CotalList the roster
Return the dashboard observer's current presence roster. Rows can include offline peers; freshness is reported separately by the presence-view SSE event.
cotal_web_session<token>Process-local dashboard session issued by the one-use launch URL.
The current snapshot or history page.
application/json- response
[index: integer]?Presence plus an optional progress signal. Working rows currently report progress.kind as unknown because the dashboard has no session-store observer.
curl -X GET 'http://127.0.0.1:7799/api/roster'[ { "activeAt": 0, "activity": "string", "activitySince": 0, "attention": "open", "card": { "actor": "string", "description": "string", "id": "string", "kind": "agent", "meta": { "property1": null, "property2": null }, "name": "string", "owner": "string", "protocolVersion": "string", "role": "string", "skills": [ { "description": "string", "id": "string", "name": "string" } ], "tags": [ "string" ] }, "channelModes": { "property1": "quiet", "property2": "quiet" }, "condition": { "code": "rate_limit", "message": "string", "since": 0, "source": "string" }, "environment": "string", "lifecycleUid": "string", "runtime": { "id": "string", "source": "endpoint-process", "startedAt": 0 }, "status": "idle", "statusSince": 0, "ts": 0, "progress": { "kind": "unknown" } }]See the HTTP interface overview for authentication and access requirements.
Complete HTTP contract
Endpoint
GET /api/rosterReturn the dashboard observer's current presence roster. Rows can include offline peers; freshness is reported separately by the presence-view SSE event.
Parameters
No operation parameters.
Responses
HTTP 200
The current snapshot or history page.
Content type: application/json.
{
"type": "array",
"items": {
"$ref": "#/components/schemas/RosterEntry"
}
}HTTP 302
A valid one-use k query token is exchanged for a dashboard session. The response redirects to the same path without its query. A valid existing cookie takes precedence over k.
Location: The requested path without the query string.
Set-Cookie: cotal_web_session=<session>; Path=/; HttpOnly; SameSite=Strict. The default local listener uses HTTP.
HTTP 401
No valid session, an invalid launch token, or a spent launch token. The readiness credential does not authorize these routes.
Content type: application/json.
{
"$ref": "#/components/schemas/AuthenticationError"
}Example:
{
"error": "unauthenticated"
}HTTP 403
Origin is checked before session authentication. An origin outside this listener's allowed origins is refused.
Content type: application/json.
{
"$ref": "#/components/schemas/OriginError"
}Example:
{
"error": "cross-origin"
}HTTP 413
These read routes accept no request body. An announced body is refused before it is read; the connection is closed.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}HTTP 500
The request failed. The body names the failure; a failed read does not terminate the dashboard.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}Authentication and access: HTTP interface of the @cotal-ai/web reference implementation. This description covers read operations, readiness metadata and the legacy channel deletion route; it does not establish a separate stable product or Cloud management API. Start the dashboard using the web service preset described in the operator guide. The server defaults to 127.0.0.1:7799; use the host and port configured for your dashboard.
Open the owner-private launch URL once to exchange its k query token for the cotal_web_session cookie. Keep the session on the same host. With the default bind, the permitted browser origins are http://127.0.0.1:<port>, http://localhost:<port> and http://cotal.localhost:<port>. A custom host uses its own HTTP origin. A cross-origin request is refused before session checks. The readiness nonce only opens /api/meta.
Read operations use GET and take no request body. Some read handlers also accept other bodyless methods; this description does not promise a 405 response for them. The native web service is read-only and always refuses channel deletion with 403. Legacy direct dashboard instances can enable deletion; /api/meta reports channelDeleteSupported. Description version 1 identifies this document, not the wire or npm package version.
OpenAPI specification contains the referenced response schemas. Complete Markdown reference.