Documentation

Ingest signals & metrics (webhook)

Per-tenant HMAC keys. Sign the raw body with HMAC-SHA256 and send both headers:

POST https://agents99.chibitek.com/api/ingest/webhook
X-Agents99-Key-Id: <your-key-id>
X-Agents99-Signature: <hex hmac-sha256 of raw body>

{
  "signals": [{
    "serviceSlug": "payments",
    "source": "datadog",
    "fingerprint": "cpu-high-payments",
    "severity": "high",
    "title": "CPU saturation on payments",
    "payload": { "value": 97 }
  }],
  "metrics": [
    { "serviceSlug": "payments", "name": "latency_ms", "value": 182 },
    { "serviceSlug": "payments", "name": "error_rate_pct", "value": 0.4 }
  ]
}

Repeated fingerprints correlate into one incident. Golden-signal metric names: latency_ms, traffic_rpm, error_rate_pct, saturation_pct.

API tokens

Admins mint scoped tokens (shown once, bcrypt-hashed at rest):

POST /api/tokens          { "name": "ci-reader", "scope": "read" }
→ { "token": "a99.…", "prefix": "…" }

# Use it anywhere a Stiki bearer works:
curl -H "Authorization: Bearer a99.…" https://agents99.chibitek.com/api/incidents

Token scopes can never decide approvals or administer the platform — those stay human.

CLI

export AGENT99_TOKEN=a99.…
node cli/agent99.mjs incidents list --status open
node cli/agent99.mjs signals send -t "Disk filling" -f disk-var-db1 -s high
node cli/agent99.mjs approvals list
node cli/agent99.mjs mttr --json

Outbound webhooks

POST /api/webhook-subscriptions
{ "url": "https://your-endpoint.example.com/hook",
  "events": ["incident.created", "incident.resolved", "approval.created"] }
→ { "secret": "…" }   # verify X-Agents99-Signature (hex HMAC-SHA256 of body)

Delivery is at-least-once with retries (max 10 attempts) from the 5-minute pipeline.

API surface

GET/POST   /api/incidents          list (status, severity, q) · create
GET/PATCH  /api/incidents/[id]     detail · acknowledge|investigate|mitigate|resolve|reopen|assign|unassign|note
GET/POST/PATCH /api/incidents/[id]/postmortem
POST       /api/signals            authenticated signal ingest
GET/POST   /api/services · /api/oncall · /api/monitors · /api/slos
GET        /api/analytics/mttr · /api/analytics/golden-signals
GET/PATCH  /api/agents             fleet · tier/enable
GET/PATCH  /api/approvals          queue · approve/reject
GET/POST   /api/shell              catalog · suggest/dry_run
GET/POST/DELETE /api/tokens        mint (once) · list · revoke
GET/POST   /api/webhook-subscriptions

All routes fail closed: 401 missing_token unauthenticated, 403 without the required agents99:* grant.