api-reference.md

AdversaryGraph API reference

• Version: 6.5.0
• Modules: 28 Operations: 323

Interactive contracts are available from a running deployment at /docs, /redoc, and /openapi.json. All platform operations use /api; protected operations accept the native session cookie or Authorization: Bearer <token>. External-provider operations can also return a documented 4xx/5xx dependency status when the corresponding credential, policy permission, or service is unavailable.

Contract completeness is checked with ./scripts/check-api-contracts.py. Against a running deployment, ./scripts/test-api-live.py --base-url http://127.0.0.1:3000 probes every read-only operation and fails on an unhandled response. Mutating operations are exercised by the backend integration suite rather than by the live smoke command.

ATT&CK

7 operations.

Method	Path	Operation	Success
GET	/api/attack/stix/objects/{stix_id}	Get Stix Object	200
GET	/api/attack/stix/objects/{stix_id}/graph	Get Stix Object Graph	200
GET	/api/attack/stix/relationships	List Stix Relationships	200
GET	/api/attack/tactics	List Tactics	200
GET	/api/attack/techniques	List Techniques	200
GET	/api/attack/techniques/{attack_id}	Get Technique	200
GET	/api/attack/versions	List Versions	200

ATT&CK Group Profiles

7 operations.

Method	Path	Operation	Success
GET	/api/apt/campaigns	List Campaigns	200
POST	/api/apt/campaigns/compare	Compare Campaigns	200
GET	/api/apt/campaigns/{attack_id}	Get Campaign	200
POST	/api/apt/compare	Compare Ttps	200
GET	/api/apt/groups	List Groups	200
GET	/api/apt/groups/{attack_id}	Get Group	200
POST	/api/apt/overlap/explain	Explain Ttp Overlap	200

Analysis

15 operations.

Method	Path	Operation	Success
POST	/api/analyze	Analyze	200
POST	/api/analyze/chat	Chat	200
POST	/api/analyze/log-pcap	Analyze Log Pcap	200
GET	/api/analyze/sessions	List Sessions	200
GET	/api/analyze/sessions/collection	Report Collection	200
POST	/api/analyze/sessions/research	Store Research	200
POST	/api/analyze/sessions/research-url	Ingest Research Url	200
DELETE	/api/analyze/sessions/{session_id}	Delete Session	204
POST	/api/analyze/sessions/{session_id}/compare	Compare Session	200
GET	/api/analyze/sessions/{session_id}/linked-report	Linked Report	200
PATCH	/api/analyze/sessions/{session_id}/linked-report	Edit Linked Report	200
POST	/api/analyze/sessions/{session_id}/reparse	Reparse Linked Report	200
PATCH	/api/analyze/sessions/{session_id}/techniques/{attack_id}/review	Update Technique Review	200
POST	/api/analyze/stream	Analyze Stream	200
GET	/api/analyze/{session_id}	Get Result	200

Asset Attack Surface

8 operations.

Method	Path	Operation	Success
POST	/api/asset-surface/analyze	Analyze Asset Surface	200
GET	/api/asset-surface/assets	List Registered Assets	200
GET	/api/asset-surface/cases	List Asset Surface Cases	200
DELETE	/api/asset-surface/cases/{case_id}	Delete Asset Surface Case	204
GET	/api/asset-surface/cases/{case_id}	Get Asset Surface Case	200
GET	/api/asset-surface/csv-schema	Asset Surface Csv Schema	200
GET	/api/asset-surface/intel-matches	List Registered Asset Matches	200
POST	/api/asset-surface/retrohunt	Run Asset Retrohunt	200

Attack Simulation

14 operations.

Method	Path	Operation	Success
GET	/api/simulation/ai-assistant/scenarios	Ai Assistant Scenarios	200
POST	/api/simulation/ai-assistant/telemetry	Ai Assistant Telemetry	200
GET	/api/simulation/attack-flows	Attack Flows	200
POST	/api/simulation/attack-flows/{flow_id}/resend	Resend Attack Flow	200
GET	/api/simulation/catalog	Catalog	200
POST	/api/simulation/forward-logs	Forward Logs	200
GET	/api/simulation/logs	Logs	200
POST	/api/simulation/manual-result	Manual Result	200
POST	/api/simulation/plan	Plan	200
POST	/api/simulation/run	Run	200
DELETE	/api/simulation/siem-destinations	Clear Siem Destinations	200
GET	/api/simulation/siem-destinations	Siem Destinations	200
POST	/api/simulation/siem-destinations	Save Siem Destination	200
GET	/api/simulation/targets	Targets	200

Authentication

20 operations.

