Gateway endpoints reference Every HTTP endpoint the desktop gateway exposes, grouped by operation family.
The desktop gateway binds to 127.0.0.1:19432 (or the first fallback in 19433–19435). All /api/gateway/* routes require auth.
Route Methods Notes /healthGET Unauthenticated liveness and capability probe. /api/gateway/health-checkGET Authenticated health check. /api/gateway/versionGET Current desktop version. /api/gateway/reposGET, POST, DELETE, PATCH Managed repositories. /api/gateway/settings/binary-pathsGET, PATCH Override claude/gh/codex/python3/git paths. /api/gateway/mcp-authGET MCP auth metadata parity route. /gateway-auth/exchangePOST Loopback-only; trades challenge token for session token.
Route Methods /api/gateway/gitPOST (status/branch/commit/push/pull/branch-diff/sync-status dispatch) /api/gateway/git/branchesGET /api/gateway/git/diffPOST /api/gateway/git/worktreePOST, DELETE /api/gateway/git/branch-worktreeGET /api/gateway/git/repo-pathGET /api/gateway/git/prPOST /api/gateway/git/userGET
These answered from a local gh invocation and were retired in PLN-1535. Desktop
GitHub data now comes from the cloud projection, so the routes stay registered
and, once a request passes the gateway's auth, onboarding and approval gates,
respond HTTP 410 with { "error": "github_data_route_retired" }. Those gates
run first and can answer before the route does — a request made before onboarding
completes gets 403, not 410.
410 rather than an unregistered path so a version-skewed client can tell a
deliberately removed endpoint from one that is merely unimplemented: this gateway
answers 501 operation not implemented for an unrecognized /api/gateway/*
path, which means "may arrive later".
Route Methods /api/gateway/git/pr/listGET /api/gateway/git/pr/commentsGET /api/gateway/git/pr/reviewsGET /api/gateway/git/pr/replyPOST /api/gateway/git/pr/filesGET /api/gateway/git/pr/file-diffGET /api/gateway/git/pr/head-shaGET /api/gateway/git/pr/inline-commentPOST
Route Methods /api/gateway/directoriesGET /api/gateway/files/searchGET /api/gateway/run-viewer-extractGET, POST, DELETE /api/gateway/work-directory/:ticketIdGET /api/gateway/symphony/attachments/*attachmentPathGET /api/gateway/symphony/upload/:ticketIdPOST (multipart via busboy)
Route Methods /api/gateway/symphony/launchPOST /api/gateway/symphony/loopPOST /api/gateway/symphony/loop/killPOST /api/gateway/symphony/plan-loop/*POST /api/gateway/symphony/status, /:ticketIdGET /api/gateway/symphony/killPOST /api/gateway/symphony/logs/:ticketIdGET /api/gateway/symphony/plan/:ticketIdGET /api/gateway/symphony/judges/:ticketIdGET /api/gateway/symphony/sessionsGET, POST, DELETE /api/gateway/symphony/sessions/unread-countGET /api/gateway/symphony/chat/:ticketIdPOST (NDJSON) /api/gateway/symphony/comment-chat/:commentIdGET, POST, PATCH, DELETE /api/gateway/symphony/commit-message/:ticketIdGET /api/gateway/symphony/chat-history/:ticketIdGET, POST, DELETE
Route Methods /api/gateway/codex/availableGET /api/gateway/codex/review/:ticketIdPOST /api/gateway/codex/status/:ticketIdGET, DELETE /api/gateway/codex/stop/:ticketIdPOST, DELETE /api/gateway/codex/review-findings/:ticketIdGET, POST /api/gateway/codex/review-dedup/:ticketIdPOST /api/gateway/codex/review-extract/:ticketIdPOST /api/gateway/codex/review-verdict/:ticketIdPOST /api/gateway/codex/argue/:ticketIdPOST /api/gateway/codex/chat/:ticketIdPOST /api/gateway/codex/finding-chat/:findingIdGET, POST, PATCH, DELETE
Route Methods /api/gateway/terminal-chatGET, POST, DELETE /api/gateway/ticket-chatGET, POST, DELETE /api/gateway/run-viewer-chatGET, POST, DELETE
Chat session routes use ProviderRegistry with ClaudeProvider and CodexProvider.
Route Methods /api/gateway/deployPOST /api/gateway/deploy/healthPOST /api/gateway/deploy/killPOST /api/gateway/deploy/teardownPOST /api/gateway/deploy/status/:ticketIdGET /api/gateway/deploy/check-existingPOST /api/gateway/deploy/detectPOST /api/gateway/deploy/redetectPOST /api/gateway/deploy/extract-infoPOST
Route Methods /api/gateway/learningsGET /api/gateway/symphony/extract-learningsPOST /api/gateway/symphony/process-learningsGET, POST /api/gateway/symphony/process-all-learningsGET, POST /api/gateway/symphony/pending-learningsGET /api/gateway/symphony/learnings-status/:ticketIdGET /api/gateway/symphony/record-learning-usePOST
The 28 supported operation IDs drive approval policy and telemetry tagging:
symphony_launch, symphony_loop, symphony_loop_kill, symphony_plan_loop, symphony_status, symphony_kill, symphony_chat, symphony_comment_chat, symphony_commit_message, symphony_sessions, symphony_plan, symphony_judges, symphony_logs, symphony_chat_history, terminal_chat, ticket_chat, run_viewer_chat, codex_review, codex_argue, git_action, git_pr, git_branch_worktree, health_check, repos_config, deploy, learnings, filesystem, binary_paths_settings
X-Desktop-Gateway-Token (internal cloud executor) or X-Desktop-Session-Token + Origin (browser)Content-Type: application/json (where a body is sent)
See Desktop gateway for the full auth model.