Developer account API
These routes back the developer console and CLI. They use a verified developer session cookie, not a project bearer or customer token. Browser console calls are same-origin at https://app.getstead.dev; the CLI sends its separate saved session to https://api.getstead.dev.
Changes require an exact trusted Origin header. The app and API origins are trusted for developer changes; that does not grant those origins customer authentication access to every project. Session cookies remain host-scoped. API project IDs select an owned resource; they do not prove ownership.
Account and session
Section titled “Account and session”/v1/developer/auth hosts email/password signup, signin, verification, password reset, get-session, and sign-out using the same suffixes and body shapes as the customer authentication endpoints. Developer sign-in sets the developer session cookie. Developer verification/reset email links use the app origin.
| Method and path | Request/result |
|---|---|
GET /v1/me |
{ ok, developer: { id, email } } for a verified session. |
DELETE /v1/me |
Deletes the developer account; 409 while it still owns projects. |
POST /v1/developer/auth/cli/approve |
Verified browser session and { challenge }, 64 hex characters; records authorization. |
POST /v1/developer/auth/cli/exchange |
{ verifier }, 64 hex characters, with trusted API Origin. Returns 202 { pending: true } until authorized, then issues a separate CLI session cookie. |
The CLI creates a random verifier and sends its SHA-256 challenge to the browser. Use the published CLI’s matching-code flow instead of constructing login links manually. Grants are single-use and expire; neither a browser cookie nor a verifier belongs in logs.
Owned projects
Section titled “Owned projects”All results use the ordinary { ok: true, ...result } envelope.
| Method and path | Request | Result |
|---|---|---|
GET /v1/developer/projects |
None | { projects, limits: { projects } }. |
POST /v1/developer/projects |
{ name } |
201 { project, credential }; secret shown once. |
GET /v1/developer/projects/:id |
None | { project }, including deletion state. |
PATCH /v1/developer/projects/:id |
{ name } |
Renamed { project }. |
DELETE /v1/developer/projects/:id |
{ name } matching the current name |
202, asynchronous permanent deletion state. |
GET /v1/developer/projects/:id/setup |
None | { gatewayEnabled, authEnabled, apiUrl, provider, deployment }. Provider contains only baseUrl, or is null; deployment is latest { id, createdAt }, or null. |
GET /v1/developer/projects/:id/browser-origins |
None | { origins }. |
PUT /v1/developer/projects/:id/browser-origins |
{ origins: string[] } |
Replaces the origin list and returns { origins }. Exact HTTPS origins or loopback HTTP, no path/query/credentials. |
GET /v1/developer/projects/:id/credentials |
None | { credentials, limits: { credentials } }, without secrets. |
POST /v1/developer/projects/:id/credentials |
{ name? }, default CLI |
201 { credential }, including the new secret once. |
DELETE /v1/developer/projects/:id/credentials/:credentialId |
None | Revokes the owned project’s credential. |
Project names are 1–200 characters; credential names are trimmed and 1–100 characters. Requests for a foreign project return 404. Mutations are refused when project deletion is already underway, while its state remains readable.
Owning sessions can also call the project JSON routes listed in the HTTP reference by replacing /v1/ with /v1/developer/projects/:id/. For example, GET /v1/developer/projects/:id/diagnostics and POST /v1/developer/projects/:id/deploy. This mapping covers the project route table; it does not turn the customer data/conversation routes or the standalone SSE handler into developer routes.
Use the CLI or console for ordinary owner workflows. Use a named project credential for backend automation that should not carry your personal account session.
Installation operator API
Section titled “Installation operator API”The following routes require Stead’s installation operator bearer. They are not available to hosted developers and are not prerequisites for signup, project creation, deployment, or credential rotation:
| Method and path | Purpose |
|---|---|
POST /v1/projects |
Create an installation-managed project and initial credential. |
GET /v1/projects |
List installation projects. |
POST /v1/projects/:id/credentials |
Mint a project credential at installation scope. |
POST /v1/credentials/:id/revoke |
Revoke a project credential at installation scope. |
The operator token does not substitute for a project credential on project-only routes. Hosted developers should never request or distribute the installation token, signing keys, database logins, or infrastructure credentials.