Administration

Authenticates an operator and returns a session token.#

Verifies an operator's username and password and, when enrolled, a TOTP second factor. On success returns an opaque session token to be sent on subsequent requests via the X-Admin-Password header. A request without a username signs in the legacy 'admin' account, kept for automation written against the shared-password era. When the credentials are correct but a second factor is required, responds 200 with requiresTotp=true and no token; resubmit including the code.

Request body

text/json · AdminLoginRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/login" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "username": "string",
  "password": "string",
  "totpCode": "string",
  "newPassword": "string"
}'

Lists the live admin sessions (admin).#

Every live session with the door that minted it (password or sso), who signed in when the door knows, and its timestamps. Rows are addressed by an opaque id; the bearer tokens never leave the server.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/sessions" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Revokes one admin session by its id (admin).#

Request body

text/json · AdminConfigurationController.SessionRevokeRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/sessions/revoke" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "id": "string"
}'

Revokes every admin session but the caller's own (admin).#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/sessions/revoke-others" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Revokes the current admin session.#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/logout" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Exchanges the admin session for the web-area ticket cookie.#

Admin-gated web areas are opened by plain page navigations, which cannot carry the session header, so the browser proves the session once here and receives an HttpOnly cookie the page gates check.

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/area-ticket" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Reports the caller's second-factor state and the org policy.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/2fa/status" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Begins TOTP enrollment for the caller's own account.#

Generates a pending TOTP secret for the signed-in operator and returns it together with an otpauth:// URI for authenticator apps. The secret only becomes active after it is confirmed via /2fa/enable with a valid code, which also returns the account's single-use recovery codes.

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/2fa/setup" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Confirms and activates TOTP enrollment.#

Request body

text/json · TwoFactorCodeRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/2fa/enable" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "code": "string"
}'

Disables the TOTP second factor.#

Requires a valid current authentication code so that a hijacked session alone cannot strip the second factor.

Request body

text/json · TwoFactorCodeRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/2fa/disable" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "code": "string"
}'

Returns the current server configuration.#

Returns all configurable settings grouped by section. Includes a defaults section for reset-to-default support. Requires the X-Admin-Password header when an admin password is configured.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/configuration" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Updates server configuration.#

Accepts a partial configuration update. Only the supplied fields are modified. Requires the X-Admin-Password header when an admin password is configured.

Request body

application/json · ConfigurationUpdateRequest

Responses

curl -X PUT "$LMKIT_ONE_URL/lmkit/v1/admin/configuration" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "connectors": [
    {
      "name": "string",
      "enabled": false,
      "transport": "string",
      "url": "string"
    }
  ],
  "agents": [
    {
      "name": "string",
      "description": "string",
      "system": "string",
      "skill": "string"
    }
  ]
}'

Reports whether the resolved ffmpeg binary actually runs.#

Probes the ffmpeg binary the server currently resolves (the admin 'FFmpeg Path' setting when set, else the LMKIT_FFMPEG_PATH environment variable, else the server-managed download when installed, else 'ffmpeg' on PATH) and reports the outcome: whether it is runnable, the resolved path, which layer supplied it ('setting' / 'environment' / 'managed' / 'path'), and the probed version line as proof. The probe is cached per resolved path, so this is cheap to call and a path change (saved from the config form) re-answers on the next call. Also carries the managed-install state: whether a managed binary is on disk, whether a static build is published for this platform, and the progress of an in-flight or just-finished managed download so the config form can render it. This is what the config form's FFmpeg Path status line reads: audio transcoding and video frame extraction both depend on this binary.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/ffmpeg/status" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Downloads and installs a managed ffmpeg build for this platform.#

Starts a background download of a static ffmpeg build matching the server's OS and CPU architecture, installing it into the server-managed tools directory. Builds come from the community static-build projects (BtbN's FFmpeg-Builds GitHub releases for Windows, the ffbinaries prebuilt releases for Linux, ffmpeg.martin-riedl.de for macOS) and must pass a -version probe before activation, so a corrupt or wrong-architecture download is discarded rather than installed. Once installed, the binary is used automatically whenever neither the FFmpeg Path setting nor the LMKIT_FFMPEG_PATH environment variable points elsewhere, and audio transcoding plus video frame extraction light up without a restart. Poll 'ffmpeg/status' for progress. 409 when a download is already running, 422 when no static build is published for this platform.

