
      tags:
      - selectors
      summary: Capture the selector's baseline
      description: Captures this selector's baseline from a fresh live fetch.
      parameters:
      - $ref: '#/components/parameters/MonitorId'
      - $ref: '#/components/parameters/SelectorId'
      responses:
        '200':
          description: The probe used to (re)seed the baseline.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SelectorProbe'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /v1/monitors/{id}/selectors/{selector_id}/clear-baseline:
    post:
      operationId: clearSelectorBaseline
      tags:
      - selectors
      summary: Clear the stored baseline
      description: Drops the stored baseline so the next check re-seeds it.
      parameters:
      - $ref: '#/components/parameters/MonitorId'
      - $ref: '#/components/parameters/SelectorId'
      responses:
        '200':
          description: Baseline cleared.
          content:
            application/json:
              schema:
                type: object
                required:
                - selector_id
                - cleared
                properties:
                  selector_id:
                    type: integer
                    format: int64
                  cleared:
                    type: boolean
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  schemas:
    Selector:
      type: object
      description: One monitor content selector (`store::target_selectors::TargetSelector`).
      required:
      - id
      - target_id
      - name
      - selector
      - enabled
      - created_at
      properties:
        id:
          type: integer
          format: int64
        target_id:
          type: integer
          format: int64
        name:
          type: string
        selector:
          type: string
        description:
          type:
          - string
          - 'null'
        enabled:
          type: integer
          description: 0/1 integer flag.
        content_type:
          type:
          - string
          - 'null'
          description: '`text` | `html` | `visual`.'
        visual_region:
          type:
          - string
          - 'null'
          description: JSON-TEXT region descriptor (visual selectors).
        ignore_regex:
          type:
          - string
          - 'null'
        priority:
          type:
          - integer
          - 'null'
          format: int64
        baseline_hash:
          type:
          - string
          - 'null'
        baseline_content:
          type:
          - string
          - 'null'
        baseline_screenshot:
          type:
          - string
          - 'null'
        baseline_fetched_at:
          type:
          - string
          - 'null'
        last_content_hash:
          type:
          - string
          - 'null'
        last_checked_at:
          type:
          - string
          - 'null'
        change_count:
          type:
          - integer
          - 'null'
          format: int64
        created_at:
          type: string
        updated_at:
          type:
          - string
          - 'null'
    SelectorUpdate:
      type: object
      description: Partial update — same flexible shapes as create, all optional.
      properties:
        name:
          type:
          - string
          - 'null'
        selector:
          type:
          - string
          - 'null'
        description:
          type:
          - string
          - 'null'
        enabled:
          type:
          - boolean
          - integer
          - 'null'
        content_type:
          type:
          - string
          - 'null'
        visual_region:
          description: Region object (or JSON string).
        ignore_regex:
          type:
          - string
          - 'null'
        priority:
          type:
          - integer
          - string
          - 'null'
    Error:
      type: object
      description: 'The daemon''s domain error body. NOTE: some 4xx responses (axum framework rejections) are `text/plain` instead of this JSON shape. Certain codes attach extra fields (e.g. `device_capacity` adds `would_use_units_per_min` / `budget_units_per_min`; `captcha_required` adds `captcha_type` / `url`).'
      required:
      - error
      - code
      properties:
        error:
          type: string
          description: 'Human-readable message (e.g. `not found: workflow 999999`).'
        code:
          type: string
          description: 'Stable machine code: `bad_request`, `unauthorized`, `forbidden`, `not_found`, `vault_locked`, `too_many_requests`, `captcha_required`, `device_capacity`, `cloud_unreachable`, `db_error`, `io_error`, `json_error`, `internal`, …'
      additionalProperties: true
    SelectorProbe:
      type: object
      description: Live probe result (`monitor::SelectorProbe`). Optional fields are OMITTED when absent.
      required:
      - selector_id
      - matched
      properties:
        selector_id:
          type: integer
          format: int64
        matched:
          type: boolean
        content:
          type: string
          description: Extracted text/html (truncated). Omitted for visual selectors or on a miss.
        content_hash:
          type: string
          description: SHA-256 content hash (text/html) or pixel hash (visual). Omitted on a miss.
        screenshot:
          type: string
          description: Base64 PNG of the captured region (visual selectors only).
        status_code:
          type: integer
          format: int64
        error:
          type: string
          description: Present when the selector did not resolve.
    SelectorCreate:
      type: object
      description: Create body. The monitor id comes from the path. `enabled` accepts a boolean or 0/1 integer; `visual_region` accepts an object or a JSON string; `priority` also accepts a numeric string.
      required:
      - selector
      properties:
        name:
          type: string
          description: Defaults to the selector string when empty.
        selector:
          type: string
        description:
          type:
          - string
          - 'null'
        enabled:
          type:
          - boolean
          - integer
          - 'null'
        content_type:
          type:
          - string
          - 'null'
        visual_region:
          description: Region object (or JSON string).
        ignore_regex:
          type:
          - string
          - 'null'
        priority:
          type:
          - integer
          - string
          - 'null'
  responses:
    NotFound:
      description: The addressed resource does not exist.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Missing/invalid bearer token, or the Origin/Host guard rejected the request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: 'Invalid input. Domain validation errors use the JSON Error shape; axum body-deserialize rejections are `text/plain` with a bare message (e.g. `Failed to deserialize the JSON body into the target type: missing field ''url''`).'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
        text/plain:
          schema:
            type: string
  parameters:
    SelectorId:
      name: selector_id
      in: path
      required: true
      description: Selector row id.
      schema:
        type: integer
        format: int64
    MonitorId:
      name: id
      in: path
      required: true
      description: Monitor (target) row id.
      schema:
        type: integer
        format: int64
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: "Every route (including `/v1/agent` and `/v1/health`) requires\n`Authorization: Bearer <token>`. Token families:\n\n- `wlt_…` — the runtime token from `runtime.json` (full access, used by the desktop\n  UI and SDK discovery).\n- `wlk_…` — a scoped API key minted via `POST /v1/keys` (CSV scopes `read|run|admin`;\n  `/v1/keys` itself requires the full-access token).\n- `wlo_…` — an OAuth 2.1 access token from the daemon's local authorization server\n  (`run` scope).\n\nTreat the token as an opaque string. The daemon additionally enforces a loopback\nOrigin/Host DNS-rebind guard.\n"