title: CloudSlash - API Endpoints Reference description: The CloudSlash daemon exposes a REST API at http://localhost:8080. All endpoints accept and return JSON. The API powers both the Web Dashboard and the CLI: a...

API Endpoints¶

The CloudSlash daemon exposes a REST API at http://localhost:8080. All endpoints accept and return JSON. The API powers both the Web Dashboard and the CLI: anything you can do in the UI, you can automate via these endpoints.

Infrastructure¶

GET /api/v1/topology¶

Retrieves a serialized snapshot of the live Devi universal graph. Response payloads reflect the current physical state evaluated against active heuristics.

Response 200 OK:

{
  "topology_version": "v3.1.0",
  "checksum_sha256": "df3a2b1...",
  "meta": {
    "total_nodes": 2847,
    "total_edges": 4103,
    "waste_identified_usd_mo": 48320.0
  },
  "nodes": [
    {
      "crn": "crn:devi:aws:us-east-1:ec2:instance:123456789012:i-0abc123",
      "type": "AWS::EC2::Instance",
      "state": "stopped",
      "cost_usd_mo": 347.2,
      "heuristics_flagged": [{"rule_name": "IdleInstance", "severity": 10}],
      "provenance": {
        "commit": "abc1234f",
        "author": "j.smith@company.com",
        "file": "infrastructure/ml/main.tf",
        "line": 47
      }
    }
  ],
  "edges": [
    {
      "source_crn": "crn:devi:aws:us-east-1:ebs:volume:123:vol-0ghi789",
      "target_crn": "crn:devi:aws:us-east-1:ec2:instance:123:i-0abc123",
      "type": "AttachedTo"
    }
  ]
}

GET /api/v1/nodes¶

Returns all discovered nodes in the serialized NodeRow format consumed by the TUI.

GET /api/v1/graph¶

Returns nodes and edges formatted for ReactFlow visualization (Web UI topology tab).

GET /api/v1/graph/topology¶

Returns the complete graph topology with node positions, edge types, and cluster groupings.

GET /api/v1/graph/blast-radius/{crn}¶

Calculates the blast radius of a node: all dependent resources that would be affected by its removal.

GET /api/v1/waste-ledger¶

Returns aggregate waste summary with projected savings per resource type.

GET /api/v1/anomalies¶

Returns statistical anomaly detection results with 30-second TTL cache.

GET /api/v1/traffic/edges¶

Returns network traffic flow edges between graph nodes.

POST /api/v1/traffic/ingest¶

Ingests traffic flow data from external monitoring sources.

Analysis¶

GET /api/v1/heuristics/status¶

Returns all heuristic engine results: counts, verdicts, and engine attribution.

GET /api/v1/drift/report¶

Returns Terraform state drift analysis: resources whose live state has diverged from declared IaC configuration.

GET /api/v1/solver/results¶

Returns formal verification results including solver confidence scores and reachability analysis.

POST /api/v1/engine/scan¶

Triggers a manual re-scan of all configured cloud providers.

POST /api/v1/sync¶

Triggers an immediate Swarm reconciliation cycle.

Policies¶

GET /api/v1/policies/mesh¶

Returns all loaded CEL policies with trigger counts and enforcement status.

POST /api/v1/policies¶

Add new CEL rules dynamically to the running daemon.

Request:

{
  "rules": [{
    "id": "block-public-rds",
    "condition": "kind == 'rds:instance' && props.PubliclyAccessible == true",
    "action": "block",
    "message": "Public RDS endpoint detected"
  }]
}

POST /api/v1/policies/toggle¶

Toggle a rule between enforcing and shadow enforcement modes.

{"rule_id": "block-public-rds"}

POST /api/v1/policies/reorder¶

Reorder rule evaluation priorities.

POST /api/v1/policies/dry-run¶

Evaluate a CEL expression against the live graph without persisting the rule.

{"condition": "cost > 1000 && provider == 'aws'"}

GET /api/v1/policies¶

Returns all configured policy rules.

Remediation Pipeline¶

GET /api/v1/remediation/queue¶

Returns the remediation pipeline state. Resources flow through stages: flagged → analyzed → codegen → sau_gate → pending → applied.

POST /api/v1/remediation/approve¶

Approves a resource for remediation execution.

POST /api/v1/remediation/reject¶

Rejects a pending remediation action.

POST /api/v1/remediation/move¶

Moves a resource between pipeline stages.

