api reference

Everything Aegis reads,over plain HTTP

A small, honest surface. Your CI posts reports with a scoped repository token; Aegis matches them to the open pull request and returns a single verdict. The cost ledger streams over MCP to Olympus.

authentication

Per-repository upload tokens

Upload requests carry a token and the full repositorypath in the JSON body. A token is bound to one repository, grants write access to that repo's reports only, can't read anything, and is rotatable from the repository's settings. An invalid or expired token returns 401.

Report uploads

Post the artifacts your CI already produces. Each request authenticates with the per-repository token — no account credentials. Reports are matched to the open pull request for the commit and folded into its verdict.

POST/api/coverage/upload

Upload a coverage report (lcov, cobertura, or JSON).

Field	Type	Notes
`coverage`	string (base64)	Base64-encoded coverage file
`repository`	string	Full path, e.g. your-org/your-repo
`token`	string	The repository's upload token
`commit`	string	Head commit SHA of the build
`branch`	string	Branch name
`ref`	string	Git ref (optional; helps PR matching)
`buildId`	string	Your CI job/build identifier

POST/api/duplication/upload

Upload a code-duplication report.

Field	Type	Notes
`report`	string \| object	Duplication report payload
`repository`	string	Full path, e.g. your-org/your-repo
`token`	string	The repository's upload token
`commit`	string	Head commit SHA of the build
`branch`	string	Branch name
`ref`	string	Git ref (optional; helps PR matching)
`buildId`	string	Your CI job/build identifier

POST/api/static-analysis/upload

Upload static-analysis findings.

Field	Type	Notes
`report`	string \| object	Static-analysis report payload
`repository`	string	Full path, e.g. your-org/your-repo
`token`	string	The repository's upload token
`commit`	string	Head commit SHA of the build
`branch`	string	Branch name
`ref`	string	Git ref (optional; helps PR matching)
`buildId`	string	Your CI job/build identifier

POST/api/vulnerabilities/upload

Upload dependency-vulnerability findings.

Field	Type	Notes
`report`	string \| object	Vulnerability report payload
`repository`	string	Full path, e.g. your-org/your-repo
`token`	string	The repository's upload token
`commit`	string	Head commit SHA of the build
`branch`	string	Branch name
`ref`	string	Git ref (optional; helps PR matching)
`buildId`	string	Your CI job/build identifier

Verdict & readiness

Read the signal Aegis produces for a build — the same rollup shown on the pull request.

GET/api/deploy-readiness

The deploy-readiness verdict for a repository's latest build — whether a merged PR is safe to ship.

GET/api/repositories/{slug}/deploy-readiness

The deploy-readiness verdict for a specific repository.

Cost ledger (MCP)

Aegis exposes an authenticated MCP server that streams AI-generation cost events. This is the pipe Olympus's cost-ingest loop pulls from to attribute spend per repository across the tokdio portfolio.

MCP/api/mcp

Authenticated MCP endpoint. Exposes unacknowledged cost events; the consumer acknowledges ids only after a durable insert, so nothing is lost if ingestion fails.

Consumed by Olympus via SHORTEST_MCP_URL + an API key. Events are re-ingestable until acknowledged.