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/ffmpeg/download" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Removes the managed ffmpeg install.#

Deletes the binary previously installed by 'ffmpeg/download' from the server-managed tools directory, so ffmpeg resolution falls back to the system PATH (or whatever the FFmpeg Path setting and LMKIT_FFMPEG_PATH environment variable dictate). Use it when a system-wide install should take over from the managed copy. 409 while a managed download is running.

Responses

curl -X DELETE "$LMKIT_ONE_URL/lmkit/v1/admin/ffmpeg/managed" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Runs a functional self-test of the resolved ffmpeg binary.#

Exercises the resolved ffmpeg end to end instead of trusting its -version banner: the binary first synthesizes a one-second audio+video clip from its built-in generators (no media asset, no network), then the clip runs through the server's two real media paths, the 16 kHz mono WAV transcode that transcription applies to every upload and the still-frame extraction behind video posters. Reports each step's outcome, duration, and artifact size; the test passes only when every step passes. Use it after pointing FFmpeg Path at a new binary or installing the managed download to prove decode and encode actually work on this host. Synchronous and cheap (a few hundred milliseconds when healthy, bounded at 30 seconds).

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/ffmpeg/test" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Prices a shared-slot-pool shape without allocating it#

Reports what the given slot count and per-slot window would cost on each loaded model's device, and what the device memory ceiling (Inference Memory Budget) would actually admit. This is the difference between 'my slot count is not applying' and 'it applied and the card refused it': a shape the device cannot hold is fitted down at attach time, slots first and then the window, so a panel that echoes back only the configured numbers reports a concurrency the server will not deliver. Read-only and non-destructive: the estimate consults the configured ceiling only, and unlike the real admission path it never evicts cached contexts or trims idle pools. Omitting the parameters prices the shape the server is currently configured with. Models whose native memory simulation is unavailable are omitted rather than reported as failures.

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/inference/slot-pool-fit" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Prices a shared-slot-pool shape together with a pending set of per-model overrides#

Same estimate as the GET form, with one difference: the body may carry an override set the operator has not saved yet, and every loaded model is priced at the shape that would actually govern IT once that set is applied. This is what lets an override be checked against the device before it is committed, rather than after a model refuses to open at it. Read-only and non-destructive; an omitted override list prices the saved one.

Request body

text/json · AdminConfigurationController.SlotPoolFitRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/inference/slot-pool-fit" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "slots": "string",
  "slotContextSize": "string",
  "memoryRatio": "string",
  "modelOverrides": [
    {
      "modelId": "string",
      "slotCount": "string",
      "slotContextSize": "string",
      "embeddingContextSize": "string"
    }
  ]
}'

Returns the inference contexts (KV-caches) held in memory for a loaded model.#

Lists every context the given model is keeping resident: the shared context of each attached parallel decoder, those actively in use, and those idle in the recycle pool. Each entry reports its token capacity, KV-cache memory footprint, residency state, and device, which is the detail behind a model's KV-cache count. A decoder's shared context additionally reports its slot shape (slot count, per-slot window, busy slots, queued requests, tracked conversations), since its capacity is a pool serving many concurrent requests rather than one session's window. Returns 404 when the model is not loaded.

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/models/contexts" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Hibernates every in-memory inference context held by a single loaded model.#

Schedules background hibernation of one model's live contexts, and their speculative-decoding draft siblings, serializing each context's state to disk and releasing device and host memory. This is a one-shot action, not a persisted setting, so it does not alter the saved configuration. A context that is mid-decode hibernates once it frees up, and any session rehydrates transparently on its next request. Returns the number of contexts scheduled. Requires the X-Admin-Password header when an admin password is configured.

Request body

text/json · ModelUnloadRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/models/hibernate" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "modelUri": "string"
}'

Returns model catalog grouped by capability.#

Returns non-legacy predefined models from the LM-Kit catalog, organized by server role. Requires the X-Admin-Password header when an admin password is configured.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/models" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns available GPU devices.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/devices" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns fast-changing dashboard metrics suitable for high-frequency polling.#

Excludes the loaded-model details list and upload-directory stats, which are served separately by GET /admin/dashboard/snapshot. Safe to poll once per second.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/dashboard/live" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns a complete CPU-RAM diagnostic breakdown of the server process.#

Aggregates the OS process view, the .NET managed heap (per-generation sizes, fragmentation, GC mode), OS-specific figures (Linux /proc/self/status and smaps_rollup, cgroup limits, the glibc allocator ledger), host physical memory, and what LM-Kit holds (model weights, KV-cache, contexts). Intended for on-demand use when the operator opens the memory panel, not high-frequency polling.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/memory/diagnostics" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Runs a blocking, compacting full garbage collection and reports what was reclaimed.#

Forces a full Gen2 collection with a one-time large-object-heap compaction, then returns the before/after working set and managed heap so the operator can see the effect.