Method	Path	Operation	Success
GET	/api/auth/audit	Auth Audit Events	200
GET	/api/auth/groups	List Groups	200
POST	/api/auth/groups	Create Group	201
DELETE	/api/auth/groups/{group_id}	Delete Group	204
PATCH	/api/auth/groups/{group_id}	Update Group	200
POST	/api/auth/login	Login	200
POST	/api/auth/logout	Logout	200
GET	/api/auth/me	Me	200
POST	/api/auth/mfa/confirm	Confirm Mfa	200
POST	/api/auth/mfa/setup	Setup Mfa	200
GET	/api/auth/sessions	List Sessions	200
POST	/api/auth/sessions/revoke-all	Revoke All My Sessions	200
GET	/api/auth/status	Status	200
GET	/api/auth/users	List Users	200
POST	/api/auth/users	Create Native User	201
DELETE	/api/auth/users/{user_id}	Disable User	204
PATCH	/api/auth/users/{user_id}	Update User	200
POST	/api/auth/users/{user_id}/mfa/disable	Disable User Mfa	200
POST	/api/auth/users/{user_id}/password	Set Password	200
POST	/api/auth/users/{user_id}/sessions/revoke	Revoke User Session Set	200

CVE Intelligence

16 operations.

Method	Path	Operation	Success
POST	/api/cve/correlate	Run Cve Correlation	200
GET	/api/cve/library	Cve Library	200
GET	/api/cve/related/actor/{actor_attack_id}	Related Cves For Actor	200
GET	/api/cve/related/ioc/{indicator_id}	Related Cves For Ioc	200
GET	/api/cve/related/technique/{attack_id}	Related Cves For Technique	200
GET	/api/cve/sources	Cve Sources	200
POST	/api/cve/sync/all	Sync All Cves	200
POST	/api/cve/sync/epss	Sync Epss	200
POST	/api/cve/sync/github-advisories	Sync Github Security Advisories	200
POST	/api/cve/sync/kev	Sync Kev	200
POST	/api/cve/sync/nvd	Sync Nvd	200
POST	/api/cve/sync/nvd/cve-ids	Sync Nvd By Cve Ids	200
POST	/api/cve/sync/nvd/missing-cvss	Sync Missing Cvss	200
POST	/api/cve/sync/osv/packages	Sync Osv Package Advisories	200
GET	/api/cve/{cve_id}	Cve Detail	200
GET	/api/cve/{cve_id}/graph	Cve Graph	200

Collection and Detection Pipeline

18 operations.

Method	Path	Operation	Success
GET	/api/pipeline/audit	Audit Events	200
POST	/api/pipeline/detections/generate	Generate	201
POST	/api/pipeline/detections/validate	Validate	200
GET	/api/pipeline/detections/versions	Detection Versions	200
POST	/api/pipeline/import/atlas	Import Atlas	200
POST	/api/pipeline/import/misp	Import Misp	200
POST	/api/pipeline/import/stix	Import Stix	200
GET	/api/pipeline/me	Me	200
GET	/api/pipeline/observables	Observables	200
POST	/api/pipeline/observables	Create Observable	201
POST	/api/pipeline/observables/{observable_id}/enrich	Enrich	200
POST	/api/pipeline/rule-feeds/defaults	Create Default Rule Feeds	200
GET	/api/pipeline/runs	Runs	200
GET	/api/pipeline/sandbox/behaviors	Sandbox Behaviors	200
GET	/api/pipeline/sources	Sources	200
POST	/api/pipeline/sources	Create Source	201
PUT	/api/pipeline/sources/{source_id}	Update Source	200
POST	/api/pipeline/sources/{source_id}/run	Run Source	200

EMB3D

4 operations.

Method	Path	Operation	Success
POST	/api/emb3d/assets/assess	Emb3D Assess Assets	200
GET	/api/emb3d/assets/report	Emb3D Asset Report	200
GET	/api/emb3d/catalog	Emb3D Catalog	200
POST	/api/emb3d/preview	Emb3D Preview Asset	200

Evidence-to-Detection Graph

16 operations.

