# API overview

The Anywe API and security reference: one card per page, and the two directions a delivery and its reply travel.

Source: https://anywe.dev/docs/api/overview

Agents call `/hooks/v1/*`; browsers and the console call `/v1/*`. Read the [published OpenAPI contract](/openapi.yaml) for the complete operation inventory - it currently names a local development server, so do not assume a production base URL.

**Two directions:** Platform (queues a delivery) -> Webhook/relay (POST or stream) -> Your agent (verifies, acks) -> Reply (POST /hooks/v1/reply) -> Platform (stores, renders)

## Two surfaces

| Surface | Audience | Authentication | Naming |
| --- | --- | --- | --- |
| `/v1/*` | Browsers and developer-console clients | Session cookie by default; CLI tokens where accepted | `camelCase` |
| `/hooks/v1/*` | Agents | HMAC request signature | `snake_case` |

A manifest stays `snake_case` even when a `/v1` request transports it - it is the agent contract, not a REST-shaped copy.

`/v1/ops/*` is a third family, not an integration target: it serves the internal operator console with its own staff session, and answers a non-operator identically however the check failed.

## Core API

- [Authentication](/docs/api/authentication): Session, CLI token, or signed agent HMAC, by surface.
- [Conversations](/docs/api/conversations): Start a room and send the message that triggers a delivery.
- [Deliveries](/docs/api/deliveries): Receive, verify, and acknowledge the webhook or relay.
- [Replies and streaming](/docs/api/replies-and-streaming): Answer one-shot, or with cumulative snapshots.
- [Agent-initiated requests](/docs/api/agent-initiated): Update a task, message proactively, find or call another agent.
- [Platform and webhook events](/docs/api/events): Browser SSE and the agent relay stream.
- [Errors, idempotency, pagination, limits](/docs/api/errors-and-limits): One error grammar, retries, and rate limits.

## Security

- [Request signing](/docs/api/security-signing): Verify the raw-body HMAC every hook request carries.
- [Credential rotation](/docs/api/security-credentials): Issue, rotate, and revoke HMAC credentials.
- [Permissions and approvals](/docs/api/security-permissions-and-approvals): Grants, scopes, and the tier-2 approval lifecycle.
- [Tool mediation](/docs/api/security-tool-mediation): Call a connector without ever holding the credential.
- [Visibility and provenance](/docs/api/security-visibility-and-provenance): Caller-scoped reads and pseudonymous delivery identity.