Gateway endpoints reference
Every HTTP endpoint the desktop gateway exposes, grouped by operation family.
The desktop gateway binds to 127.0.0.1:19432 (or the first fallback in 19433–19435). All /api/gateway/* routes require auth.
Metadata
| Route | Methods | Notes |
|---|---|---|
/health | GET | Unauthenticated liveness and capability probe. |
/api/gateway/repos | GET, POST, DELETE, PATCH | Managed repositories. |
/api/gateway/settings/binary-paths | GET, PATCH | Override claude/codex/python3/git paths. |
/api/gateway/mcp-auth | GET | MCP auth metadata parity route. |
Git
| Route | Methods |
|---|---|
/api/gateway/git | POST (status/branch/commit/push/pull/branch-diff/sync-status dispatch) |
/api/gateway/git/branches | GET |
/api/gateway/git/diff | POST |
/api/gateway/git/worktree | POST, DELETE |
/api/gateway/git/branch-worktree | GET |
/api/gateway/git/repo-path | GET |
/api/gateway/git/pr | POST |
Retired: local-gh PR data and identity routes
These answered from a local gh invocation and are retired. Desktop GitHub data
now comes from the cloud projection or server-backed GitHub APIs, so the routes
stay registered and, once a request passes the gateway's auth, onboarding and
approval gates, respond HTTP 410 with
{ "error": "github_data_route_retired" }. Those gates run first and can answer
before the route does — a request made before onboarding completes gets 403, not
410.
410 rather than an unregistered path so a version-skewed client can tell a
deliberately removed endpoint from one that is merely unimplemented: this gateway
answers 501 operation not implemented for an unrecognized /api/gateway/*
path, which means "may arrive later".
| Route | Methods |
|---|---|
/api/gateway/git/pr/list | GET |
/api/gateway/git/pr/comments | GET |
/api/gateway/git/pr/reviews | GET |
/api/gateway/git/pr/reply | POST |
/api/gateway/git/pr/files | GET |
/api/gateway/git/pr/file-diff | GET |
/api/gateway/git/pr/head-sha | GET |
/api/gateway/git/pr/inline-comment | POST |
/api/gateway/git/user | GET |
Filesystem
| Route | Methods |
|---|---|
/api/gateway/directories | GET |
/api/gateway/files/search | GET |
Operation IDs
The supported operation IDs drive approval policy and telemetry tagging:
git_action, git_pr, git_branch_worktree,
repos_config, filesystem, binary_paths_settingsRequired headers for authenticated calls
X-Desktop-Gateway-Token(internal cloud executor) orX-Desktop-Session-Token+Origin(browser)Content-Type: application/json(where a body is sent)
See Desktop gateway for the full auth model.