Method	Path	Operation	Success
GET	/api/evidence-graph	Query	200
POST	/api/evidence-graph/edges	Create Edge	201
DELETE	/api/evidence-graph/edges/{edge_id}	Delete Edge	204
PATCH	/api/evidence-graph/edges/{edge_id}	Update Edge	200
GET	/api/evidence-graph/export	Export	200
POST	/api/evidence-graph/from-asset/{asset_id}	From Asset	200
POST	/api/evidence-graph/from-ioc/{ioc_id}	From Ioc	200
POST	/api/evidence-graph/from-malware/{case_id}	From Malware	200
POST	/api/evidence-graph/from-report/{report_id}	From Report	200
POST	/api/evidence-graph/from-simulation/{simulation_run_id}	From Simulation	200
GET	/api/evidence-graph/gaps	Gaps	200
POST	/api/evidence-graph/nodes	Create Node	201
DELETE	/api/evidence-graph/nodes/{node_id}	Delete Node	204
PATCH	/api/evidence-graph/nodes/{node_id}	Update Node	200
GET	/api/evidence-graph/paths	Paths	200
GET	/api/evidence-graph/summary	Summary	200

Export

4 operations.

Method	Path	Operation	Success
GET	/api/export/analysis/{session_id}	Export Analysis Pdf	200, 202
POST	/api/export/analysis/{session_id}	Export Analysis Pdf	200, 202
GET	/api/export/analysis/{session_id}/stix	Export Analysis Stix	200, 202
POST	/api/export/layer	Export Layer Pdf	200

IOC Intelligence

30 operations.

Method	Path	Operation	Success
GET	/api/ioc/actors/counts	Actor Ioc Counts Route	200
GET	/api/ioc/actors/{actor_id}	Actor Ioc Route	200
POST	/api/ioc/actors/{actor_id}/enrich/otx	Enrich Actor Otx Route	200
GET	/api/ioc/actors/{actor_id}/export.csv	Actor Ioc Csv Route	200
GET	/api/ioc/actors/{actor_id}/summary	Actor Ioc Summary Route	200
POST	/api/ioc/enrich/ttps	Enrich Ioc Ttps Route	200
POST	/api/ioc/import	Import Ioc Route	200
POST	/api/ioc/import/stix	Import Ioc Stix Route	200
POST	/api/ioc/import/taxii	Import Ioc Taxii Route	200
POST	/api/ioc/investigate	Investigate Ioc Route	200
GET	/api/ioc/investigations	List Ioc Investigations	200
DELETE	/api/ioc/investigations/{session_id}	Delete Ioc Investigation	204
GET	/api/ioc/investigations/{session_id}	Get Ioc Investigation	200
GET	/api/ioc/library	Ioc Library Route	200
GET	/api/ioc/library/export/stix	Export Ioc Library Stix Route	200
GET	/api/ioc/library/{indicator_id}/detail	Ioc Library Detail Route	200
POST	/api/ioc/opencti/pull	Opencti Pull Route	200
POST	/api/ioc/opencti/push	Opencti Push Route	200
GET	/api/ioc/opencti/status	Opencti Status Route	200
POST	/api/ioc/opencti/sync	Opencti Sync Route	200
POST	/api/ioc/report	Import Iocs From Report	200
GET	/api/ioc/sources	Sources	200
POST	/api/ioc/sources	Create Source	200
DELETE	/api/ioc/sources/{source_id}	Delete Source	204
PATCH	/api/ioc/sources/{source_id}	Update Source	200
POST	/api/ioc/sync/malpedia	Sync Malpedia Route	200
POST	/api/ioc/sync/otx	Sync Otx Route	200
POST	/api/ioc/sync/threatfox	Sync Threatfox Route	200
POST	/api/ioc/sync/{source_id}	Sync Source Route	200
POST	/api/ioc/virustotal/lookup	Virustotal Lookup	200

Knowledge

4 operations.

Method	Path	Operation	Success
GET	/api/knowledge/articles	List Articles	200
GET	/api/knowledge/articles/{article_id}	Get Article	200
POST	/api/knowledge/seed	Trigger Seed	200
GET	/api/knowledge/stats	Stats	200

MITRE Sync

6 operations.

