HTTP endpoints

All POST requests must send Content-Type: application/json and, if an Origin header is present, it must match the site origin. Bodies are limited to 64 KiB. Authenticate with Authorization: Bearer <token> or the aim_session cookie.

Agent-facing

`GET <page>.json` · `GET <page>.toon`

Returns the manifest. Token optional; without it, public schema only.

`POST /__aim/invoke`

Request

{ "actionId": "approve_request", "input": "req-3" }

200 Response

{ "ok": true, "invocationId": "6f1c…", "result": { "requestId": "req-3", "status": "approved" } }

504 Response

{ "ok": false, "invocationId": "6f1c…", "error": "Timed out; outcome is unknown. Re-read session state before retrying." }

string

required

An id from the manifest’s actions[].

any

required

A value matching that action’s input_schema. Not wrapped.

`POST /__aim/disconnect`

Revokes the token and clears the cookie. Same effect as invoking the disconnect action.

Page-facing

These are used by the page’s bridge client. Agents don’t call them.

Route	Purpose
`POST /__aim/session`	Create or resume a session. Returns `{ sessionToken, expiresIn }` and sets the cookie.
`POST /__aim/sync`	Store the page’s snapshot `{ page, state, actions }` and claim the tab lease.
`POST /__aim/poll`	Heartbeat. Returns `{ invocation }` or `{ invocation: null }`.
`POST /__aim/invoke-result`	Report `{ invocationId, result?, error?, snapshot }` for a claimed invocation.

Getting started

Learn

Develop

Specification

Security

Community

Agent-facing

`GET <page>.json` · `GET <page>.toon`

`POST /__aim/invoke`

`POST /__aim/disconnect`

Page-facing

​Agent-facing

​GET <page>.json · GET <page>.toon

​POST /__aim/invoke

​POST /__aim/disconnect

​Page-facing

Agent-facing

`GET <page>.json` · `GET <page>.toon`

`POST /__aim/invoke`

`POST /__aim/disconnect`

Page-facing