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/memory/gc-collect" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Asks the native allocator to return freed-but-retained memory to the OS.#

On glibc this calls malloc_trim(0), the direct lever for the arena-retention RSS growth seen under high-concurrency churn on Linux. On Windows it empties the process working set. Reports the before/after resident set so the operator can see the effect.

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/memory/trim" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Clears rebuildable LM-Kit SDK caches and reports what was reclaimed.#

Drops the idle OCR engine pool, the idle inference-context recycle pool, and per-model tokenization / embedding lookup caches, then runs a collection. Loaded model weights and in-use contexts are never touched, so it is safe on a live server; the only cost is that the next request rebuilds what was dropped.

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/memory/clear-caches" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the heavier dashboard snapshot (upload-directory stats).#

Intended for on-demand refresh; not for high-frequency polling.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/dashboard/snapshot" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns live dashboard metrics.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/dashboard" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Triggers manual file cleanup of expired uploads.#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/files/cleanup" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns live OpenTelemetry instruments discovered from watched meters, including per-tag-set breakdowns and histogram bucket distributions.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/telemetry/status" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Streams telemetry snapshots via Server-Sent Events at 1Hz. Avoids the polling round-trip the panel used to do every second.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/telemetry/stream" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns recent alert history (up to 200 entries).#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/alerts/history" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Clears all recorded alerts. Returns the number of entries removed. Audit-logged to ActivityLog + LogManager so operators can trace who cleared the list.#

Responses

curl -X DELETE "$LMKIT_ONE_URL/lmkit/v1/admin/alerts/history" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Dismisses the dashboard alert banner: mutes every currently-recorded alert so the banner disappears until a NEW threshold breach fires. The alerts are not deleted - the Alerts page still lists them and GET alerts/history returns them. Returns the number of alerts muted. Audit-logged.#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/alerts/dismiss" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the latest restart-cause report, produced when the server detects that its previous run terminated without a clean shutdown (crash, OOM kill, host reboot, ...). Includes the classified cause, confidence, recommendation, and the raw OS-level evidence lines.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/diagnostics/restart-report" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the restart history: one entry per server start (normal start, admin restart, or crash recovery), newest first. Crash recoveries carry the full restart-cause report with evidence, so past incidents stay diagnosable long after their dashboard banner was dismissed.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/diagnostics/restart-history" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Acknowledges (dismisses) the current restart-cause report so the dashboard banner disappears. The dismissal is persisted and audit-logged; the report itself remains retrievable from GET diagnostics/restart-report.#

Request body

text/json · RestartReportAcknowledgeRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/diagnostics/restart-report/acknowledge" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "id": "string"
}'

Queries the persistent audit log (admin actions, alerts, control events). Supports filtering by minimum severity, source category, and a since-timestamp, with a hard limit of 5000 entries per call. The same store backs the in-memory dashboard activity feed; this endpoint is the durable history that survives process restarts.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/audit/history" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the audit log as JSON Lines (one JSON object per line) for ingestion into log aggregators (Splunk, Datadog, ELK, Sentinel). Optionally filter by a since-timestamp.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/audit/export" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the actual disk usage of the model storage directory by scanning the filesystem. Reports total bytes on disk, file count, and the resolved directory path. This is the authoritative figure for 'how much space do the downloaded models take'. Summing catalog-metadata sizes can mislead because it counts only models the catalog knows about and uses each model's nominal file size, not what is actually on disk.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/models/disk-usage" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the top host processes by CPU usage. CPU% is computed from the delta of TotalProcessorTime between successive calls; the first call after process start returns 0% for every entry, so callers that want meaningful values should poll at a few-second cadence.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/processes" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns recent request latency percentiles (P50/P90/P95/P99).#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/metrics/latency" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns per-endpoint aggregated stats (count / latency / error rate).#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/metrics/endpoints" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Clears recorded metric history (in-memory). Charts reset to empty.#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/metrics/history/reset" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the persisted per-instrument time-series history (up to 1 hour at 1 Hz). Used by the telemetry panel to seed its live charts so users see real history when they open the page hours after the server started.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/telemetry/history" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns one instrument's durable, downsampled time-series over a window (seconds). Backs the telemetry panel's long windows (1h .. 7d) and survives a process restart, unlike the in-memory ring which is wiped on restart.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/telemetry/series" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Resets every OpenTelemetry instrument snapshot collected by the admin panel (counts, sums, bucket counts, per-tag-set state).#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/telemetry/reset" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns recent samples for each metric tracked by the live dashboard.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/metrics/history" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns accurate window statistics (avg/min/max/last) per dashboard metric, computed from the raw 1 Hz samples.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/metrics/stats" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the current OCR engine status: provider, in-flight operations, and concurrency configuration.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/ocr/status" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the list of currently in-flight inference requests.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/inferences/active" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Lists the API requests currently in flight, for the dashboard 'Active requests' panel.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/requests/active" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Lists the inferences currently waiting for a scheduler slot, for the dashboard 'Queue depth' panel.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/queue/active" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Lists the background jobs currently processing, for the dashboard 'Active jobs' panel.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/jobs/active" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Cancels one in-flight background job from the admin console (admin override, any owner).#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/jobs/$ID/cancel" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Lists every API key the server accepts as a bearer token. Tokens are returned redacted.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Mints a new API key. The raw token is returned ONCE in this response - it cannot be re-displayed later.#