POST /api/v1/remediation/bulk¶

Bulk-approve or bulk-reject multiple resources.

GET /api/v1/plan¶

Returns the Terraform plan diff for the specified resource.

GET /api/v1/provenance¶

Returns git blame provenance data: commit hash, author, and file location.

GET /api/v1/oracle/{crn}¶

Returns Oracle formal verification results for a specific resource, including spot instance interruption risk.

Configuration¶

GET /api/v1/config¶

Returns the current daemon configuration as JSON.

PUT /api/v1/config¶

Mutates configuration values via deep-merge. Changes are applied without requiring a daemon restart.

Request:

{
  "daemon": {"scan_interval": "5m"},
  "oracle": {"enabled": true, "trigger_threshold": 0.5}
}

POST /api/v1/config/slack-test¶

Sends a test notification to the configured Slack webhook.

AI¶

POST /api/v1/cortex/assimilate¶

DEVI AI chat endpoint. Accepts a natural language query and returns streaming infrastructure analysis.

GET /api/v1/ai/providers¶

Returns the list of configured AI providers and their status.

Plugins¶

GET /api/v1/plugins¶

Returns all installed plugins with their status, category, display name, and color from the registry.

Response 200 OK:

[
  {
    "name": "aws",
    "display_name": "Amazon Web Services",
    "category": "cloud",
    "color": "#FF9900",
    "path": "/Users/you/.cloudslash/plugins/cloudslash-plugin-aws",
    "active": true
  },
  {
    "name": "k8s",
    "display_name": "Kubernetes",
    "category": "infrastructure",
    "color": "#326CE5",
    "path": "/Users/you/.cloudslash/plugins/cloudslash-plugin-k8s",
    "active": true
  }
]

The category field is assigned by the registry maintainer and controls workspace filtering in both the TUI ([C] key) and Web UI. Valid categories: cloud, database, infrastructure, saas, iot, devops, security.

POST /api/v1/plugins/install¶

Installs a community plugin from the registry.

POST /api/v1/plugins/toggle¶

Enables or disables an installed plugin.

Observability¶

GET /healthz¶

Liveness probe. Returns 200 OK when the daemon process is alive.

GET /readyz¶

Readiness probe. Returns 200 OK when the graph is hydrated and the engine is accepting requests.

Event History¶

The event history endpoints query the persistent BadgerDB-backed event store. Events survive daemon restarts and include scans, s.a.u decisions, approvals, rejections, policy changes, and pipeline movements.

GET /api/v1/history¶

Paginated event history with filtering support.

Query Parameters:

Response 200 OK:

{
  "events": [
    {
      "id": "a1b2c3d4e5f6",
      "ts": "2026-04-30T14:30:00Z",
      "type": "s.a.u_ACTION",
      "crn": "crn:aws:us-east-1:ec2:instance:123:i-0abc",
      "status": "QUARANTINED",
      "message": "[s.a.u] Quarantined idle EC2 instance",
      "actor": "daemon",
      "session_id": "f6e5d4c3b2a1",
      "meta": { "savings_usd": 432.50 }
    }
  ],
  "next_cursor": "events:00000017189...",
  "total": 1
}

GET /api/v1/history/summary¶

Aggregate statistics across all stored events.

Response 200 OK:

{
  "total_events": 2847,
  "quarantined": 124,
  "approved": 98,
  "rejected": 12,
  "total_savings_usd": 48320.0,
  "first_event": "2026-03-01T00:00:00Z",
  "last_event": "2026-04-30T23:59:00Z",
  "session_count": 47
}

GET /api/v1/history/resource¶

Full lifecycle timeline for a single resource.

Query Parameters:

Response 200 OK:

{
  "crn": "crn:aws:us-east-1:ec2:instance:123:i-0abc",
  "events": [ ... ],
  "total": 4
}

GET /api/v1/history/sessions¶

Lists all daemon sessions with event counts and time ranges.

Response 200 OK:

{
  "sessions": [
    {
      "session_id": "f6e5d4c3b2a1",
      "first_event": "2026-04-30T14:00:00Z",
      "last_event": "2026-04-30T18:30:00Z",
      "event_count": 847
    }
  ],
  "current": "a1b2c3d4e5f6"
}

POST /api/v1/history/prune¶

Manually prune events older than a specified age.

Request Body:

{
  "max_age_days": 90
}

Response 200 OK:

{
  "pruned": 142,
  "max_age_days": 90
}