Skip to main content
Besides the FastMCP HTTP interface that AI agents speak, toorow serves a REST API. It is what the admin console itself calls, so anything the console can do is reachable from a script.
The server mounts 547 routes. This page documents the families you reach first, with their real paths and methods — it is not a listing of all of them. The router is the reference that cannot fall behind, and every path named here is checked against it by a conformance test.

​
1. Authentication

Every request authenticates according to TOOROW_AUTH_MODE:
  • oauth (production) — a Bearer JWT: Authorization: Bearer <token>.
  • static (QA / dev) — the shared secret: Authorization: Bearer <TOOROW_STATIC_TOKEN>.
Reads are scoped by project_id and the scope is enforced server-side. An unscoped call fails; it does not fall back to a default.

​
2. Datastreams and reports — /api/flows

Implemented in server/core/flows_api.py. A flow is a datastream or a report definition; kind distinguishes them.
Lists the datastreams and report definitions of a project.
Returns one definition.
Validates, then creates or updates. The answer is {"kind", "id", "changed", "flow", "diff"} — diff says what actually moved, so a no-op update is visible as one. Refusals are explicit: 400 on the body or the scope, 404 when the scope does not resolve, 409 on a name conflict, 422 on validation.
Checks a definition and writes nothing.

​
3. Business context — /api/context-events

Implemented in server/core/context_events_api.py. A context event is what happened in the business on a date — a migration, a price change, an outage.
Lists events over a window. Add include_retired=true to also see withdrawn ones.
metric is optional on purpose: an outage or a holiday concerns every metric, and an event with no metric stays admissible under every claim. Naming one narrows where the event is ever offered.
Corrects an event. The previous wording is kept: who changed it, when, and which fields are appended as a revision.
The correction history of one event.
Withdraws an event. This is an audited transition, and it is not undone.

​
4. Data quality — under the project

Implemented in server/core/controls_quality_api.py. Quality is governed per project, so its addresses sit under the project rather than at the root.
/api/dq/* is not served. /api/dq/status, /api/dq/alerts and /api/dq/monitors/runs were documented on this page and never existed; /api/dq/summary, /api/dq/evaluate and /api/dq/issues/{id}/acknowledge exist as route objects but the composed router does not mount them: story 49.4 unmounted the three, and server/core/dq_api.py now only supplies the server-side helper fetch_dq_report_data. Measured 2026-09-06: the router mounts 547 addresses, none of them under /api/dq.
To read quality findings, an agent calls get_data_quality_report over MCP — see Data Quality for what each of the ten monitors watches.

​
5. Organizations and access — /api/organizations

​
Next Steps & Cross-References

FastMCP Agent Tools

The MCP surface an AI agent speaks, and the three profiles that gate it.

Data Quality

What each of the ten monitors watches, and what its findings mean.

Agent Context

How context events are offered to an agent, and why never as causes.

Self-Hosting Guide

Environment variables, including TOOROW_AUTH_MODE.