Request body

text/json · AdminConfigurationController.CreateApiKeyRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string",
  "scope": "string",
  "expiresInDays": "string",
  "clusterGrants": [
    "string"
  ]
}'

Revokes (disables but retains) an API key.#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys/$ID/revoke" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Re-enables a previously revoked API key.#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys/$ID/restore" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Regenerates an API key's token. The key keeps its identity and access to all its resources; the old token stops working immediately. The new token is returned ONCE.#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys/$ID/regenerate" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Updates the display name of an API key. The token and usage statistics are preserved.#

Parameters

Request body

text/json · AdminConfigurationController.RenameApiKeyRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys/$ID/rename" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string"
}'

Sets which server-executed tools a key may use in chat: null follows the server policy, an empty list locks tools off, names narrow the policy.#

Parameters

Request body

text/json · AdminConfigurationController.ApiKeyToolGrantsRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys/$ID/tool-grants" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "grants": [
    "string"
  ]
}'

Sets which search clusters a key may address: null restores the open default (any cluster), an empty list locks clusters off, ids restrict to those clusters.#

Parameters

Request body

text/json · AdminConfigurationController.ApiKeyClusterGrantsRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys/$ID/cluster-grants" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "grants": [
    "string"
  ]
}'

Reports what one API key can reach in Search: its cluster grants, every configured cluster, and the tenants granted to it in each.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys/$ID/search-access" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Permanently deletes an API key. Use revoke if you might re-enable it later.#

Parameters

Responses

curl -X DELETE "$LMKIT_ONE_URL/lmkit/v1/admin/apikeys/$ID" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Mints a seconds-lived ticket that authorizes one stream or download URL.#

EventSource connections and anchor-tag downloads cannot carry the X-Admin-Password header, and the session token itself never rides a query string (URLs persist in proxy logs and browser history). This mints a ticket bound to one purpose ('events', 'telemetry', or 'uploads') that expires within seconds; pass it as ?ticket= to the matching endpoint.

Request body

text/json · StreamTicketRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/stream-ticket" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "purpose": "string"
}'

Server-Sent Events stream that emits dashboard, inferences, and downloads ticks every second from a single long-lived connection. Replaces the three 1Hz polling endpoints (the polling endpoints still work as fallback).#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/events" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns a security-posture audit: every hardening control the server exposes, whether it is at its recommended setting, and what to change to reach optimal security.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/security/audit" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Sets the first operator password, or changes the caller's own. Requires an authorized admin session.#

While no operator account exists, this creates the first one ('admin', Owner) with the given password. Once accounts exist it changes the calling operator's own password and requires the current one; the account's other sessions and remembered devices are signed out.

Request body

application/json · AdminConfigurationController.ChangeAdminPasswordRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/security/admin-password" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "newPassword": "string",
  "currentPassword": "string"
}'

Lists the operator accounts (admin).#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/security/operators" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Creates a new operator account (admin).#

Adds a named operator with its own credential. Role is one of owner, admin, or viewer (stored now, enforced once role gates ship).

