Every workflow, run, and fleet is an HTTP call away.

Every authenticated request carries Authorization: Bearer <jwt>. The token is a JWT, so it expires; the app refreshes it from a cookie session, and a programmatic caller fetches a personal token from GET /api/users/me/token and rotates it with POST /api/users/me/token/regenerate. A missing or expired token returns 401.

The CLI uses a browser handoff: GET /api/auth/cli-callback redirects back to a local listener after you sign in. Check the current actor any time with GET /api/auth/session.

curl https://platform.trickest.com/api/users/me \
  -H "Authorization: Bearer $TRICKEST_TOKEN"

# {
#   "username": "you",
#   "email":    "you@example.com",
#   "vault":    "…"
# }

A workflow is a versioned DAG of modules. Execution is one call: POST /api/runs binds a workflow version to a fleet and inputs, applies any overrides, and returns 201 with the run. Execution is asynchronous, so you observe it after the fact: poll GET /api/runs/{id}, walk GET /api/runs/{id}/subjobs, or stream a single subjob console. Stop or retry from the same resource.

Lists paginate with page and page_size (DRF-style, default page size 20), not opaque cursors.

curl https://platform.trickest.com/api/runs \
  -H "Authorization: Bearer $TRICKEST_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "workflow":   "<workflow-uuid>",
    "fleet":      "<fleet-uuid>",
    "machines":   { "default": 4 },
    "inputs":     { "target": "example.com" }
  }'

# 201 Created
# { "id": "<run-uuid>", "status": "PENDING" }

The API is not a thin demo. It is the surface the product itself drives: 145 documented operations across 94 annotated routes and 30 resource tags, generated from the route handlers and served as one OpenAPI 3.0.0 spec.

Schedule a workflow with POST /api/schedule: pass a workflow, a fleet, an ISO 8601 start date, an integer repeat period, and a parallelism cap. Files move through POST /api/files, a streaming proxy that pipes the upload to storage and attaches auth server-side. The route never hands a token to the browser for a direct PUT.

curl https://platform.trickest.com/api/schedule \
  -H "Authorization: Bearer $TRICKEST_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "workflow":     "<workflow-uuid>",
    "fleet":        "<fleet-uuid>",
    "date":         "2026-06-08T09:00:00Z",
    "repeat_period": 86400,
    "parallelism":  4
  }'

Browse and try every endpoint in the OpenAPI viewer at /api-docs. It renders the spec the routes generate, so it tracks the real surface as it changes. For typed programmatic access, reach for the client.