Method	Path	Operation	Success
POST	/api/sync/cve	Trigger Cve Sync	200
POST	/api/sync/dynamic-db	Trigger Dynamic Db Sync	200
POST	/api/sync/ioc	Trigger Ioc Sync	200
GET	/api/sync/status	Sync Status	200
GET	/api/sync/task/{task_id}	Task Status	200
POST	/api/sync/trigger	Trigger Sync	200

MalwareGraph

26 operations.

Method	Path	Operation	Success
GET	/api/malwaregraph/analyses	List Analyses	200
POST	/api/malwaregraph/analyses	Create Analysis	200
GET	/api/malwaregraph/analyses/{job_id}	Get Analysis	200
POST	/api/malwaregraph/analyses/{job_id}/ai-full-analysis	Ai Full Analysis	200
POST	/api/malwaregraph/analyses/{job_id}/debug-sessions	Create Debug Session	200
POST	/api/malwaregraph/analyses/{job_id}/debug-workspaces	Create Debug Workspace	200
POST	/api/malwaregraph/analyses/{job_id}/decompilation	Create Decompilation	200
GET	/api/malwaregraph/analyses/{job_id}/files/preview	File Preview	200
POST	/api/malwaregraph/analyses/{job_id}/inject-file	Inject File	200
GET	/api/malwaregraph/analyses/{job_id}/logs	Get Analysis Logs	200
POST	/api/malwaregraph/analyses/{job_id}/obfuscation-analysis	Obfuscation Analysis	200
GET	/api/malwaregraph/analyses/{job_id}/report	Get Report	200
POST	/api/malwaregraph/analyses/{job_id}/runtime-debug-sessions	Create Runtime Debug Session	200
POST	/api/malwaregraph/analyses/{job_id}/save-unpacked	Save Unpacked	200
GET	/api/malwaregraph/analyses/{job_id}/strings	Strings Analysis	200
POST	/api/malwaregraph/analyses/{job_id}/unpack	Unpack	200
POST	/api/malwaregraph/analyses/{job_id}/unpack/runtime	Runtime Unpack	200
GET	/api/malwaregraph/analyses/{job_id}/workflow-graph	Get Workflow Graph	200
GET	/api/malwaregraph/debug-workspaces/{session_id}	Get Debug Workspace	200
POST	/api/malwaregraph/debug-workspaces/{session_id}/ai-assistant	Debug Workspace Ai Assistant	200
POST	/api/malwaregraph/debug-workspaces/{session_id}/step	Step Debug Workspace	200
GET	/api/malwaregraph/health	Health	200
POST	/api/malwaregraph/llm/complete	Complete Llm For Malwaregraph	200
GET	/api/malwaregraph/llm/providers	Providers	200
GET	/api/malwaregraph/logs	Get Service Logs	200
POST	/api/malwaregraph/runtime-debug-sessions/{session_id}/step	Step Runtime Debug Session	200

Observability

4 operations.

Method	Path	Operation	Success
GET	/api/observability/logs	Api Logs	200
GET	/api/observability/metrics	Prometheus Metrics	200
GET	/api/observability/summary	Observability Summary	200
GET	/api/observability/traces	Recent Traces	200

Operational Intelligence

15 operations.

Method	Path	Operation	Success
GET	/api/operations/detections	Detections	200
POST	/api/operations/detections	Create Detection	201
DELETE	/api/operations/detections/{item_id}	Delete Detection	204
PUT	/api/operations/detections/{item_id}	Update Detection	200
GET	/api/operations/intake	Intake	200
POST	/api/operations/intake	Create Intake	201
DELETE	/api/operations/intake/{item_id}	Delete Intake	204
PUT	/api/operations/intake/{item_id}	Update Intake	200
GET	/api/operations/investigations	Investigations	200
POST	/api/operations/investigations	Create Investigation	201
DELETE	/api/operations/investigations/{item_id}	Delete Investigation	204
PUT	/api/operations/investigations/{item_id}	Update Investigation	200
GET	/api/operations/tracked-actors	Tracked Actors	200
POST	/api/operations/tracked-actors	Track Actor	201
DELETE	/api/operations/tracked-actors/{item_id}	Delete Tracked Actor	204

RetroHunt

4 operations.

Method	Path	Operation	Success
POST	/api/retrohunt/collect	Trigger Collect	200
GET	/api/retrohunt/collect/{task_id}	Collect Status	200
GET	/api/retrohunt/signals	List Signals	200
GET	/api/retrohunt/stats	Stats	200

Saved Layers

4 operations.

