Documentation
Everything you need to send data in, drive the API, and script the CLI.
Ingest signals & metrics (webhook)
Per-tenant HMAC keys. Sign the raw body with HMAC-SHA256 and send both headers:
POST https://agents99.chibitek.com/api/ingest/webhook
X-Agents99-Key-Id: <your-key-id>
X-Agents99-Signature: <hex hmac-sha256 of raw body>
{
"signals": [{
"serviceSlug": "payments",
"source": "datadog",
"fingerprint": "cpu-high-payments",
"severity": "high",
"title": "CPU saturation on payments",
"payload": { "value": 97 }
}],
"metrics": [
{ "serviceSlug": "payments", "name": "latency_ms", "value": 182 },
{ "serviceSlug": "payments", "name": "error_rate_pct", "value": 0.4 }
]
}Repeated fingerprints correlate into one incident. Golden-signal metric names: latency_ms, traffic_rpm, error_rate_pct, saturation_pct.
API tokens
Admins mint scoped tokens (shown once, bcrypt-hashed at rest):
POST /api/tokens { "name": "ci-reader", "scope": "read" }
→ { "token": "a99.…", "prefix": "…" }
# Use it anywhere a Stiki bearer works:
curl -H "Authorization: Bearer a99.…" https://agents99.chibitek.com/api/incidentsToken scopes can never decide approvals or administer the platform — those stay human.
CLI
export AGENT99_TOKEN=a99.… node cli/agent99.mjs incidents list --status open node cli/agent99.mjs signals send -t "Disk filling" -f disk-var-db1 -s high node cli/agent99.mjs approvals list node cli/agent99.mjs mttr --json
Outbound webhooks
POST /api/webhook-subscriptions
{ "url": "https://your-endpoint.example.com/hook",
"events": ["incident.created", "incident.resolved", "approval.created"] }
→ { "secret": "…" } # verify X-Agents99-Signature (hex HMAC-SHA256 of body)Delivery is at-least-once with retries (max 10 attempts) from the 5-minute pipeline.
API surface
GET/POST /api/incidents list (status, severity, q) · create GET/PATCH /api/incidents/[id] detail · acknowledge|investigate|mitigate|resolve|reopen|assign|unassign|note GET/POST/PATCH /api/incidents/[id]/postmortem POST /api/signals authenticated signal ingest GET/POST /api/services · /api/oncall · /api/monitors · /api/slos GET /api/analytics/mttr · /api/analytics/golden-signals GET/PATCH /api/agents fleet · tier/enable GET/PATCH /api/approvals queue · approve/reject GET/POST /api/shell catalog · suggest/dry_run GET/POST/DELETE /api/tokens mint (once) · list · revoke GET/POST /api/webhook-subscriptions
All routes fail closed: 401 missing_token unauthenticated, 403 without the required agents99:* grant or a valid tenant org (tenant_door_closed), 503 vault_unavailable when a Stiki vault pointer cannot resolve.