One listener (VEJAS_HTTP_ADDR, default :8686) serves the panel, the API
and MCP. With VEJAS_TOKEN set, every mutating route requires
Authorization: Bearer <token>. In governed mode (ADR-0024) mutating routes
answer with a didactic refusal pointing at the proposal queue.
Header On Purpose
Authorization: Bearer <token>every mutating route Write protection, when VEJAS_TOKEN is set. X-Approval-Token: <token>/proposals/{id}/approve|rejectThe human approval credential, distinct from VEJAS_TOKEN (ADR-0024). X-Vejas-Actor: <id>any mutating route Optional. Records who made the change in the audit trail; absent, the actor is panel. The enterprise auth proxy sets it after authenticating a user (ADR-0030) — useful open too, for a single operator naming themselves. Trimmed, capped at 128 chars.
Route Purpose
GET /healthzLiveness. GET /metricsPrometheus text format — hand-rolled, always on. GET / · GET /panelThe panel (single embedded HTML). GET /topologyUnits and their wiring. GET /graphThe flow graph (drives the panel’s clickable diagram). GET /eventsRecent traced events (ring). GET /driversLive driver catalog with config contracts. GET /rulesThe rules view (ADR-0019): N1 parameters, N2 read-only projection. GET /surfaceThe business surface: editable literals, tables, spans. GET /evictionsVersion-overlay evictions (git-wins, loud — ADR-0021).
Route Purpose
GET /file · POST /file/setRead / write a flow or connector file (guarded paths). POST /surface/setEdit one literal through the product write path (targeted restart). GET /fixture · POST /fixture/setPer-flow test fixtures. POST /previewRun a flow against a fixture without publishing. POST /flows/new · POST /connectors/newCreate from the panel/agent. POST /connectors/testConnector probe (auth reachability, no writes). POST /reloadReload units after out-of-band file changes.
Route Purpose
GET /dlqDead letters with death envelopes (version-tagged). POST /dlq/replay · POST /dlq/purgeExplicit replay / purge (ADR-0015).
Route Purpose
POST /surface/timetravelCandidate vs live over a window of persisted real traffic. POST /surface/canary/start · /stop · GET /surface/canaryShadow canary on live traffic. POST /surface/replayReplay literal history (ADR-0018). POST /surface/rollbackForward-only rollback of a literal.
Route Purpose
GET /proposalsThe proposal queue. POST /proposals/{id}/approve · /rejectHuman decision — requires X-Approval-Token (distinct credential).
Route Purpose
POST /events/goldenCapture a ring event as a curated test case (golden traffic). POST /provisionInstantiate a tenant package from a template. GET /secrets · POST /secrets/setSecret paths (values never returned).
Route Purpose
POST /mcpJSON-RPC 2.0 — the runtime is the MCP server. See MCP tools . POST /ingest/<suffix> (http-in connector, own port) Webhook ingestion → vx.<suffix> on the bus, 202 after the JetStream pub-ack.