Method	Path	Operation	Success
GET	/api/layers	List Layers	200
POST	/api/layers	Save Layer	201
DELETE	/api/layers/{layer_id}	Delete Layer	204
GET	/api/layers/{layer_id}	Get Layer	200

Sector Intelligence

8 operations.

Method	Path	Operation	Success
GET	/api/sector/packs	Sector Packs	200
GET	/api/sector/packs/{sector_id}	Sector Pack Detail	200
GET	/api/sector/regions	Regions	200
GET	/api/sector/relevance	Relevance	200
GET	/api/sector/sectors	Sectors	200
GET	/api/sector/sources	Sources	200
POST	/api/sector/sync/misp-galaxy	Sync Misp	200
GET	/api/sector/technologies	Technologies	200

Statistics

1 operation.

Method	Path	Operation	Success
GET	/api/statistics/overview	Statistics Overview	200

System

7 operations.

Method	Path	Operation	Success
GET	/api/health	Check API liveness and startup progress	200
GET	/api/ready	Check API and database readiness	200
GET	/api/system/capabilities	List every supported API module and operation	200
GET	/api/system/selftest	Selftest	200
GET	/api/system/startup	Startup	200
POST	/api/system/taxonomy/normalize	Normalize Taxonomy	200
GET	/api/system/taxonomy/status	Taxonomy Status	200

Threat Hunting

15 operations.

Method	Path	Operation	Success
GET	/api/threat-hunting/hunts	List Hunts	200
POST	/api/threat-hunting/hunts	Create Hunt	201
DELETE	/api/threat-hunting/hunts/{hunt_id}	Archive Hunt Legacy — deprecated	204
GET	/api/threat-hunting/hunts/{hunt_id}	Get Hunt	200
PATCH	/api/threat-hunting/hunts/{hunt_id}	Update Hunt	200
POST	/api/threat-hunting/hunts/{hunt_id}/archive	Archive Hunt	200
GET	/api/threat-hunting/hunts/{hunt_id}/export	Export Hunt	200
GET	/api/threat-hunting/hunts/{hunt_id}/findings	List Findings	200
POST	/api/threat-hunting/hunts/{hunt_id}/findings	Create Finding	201
DELETE	/api/threat-hunting/hunts/{hunt_id}/findings/{finding_id}	Archive Finding Legacy — deprecated	204
PATCH	/api/threat-hunting/hunts/{hunt_id}/findings/{finding_id}	Update Finding	200
POST	/api/threat-hunting/hunts/{hunt_id}/findings/{finding_id}/archive	Archive Finding	200
GET	/api/threat-hunting/hunts/{hunt_id}/query-versions	Query Versions	200
GET	/api/threat-hunting/stats	Stats	200
GET	/api/threat-hunting/templates	Templates	200

Threat Hunting AI

4 operations.

Method	Path	Operation	Success
POST	/api/threat-hunting/ai/assist	Assist	200
GET	/api/threat-hunting/ai/history	History	200
POST	/api/threat-hunting/ai/hypotheses	Hypotheses	200
GET	/api/threat-hunting/ai/providers	Providers	200

Threat Hunting Query Library

6 operations.

Method	Path	Operation	Success
GET	/api/query-library	Search	200
GET	/api/query-library/autocomplete	Get Autocomplete	200
POST	/api/query-library/build-from-ioc	Build From Ioc	200
GET	/api/query-library/facets	Get Facets	200
POST	/api/query-library/sync	Sync From Detection Feeds	200
GET	/api/query-library/{item_id}	Get Item	200

Threat Radar

46 operations.