Request body

application/json · AdminConfigurationController.OperatorCreateRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/security/operators" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "username": "string",
  "displayName": "string",
  "email": "string",
  "role": "string"
}'

Describes the caller's own identity and access tier.#

Who this session belongs to and what it may do: the operator's username and role for a local sign-in, the account identity for an SSO sign-in, or the open unprovisioned surface. The panel uses it to offer only the surfaces the role can act on.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/security/me" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Updates an operator's profile and role (Owner).#

Parameters

Request body

application/json · AdminConfigurationController.OperatorUpdateRequest

Responses

curl -X PUT "$LMKIT_ONE_URL/lmkit/v1/admin/security/operators/$ID" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "displayName": "string",
  "email": "string",
  "role": "string"
}'

Deletes an operator account (Owner).#

Removes the account permanently and ends its sessions. Prefer disabling, which keeps the name attributable in old audit entries; deletion is for accounts created in error.

Parameters

Responses

curl -X DELETE "$LMKIT_ONE_URL/lmkit/v1/admin/security/operators/$ID" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Enables or disables an operator account (Owner).#

Disabling is the preferred way to retire an operator: sign-in is refused, its sessions and remembered devices end, and its name stays attributable in the audit trail.

Parameters

Request body

application/json · AdminConfigurationController.OperatorEnabledRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/security/operators/$ID/enabled" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "enabled": false
}'

Resets an operator's password to a one-time value (Owner).#

Assigns a temporary password the operator must replace at the next sign-in. The account's sessions and remembered devices end immediately, so only the holder of the one-time value can return.

Parameters

Request body

application/json · AdminConfigurationController.OperatorPasswordResetRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/security/operators/$ID/reset-password" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "newPassword": "string"
}'

Returns metadata about the TLS certificate Kestrel is currently serving with, plus an inventory of TLS protocols and cipher suites available to the host.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/tls/info" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Uploads a PEM or PFX certificate bundle. The file is validated, re-exported to a stable per-server path, and used on the next restart. Restart the server (or click the Restart button on the dashboard) to apply.#

Request body

application/x-www-form-urlencoded · object

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/tls/certificate" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/x-www-form-urlencoded"

Removes the admin-uploaded TLS certificate so the server reverts to the self-signed fallback on the next restart.#

Responses

curl -X DELETE "$LMKIT_ONE_URL/lmkit/v1/admin/tls/certificate" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the current ACME (Let's Encrypt) automatic-TLS settings and whether they are active on this run.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/tls/acme" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Updates the ACME (Let's Encrypt) automatic-TLS settings. Persisted to appsettings.json; a server restart is required to apply.#

Request body

application/json · AcmeConfigRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/tls/acme" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "enabled": false,
  "domainNames": [
    "string"
  ],
  "emailAddress": "string",
  "acceptTermsOfService": false
}'

Lists every recurring server-side maintenance task and its last run, last duration, last status, and computed next run.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/scheduler/jobs" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Triggers one immediate pass of a named recurring maintenance task. The next scheduled tick is unaffected.#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/scheduler/jobs/$NAME/run" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Requests cancellation of every in-flight inference. Returns the number of inferences that were active when the call was made.#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/inferences/cancel-all" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Initiates a graceful server restart. In-flight inferences are cancelled, a fresh child process is spawned with the same command-line args + environment, and the current host stops cleanly. The child waits for this process to fully exit before binding its listeners, so there is a brief window of unavailability but no port conflict.#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/server/restart" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Requests cancellation of an in-flight inference by aborting the underlying HTTP connection.#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/inferences/$ID/cancel" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the most recent activity feed entries.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/activity/recent" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Downloads the complete retained log history.#

Streams every retained log file (server.log plus all rotated archives) concatenated oldest-first as a single text/plain download. The dashboard polling endpoint is capped at 500 lines for low-latency UI updates; this endpoint is the canonical way to retrieve the full on-disk history.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/logs/download" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the retained log history as JSON, with cursor pagination for scroll-back.#

Reads every retained log file (server.log plus rotated archives) and returns a page of entries in chronological order. Without beforeLine: returns the most recent maxLines entries (the tail). With beforeLine=K: returns up to maxLines entries strictly older than line K, for scroll-up pagination. Lines are numbered 1..totalLines across the full retained set (1 = oldest, totalLines = newest). Response envelope: { logs, totalLines, totalBytes, truncated, fromLine, toLine, files }. fromLine/toLine bracket the returned page; pass fromLine back as the next beforeLine to walk further into history. truncated=true on the tail call means the full set exceeds the cap (use /logs/download for the complete archive). maxLines defaults to 20000 and is clamped to [100, 200000]; the UI uses 2000 per scroll batch.

