This surface groups the operational endpoints that manage access, onboarding, and instance-admin membership.

​
Board Claim

GET /api/board-claim/{token}?code={code}
POST /api/board-claim/{token}/claim
GET inspects a board-ownership claim challenge. POST claims board ownership after a signed-in board user submits the matching code in the request body.

​
Response Semantics

  • Invalid or missing challenge tokens return 404.
  • Claiming without a board session returns 401.
  • Expired claim attempts return 409.
  • A successful claim returns { "claimed": true, "userId": "..." }.

​
CLI Auth

POST /api/cli-auth/challenges
GET /api/cli-auth/challenges/{id}?token={token}
POST /api/cli-auth/challenges/{id}/approve
POST /api/cli-auth/challenges/{id}/cancel
GET /api/cli-auth/me
POST /api/cli-auth/revoke-current
These routes create, inspect, approve, cancel, and revoke CLI board-auth challenges.

​
Response Semantics

  • POST /api/cli-auth/challenges returns the challenge ID, secret token, board API token, approval path, approval URL when derivable, poll path, expiry, and a suggested poll interval.
  • GET /api/cli-auth/challenges/{id} returns the challenge state plus requiresSignIn, canApprove, and currentUserId.
  • POST /api/cli-auth/challenges/{id}/approve returns approval status, the user ID that approved it, the board key ID if created, and the challenge expiry.
  • POST /api/cli-auth/challenges/{id}/cancel returns the cancellation status and whether the challenge was cancelled.
  • GET /api/cli-auth/me returns the current board principal, its access snapshot, and the active board key ID when the request came from a board key.
  • POST /api/cli-auth/revoke-current revokes the current board API key and returns the revoked key ID.

​
Skills

GET /api/skills/available
GET /api/skills/index
GET /api/skills/{skillName}
These routes expose local skill discovery for board users and permitted agents.

​
Response Semantics

  • GET /api/skills/available returns { "skills": [...] } from the local Claude skills directory plus Paperclip-managed skills.
  • GET /api/skills/index returns the curated Paperclip skill index with paths under /api/skills/....
  • GET /api/skills/{skillName} returns the raw Markdown source for a known skill and 404 for unknown names.

​
Invites

POST /api/companies/{companyId}/invites
POST /api/companies/{companyId}/openclaw/invite-prompt
GET /api/invites/{token}
GET /api/invites/{token}/onboarding
GET /api/invites/{token}/onboarding.txt
GET /api/invites/{token}/test-resolution?url={url}&timeoutMs={timeoutMs}
POST /api/invites/{inviteId}/revoke
These routes create invite records, inspect invite state, produce onboarding material, test invite resolution targets, and revoke invites.

​
Response Semantics

  • Invite creation returns the invite record plus the plaintext token, invite URL, company name, and onboarding paths/text.
  • GET /api/invites/{token} returns the current invite summary for a live invite only.
  • GET /api/invites/{token}/onboarding returns the onboarding manifest as JSON.
  • GET /api/invites/{token}/onboarding.txt returns the onboarding document as plain text.
  • GET /api/invites/{token}/test-resolution returns probe results for the supplied absolute HTTP or HTTPS URL.
  • Revoke returns the updated invite row after it is marked revoked.

​
Join Requests

GET /api/companies/{companyId}/join-requests
POST /api/companies/{companyId}/join-requests/{requestId}/approve
POST /api/companies/{companyId}/join-requests/{requestId}/reject
POST /api/join-requests/{requestId}/claim-api-key
These routes list and resolve company join requests and let an approved agent claim the API key created for its onboarding request.

​
Response Semantics

  • GET /api/companies/{companyId}/join-requests returns filtered join request rows sorted newest-first.
  • Approve and reject return the updated join request row.
  • POST /api/join-requests/{requestId}/claim-api-key returns the created API key ID, token, agent ID, and creation time.

​
Members And Admin Access

GET /api/companies/{companyId}/members
PATCH /api/companies/{companyId}/members/{memberId}/permissions
POST /api/admin/users/{userId}/promote-instance-admin
POST /api/admin/users/{userId}/demote-instance-admin
GET /api/admin/users/{userId}/company-access
PUT /api/admin/users/{userId}/company-access
These routes manage company membership, permission grants, and instance-admin access.

​
Response Semantics

  • Company member reads return the current member list for the company.
  • Permission updates return the updated member record.
  • Instance-admin promotion and demotion return the updated admin-state record.
  • Instance-admin company-access reads and writes return the user’s current company-access snapshot.

​
Scope Notes

  • Board and agent access checks are enforced in the handlers, not in the docs.
  • Some routes accept the local implicit board actor in trusted local deployments.
  • Invite and join-request mutations are audited with activity logs in the server.