Method	Path	Operation	Success
GET	/api/threat-radar/asset-scanner/providers	Asset Scanner Providers	200
GET	/api/threat-radar/cases	List Cases	200
GET	/api/threat-radar/cases/{case_id}	Get Case	200
POST	/api/threat-radar/cases/{case_id}/create-detection-requirement	Create Detection	201
POST	/api/threat-radar/cases/{case_id}/create-hunt	Create Hunt	201
POST	/api/threat-radar/cases/{case_id}/create-ir-escalation	Create Ir	201
POST	/api/threat-radar/cases/{case_id}/create-psirt-task	Create Psirt	201
POST	/api/threat-radar/cases/{case_id}/escalate	Escalate Case	200
POST	/api/threat-radar/cases/{case_id}/generate-report	Generate Case Report	201
GET	/api/threat-radar/cases/{case_id}/graph	Get Case Graph	200
POST	/api/threat-radar/cases/{case_id}/score	Rescore Case	200
POST	/api/threat-radar/evidence	Create Evidence	201
POST	/api/threat-radar/exposure/classify	Classify Exposure	200
POST	/api/threat-radar/exposure/ingest	Ingest Exposure	201
POST	/api/threat-radar/exposure/plan	Exposure Monitoring Plan	200
GET	/api/threat-radar/exposure/providers	Exposure Providers	200
GET	/api/threat-radar/product-exposure	Product Exposure	200
POST	/api/threat-radar/product-map	Create Product Map	201
GET	/api/threat-radar/queues/{queue}	Workflow Queue	200
GET	/api/threat-radar/signals	List Signals	200
POST	/api/threat-radar/signals	Create Signal	201
GET	/api/threat-radar/signals/{signal_id}	Get Signal	200
POST	/api/threat-radar/signals/{signal_id}/triage	Triage Signal	200
GET	/api/threat-radar/sources	List Sources	200
POST	/api/threat-radar/sources	Create Source	201
GET	/api/threat-radar/spaces	List Company Spaces	200
POST	/api/threat-radar/spaces	Create Company Space	201
GET	/api/threat-radar/spaces/metrics	Company Space Metrics	200
GET	/api/threat-radar/spaces/{space_id}	Get Company Space	200
POST	/api/threat-radar/spaces/{space_id}/ai-assistant	Company Space Ai Assistant	200
GET	/api/threat-radar/spaces/{space_id}/alerts	List Space Alerts	200
POST	/api/threat-radar/spaces/{space_id}/alerts/{alert_id}/status	Update Alert Status	200
GET	/api/threat-radar/spaces/{space_id}/assets	List Space Assets	200
POST	/api/threat-radar/spaces/{space_id}/assets	Create Space Asset	201
PUT	/api/threat-radar/spaces/{space_id}/assets/{asset_id}	Update Space Asset	200
GET	/api/threat-radar/spaces/{space_id}/assets/{asset_id}/intelligence	Get Space Asset Intelligence	200
GET	/api/threat-radar/spaces/{space_id}/assets/{asset_id}/scans	List Asset Scans	200
POST	/api/threat-radar/spaces/{space_id}/assets/{asset_id}/scans	Create Asset Scan	201
GET	/api/threat-radar/spaces/{space_id}/assets/{asset_id}/scans/{scan_id}	Get Asset Scan	200
POST	/api/threat-radar/spaces/{space_id}/dashboards	Create Space Dashboard	201
POST	/api/threat-radar/spaces/{space_id}/dashboards/generate	Generate Space Dashboard	201
POST	/api/threat-radar/spaces/{space_id}/monitors	Create Space Monitor	201
POST	/api/threat-radar/spaces/{space_id}/monitors/{monitor_id}/run	Run Space Monitor	200
POST	/api/threat-radar/spaces/{space_id}/search	Search Threat Monitor	200
GET	/api/threat-radar/unified/entities	Unified Entities	200
GET	/api/threat-radar/watchlists/{watchlist}	Watchlist	200

Troubleshooting

1 operation.

Method	Path	Operation	Success
POST	/api/troubleshooting/assistant	Assistant	200

Unified Intelligence RAG

13 operations.

Method	Path	Operation	Success
POST	/api/rag/assist	Assist	200
GET	/api/rag/company-spaces	Company Spaces	200
GET	/api/rag/entity/{source_type}/{source_id}	Entity	200
GET	/api/rag/index-runs	Index Runs	200
GET	/api/rag/profiles	Client Profiles	200
POST	/api/rag/profiles	Create Client Profile	201
DELETE	/api/rag/profiles/{profile_id}	Delete Client Profile	204
PUT	/api/rag/profiles/{profile_id}	Update Client Profile	200
POST	/api/rag/proposals/{proposal_id}/confirm	Confirm Proposal	200
GET	/api/rag/providers	Providers	200
POST	/api/rag/reindex	Reindex	202
POST	/api/rag/search	Search	200
GET	/api/rag/status	Status	200