NexusAGI API
Endpoints reachable from outside this machine. Every call needs the shared access password once, via /api/nexusagi/auth, to get a session token.
Authentication
New username + the shared password registers an account; an existing username + the same password logs in. Returns a session token to send back as X-NexusAgi-Session on every other call. At most 2 sessions may be active system-wide at once.
Rate limiting. One attempt per client per 60s, counted by client address and independent of the username, plus a ceiling on total attempts per minute across all clients and an escalating backoff after repeated failures. A 429 carries retryAfterSeconds and a Retry-After header. (This page previously claimed "one attempt per account per 60s" — that was true only for a username that had already logged in successfully at least once, and so overstated the endpoint's brute-force resistance; corrected 2026-08-23.)
curl -X POST /api/nexusagi/auth -d '{"username":"vasa","password":"...","profileName":"Vasa"}'
→ { sessionToken, registered, username, profileName, lifetimeTokens, activeSessions }
Ends the current session, freeing its concurrency slot immediately instead of waiting for idle eviction.
Chat
Sends one message to the AGI. Wraps the same InteractiveService.ChatAsync the desktop dashboard and offline CLI use — no separate reply logic. Tokens used are recorded against your account automatically.
curl -X POST /api/nexusagi/chat -H "X-NexusAgi-Session: <token>" -d '{"message":"hello"}'
→ { reply, success, tokensUsed, usedWeb, learned, sessionTokens, lifetimeTokens }
Marks a reply as right or wrong. Feeds directly into the same experience-reward pipeline every other learning path uses (Reward: 1.0 for positive, 0.0 for negative) — high-reward experiences are preferentially retained, so this is a real signal the AGI acts on, not cosmetic.
curl -X POST /api/nexusagi/feedback -H "X-NexusAgi-Session: <token>" \
-d '{"userMessage":"...","agiReply":"...","rating":"positive","note":null}'
→ { recorded: true }
Usage & status
Your own token usage: current session, lifetime total, a 30-day daily breakdown, and your last 10 sessions.
A running bug-count/summary (errors scanned, fixes applied, self-writes) and an experience-level summary (knowledge node count, basics mastered) — what the dashboard's sidebar shows.