Overview
HTTP routes, WebSocket protocol, event types.
This section is the on-the-wire reference. For the why behind any of these shapes, jump to Concepts. If you are comparing SNA's HTTP/WebSocket API with ACP, see SNA and ACP.
Endpoint reference
Request fields, responses, and notes for every HTTP endpoint.
HTTP routes
Every server endpoint, grouped by surface.
WebSocket protocol
Request/response ops, push channels, reconnect semantics.
Events
The 15-type AgentEvent enum, deltas, finals.
OpenAPI spec
Live spec served by the running server.
Source of truth
The server's Hono app is built from @hono/zod-openapi route
definitions. The running server publishes its own OpenAPI 3.1 spec
that's generated from those same Zod schemas, so the wire shapes you
see here, the SDK types, and the live spec can't drift.
| URL | Purpose |
|---|---|
GET /openapi.json | Raw spec JSON |
GET /docs | Swagger UI |
GET /spec | Plain text spec |
Authentication
All runtime HTTP routes except GET /health require
Authorization: Bearer <authToken>. The same token protects SSE
streams and WebSocket upgrades. SDK launchers return it as
handle.connection.authToken, and clients should pass
handle.connection through intact.
The OpenAPI document declares global bearerAuth, clears security on
/health, and lists 401/403 responses on protected routes.
When in doubt, hit the live server: it's always more authoritative than this page.