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/logs/file" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Clears the server log file.#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/logs/clear" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Clears the request history.#

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/requests/clear" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the recorded request history with filters and sorting. Use this for audit and incident investigation.#

All filter parameters are optional and AND-combine. method: GET/POST/etc. statusClass: 2xx/3xx/4xx/5xx. statusCode: exact status code (overrides statusClass). path: case-insensitive substring of the request path. clientIp: exact match. apiKeyId: stable identifier from ApiKeyStore (exact match). apiKey: case-insensitive substring of the audit-safe display form (key name or redacted token). requestId: exact match. minMs/maxMs: duration bounds in milliseconds. keyPresence: anonymous (no key supplied) or identified (any key supplied). hasError: true => only rows with a captured error summary, false => only rows without one. sinceUtc/untilUtc: ISO-8601 inclusive bounds. limit: page size, clamped to a server-side maximum (default 200). offset: row offset for pagination (default 0, requires SQLite path). sort: newest (default), oldest, slowest, fastest, status.

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/requests" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns a bucketed request-count timeseries for the same filter shape as /requests.#

Aggregates rows in the request audit store into fixed-width time buckets. Drives the request-volume chart on the admin Requests page. When sinceUtc is omitted the window starts at the oldest matching row, so the series covers the full filtered history. When bucketSeconds is omitted a width is auto-selected so the window spans at most ~120 buckets. The response echoes the effective sinceUtc/untilUtc/bucketSeconds used.

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/requests/timeseries" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns an aggregate summary (status mix, latency percentiles, byte totals) of the rows matching the same filters as /requests.#

Aggregates the FULL filtered result set, not one page: total row count, per-status-class counts, combined error rate, p50/p95/avg/max duration, and request/response byte totals. Drives the stats strip above the audit-log table. All filter parameters mirror /requests.

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/requests/stats" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns top-talker aggregates (by API key or client IP) over the rows matching the same filters as /requests.#

Groups the filtered rows by API key (by=key, default) or client IP (by=client) and returns the busiest groups first: request count, 4xx/5xx split, error rate, p50/p95 latency, and last-seen timestamp. Key buckets carry the stable ApiKeyStore id when the token resolved, so a row can be turned into an apiKeyId filter with one click. Anonymous traffic collapses into a single empty-id bucket. top caps the group count (default 25, max 100).

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/requests/aggregate" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Exports recorded requests as CSV, with the same filters as the /requests endpoint.#

Streams every persisted row that matches the supplied filter as CSV (one row per request). Designed for incident export and downstream analysis: open in Excel / a pandas dataframe / a BI tool. No row cap is applied: exports walk the full filtered result set, not just the current page. All filter parameters mirror /requests.

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/requests/export" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Starts a model download as a background task.#

Schedules a background download for the supplied modelId and returns immediately. Progress is reported through GET /admin/downloads/active and the download survives client disconnects or page reloads. Cancel via POST /admin/downloads/cancel. Requires the X-Admin-Password header when an admin password is configured.

Request body

application/json · AdminConfigurationController.DownloadRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/downloads/start" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "modelId": "string"
}'

Cancels an in-progress model download.#

Request body

application/json · AdminConfigurationController.DownloadRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/downloads/cancel" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "modelId": "string"
}'

Returns the list of active and recently completed downloads.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/downloads/active" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Tests AWS Textract connectivity with the supplied credentials.#

Signs a minimal Textract DetectDocumentText request with SigV4 and sends it to the target region. Any field left blank (including a masked secret of ****) falls back to the stored server configuration.

Request body

application/json · TextractTestRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/ocr/textract/test" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "awsAccessKeyId": "string",
  "awsSecretAccessKey": "string",
  "awsRegion": "string"
}'

Streams log entries in real-time via Server-Sent Events.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/logs/stream" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Downloads the current appsettings.json configuration.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/config/export" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Uploads and replaces the appsettings.json configuration.#

Replaces the whole settings file, every section included. Because that reaches the Owner-only sections (Security, SSO) the piecemeal configuration API refuses to Admin sessions, the import needs the Owner role: anything less would let an Admin write through the file what the API refuses at the boundary.

