The workspace API.
A same-origin HTTP interface for account sessions and benchmark records.
Authentication and request rules
Requests and responses use JSON. Account write endpoints require Content-Type: application/json. Session cookies are HttpOnly and SameSite=Lax; the deployed HTTPS site uses Secure cookies.
POST /api/signup accepts name, email and password. POST /api/login accepts email and password. On success the server sets a session cookie and returns name, email and a csrf token.
Authenticated writes require the returned token in the X-CSRF-Token header. Keep cookies and tokens private. These endpoints do not proxy model-provider requests.
Supported routes
GET /api/me — current account and CSRF token; HTTP 401 without an active session.
POST /api/logout — revoke the current session. DELETE /api/account — delete the authenticated account, its sessions and saved runs.
GET /api/runs — list your saved runs. POST /api/runs — validate and save a run. DELETE /api/runs/{id} — delete a run belonging to your account.
GET /api/export?format=json — full run records. GET /api/export?format=csv — spreadsheet-ready summaries.
GET /api/health — public service readiness, database reachability, uptime and observation time.
Run fields and limits
Required: non-empty name, model, hardware and samples. Each sample has a positive finite latencyMs and optional non-negative integer outputTokens. The server validates all fields before saving.
The workspace limits accounts to 500 run records. Authentication and write requests are rate-limited; an excess returns HTTP 429. Other validation failures return a JSON error with an appropriate non-success HTTP status.
Access is account-scoped. Requests cannot read, export or delete another account’s runs. This release does not provide a public model-routing API or a published API-key authentication scheme.