Request body

multipart/form-data · object

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/config/import" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: multipart/form-data"

Unloads a model from memory.#

Request body

text/json · ModelUnloadRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/models/unload" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "modelUri": "string"
}'

Loads a model into memory by model ID.#

Request body

text/json · ModelUnloadRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/models/load" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "modelUri": "string"
}'

Deletes a downloaded model file from disk.#

Request body

text/json · ModelUnloadRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/models/delete" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "modelUri": "string"
}'

Deletes every file in the model storage directory. Unloads any in-memory models first.#

Wipes the contents of the configured model directory. Any currently-loaded model is unloaded first so its on-disk file can be removed (unloads that fail because the model is in use leave that file skipped and counted in 'skippedInUse'). Active downloads are cancelled best-effort. Returns the aggregate count and byte total of deleted files, plus a list of files that could not be deleted.

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/models/delete-all" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the actual disk usage of the upload directory by scanning the filesystem. Reports total bytes on disk, file count (excluding .manifest sidecars), and the resolved directory path.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/uploads/disk-usage" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Deletes every file in the upload directory.#

Wipes the contents of the configured upload directory, including manifest sidecars. Files locked by an in-flight request are skipped and reported in 'failed'. Returns the aggregate count and byte total of deleted files.

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/uploads/delete-all" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Lists the files in the upload directory for browsing in the admin console.#

Returns one entry per stored file (manifest sidecars excluded), each with its path relative to the upload root, its original upload name (resolved from the manifest when present), size, last modified time, and owner bucket. Use the path with the download endpoint to fetch a single file.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/uploads/files" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Downloads a single file from the upload directory by its path relative to the upload root.#

The path must stay inside the upload directory; any path that escapes it (".." traversal or an absolute path) is rejected. The file is served as an attachment under its original upload name.

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/uploads/download" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Downloads the entire upload directory as a single zip archive.#

Streams a zip of every file in the upload directory (including manifest sidecars), preserving the per-owner bucket structure. Files locked by an in-flight request are skipped.

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/uploads/download-all" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the actual disk usage of the context hibernation directory by scanning the filesystem. Reports total bytes on disk, file count, and the resolved directory path.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/hibernation/disk-usage" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Deletes every file in the context hibernation directory.#

Wipes the contents of the configured hibernation cache directory. Files locked by active sessions are skipped and reported in 'failed'. Returns the aggregate count and byte total of deleted files.

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/hibernation/delete-all" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Creates a new Search cluster and initializes its schema.#

Request body

text/json · SearchServiceClusterCreateRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "clusterId": "string",
  "isDefault": false,
  "fullTextStore": "string",
  "vectorStore": "string"
}'

Tests a Search cluster connection without saving it.#

Request body

text/json · SearchServiceClusterCreateRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/test" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "clusterId": "string",
  "isDefault": false,
  "fullTextStore": "string",
  "vectorStore": "string"
}'

Tests an existing Search cluster connection. With no body it tests the cluster's stored connection; with a body it tests the supplied (edited) parameters, keeping the stored password where a field is left blank.#

Parameters

Request body

text/json · SearchServiceClusterCreateRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/test" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "clusterId": "string",
  "isDefault": false,
  "fullTextStore": "string",
  "vectorStore": "string"
}'

Returns an existing Search cluster's connection parameters (passwords redacted) so the admin UI can pre-fill the edit form.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/connection" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Changes an existing Search cluster's connection parameters. Blank password fields keep the stored password. The new connection is validated and migrated before it is persisted; on failure the previous connection is restored.#

Parameters

Request body

application/json · SearchServiceClusterCreateRequest

Responses

curl -X PUT "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/connection" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "clusterId": "string",
  "isDefault": false,
  "fullTextStore": "string",
  "vectorStore": "string"
}'

Deletes a Search cluster from configuration. Data in PostgreSQL is left intact.#

Parameters

Responses

curl -X DELETE "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Sets a Search cluster as default.#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/default" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Lists every tenant in a Search cluster, across all owners.#

The expensive per-tenant page/vector totals are served from a short-lived cache so the list renders immediately; a tenant whose totals are still being computed is flagged statsPending. Pass fresh=true to recompute every count synchronously (the explicit per-tenant Refresh action).

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/tenants" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Provisions a new tenant in a Search cluster.#

Parameters

Request body

text/json · SearchServiceTenantCreateRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/tenants" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "displayName": "string",
  "grantKeyIds": [
    "string"
  ]
}'

Lists API keys and whether each one can access a tenant (per-key grant).#

A key can reach the tenant when it has been granted that tenant. Revoked keys are omitted.

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/tenants/$TENANTID/access" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Grants or revokes one API key's access to one tenant (per-tenant grant).#

Granting adds an access grant for this one key on this one tenant; revoking removes it. Grants are additive and per-tenant, so they never affect the key's access to any other tenant. Revoking a key that reached the tenant through ownership retires that ownership (granting the owner's other active keys first) so the revoke takes effect.

Parameters

Request body

text/json · SearchServiceTenantAccessRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/tenants/$TENANTID/access" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "apiKeyId": "string",
  "grant": false
}'

Returns operational health for a Search cluster.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/health" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Sets a Search cluster's storage-volume size for the admin disk-usage bar. Display metadata only - PostgreSQL cannot read the OS volume size on a managed instance - so it never touches the database and works even when the backend is read-only or full. Pass maxStorageGb (0 clears it).#

Parameters

Request body

application/json · SearchServiceStorageRequest

Responses

curl -X PUT "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/storage" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "maxStorageGb": "string"
}'

Estimates per-column on-disk storage for a Search cluster's heavy tables (sampled pg_column_size scaled by live row count). Tells apart a multi-GB column (e.g. ft_search.page_markdown) from a negligible one, to target space reclamation.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/column-storage" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns database diagnostics for a Search cluster: server overview, per-index usage and size, and per-table access patterns.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/diagnostics" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the live state of the background embedding/reindex worker (process-global): status, current phase and operation age, trailing-window throughput per cluster, inference-lane occupancy, the data-plane admission-gate queue, parked tenants, and a recent event timeline. Lightweight and pollable - reads in-process state only, no database query.#

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/search/worker" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the Search live-telemetry series (query latency/throughput, connection-gate and embedding-lane occupancy, worker write/drain/backlog, and live database health: delta cache-hit ratio, disk-read rate, transaction rate, active backends, and the longest-running query) as recent per-metric sample arrays, plus a database-health headline. Reads only the in-process metric ring and the sampler's last snapshot - no database query runs on this path, so the panel can poll it freely.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/search/metrics" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Returns the cluster's cumulative per-query statistics from pg_stat_statements, ordered by total execution time: the aggregate view of what has cost the database the most since its statistics were last reset (catching the frequent-but-fast as well as the rare-but-huge). Installs the extension on first use; reports available=false when the managed instance does not preload it. Query text of other database roles may read '<insufficient privilege>' while its timings stay real.#

Parameters

Responses

curl -X GET "$LMKIT_ONE_URL/lmkit/v1/admin/search/top-queries" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Clears the cluster's slow-query views so they measure from a clean slate after a deploy: empties the in-memory live trace (finished entries keep their durable copy in the server log) and resets the database's cumulative pg_stat_statements ranking. statementsReset reports whether the database-side reset succeeded; a managed instance may refuse it when the admin role lacks the privilege, in which case the trace is still cleared and detail carries the database's error text.#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/search/slow-queries/reset" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Captures the query plan for a search under a tenant's row-level-security scope, so the plan reflects a real caller's query. Mode 'fulltext' (default) explains the BM25 inverted-index scan; mode 'vector' embeds the query with the tenant's model and explains the semantic retrieval.#

Parameters

Request body

application/json · SearchServiceExplainRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/explain" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "tenant_id": "string",
  "query": "string",
  "ft_config": "string",
  "mode": "string"
}'

Refreshes PostgreSQL planner statistics (ANALYZE) for a Search cluster's tables so the planner uses the GIN and HNSW indexes instead of sequential and per-row scans. Autovacuum never analyzes the partitioned parent tables, so this is the supported way to keep statistics fresh. Safe to run on a live cluster.#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/analyze" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Rebuilds the full-text GIN index across every ft_search partition for a Search cluster. Recovers an index left invalid (silently ignored by the planner, forcing a sequential scan); CREATE INDEX IF NOT EXISTS cannot repair an existing-but-invalid index. Holds a brief lock on ft_search while the GIN builds.#

Parameters

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/admin/clusters/search/$CLUSTERID/rebuild-fulltext-index" \
  -H "Authorization: Bearer $LMKIT_API_KEY"

Rebuilds every invalid per-model vector HNSW index for a Search cluster so semantic and hybrid search use the index instead of a full scan. An invalid HNSW index is silently ignored by the planner. HNSW indexes can be large, so a rebuild can take minutes and holds a lock on its table while it builds; valid indexes are skipped.#

Parameters