Skip to main content
Figranium exposes a local REST API for task management, execution, and data retrieval. Base URL: http://localhost:11345 (default)
If enabled, authentication must be provided via one of the following methods:
  • Header: x-api-key: your_key or key: your_key
  • Authorization Header: Authorization: Bearer your_key
  • Request Body: {"apiKey": "your_key"} or {"key": "your_key"}

Health

GET /api/health

Returns the server status and storage backend connectivity. Use this endpoint for uptime monitoring, load-balancer health checks, or verifying that Figranium is ready to accept work. Response (healthy):
Response (degraded — database unreachable):
Returns HTTP 200 when healthy and 503 when degraded. This endpoint does not require authentication.

Authentication

If enabled, authentication must be provided via one of the following methods:
  • Header: x-api-key: your_key or key: your_key
  • Authorization Header: Authorization: Bearer your_key
  • Request Body: {"apiKey": "your_key"} or {"key": "your_key"}

Tasks

Lists all saved tasks. Each task includes its full configuration except for the version history, which is fetched separately when you open a task in the editor.Response:
The description field is optional and only present if the task has one.
Returns a lightweight list of all saved tasks with summary metadata (ID, name, description, mode, schedule, variables, createdAt, updatedAt) without version history or full action lists. Useful for lightweight listings and dashboard overviews. Requires API-key authentication.Response:
Updates the updatedAt timestamp of a task to the current time without modifying its configuration.Response:
Creates or updates a task. If a task with the same id already exists, it is overwritten. Include ?version=true in the query string to save a version snapshot before overwriting.Body:
The description field is optional. When set, it appears on the canvas trigger card and in the tasks[] entries returned by GET /api/tasks/list so external tools and AI agents have context about the task without fetching its full definition.
Applies a partial update to an existing task. Only the fields you include in the body are changed. The id and versions fields are ignored if supplied. Figranium takes a version snapshot of the task before applying the update, so you can restore the previous state from the version history.Use this endpoint when you want to change a single attribute (for example, a schedule, a variable, or one action) without re-sending the full task definition.Body: Any subset of the task’s top-level fields.
Response:
Error responses:
Deletes a task by ID. Any in-process schedule registered for the task is also removed, so a scheduled run will not fire after deletion.Response:
Error responses:
Triggers an execution of a specific task.
You don’t need to assemble this URL by hand. The Trigger via API panel in the task editor’s Task Settings API tab shows the complete endpoint URL for your instance (for example, https://your-figranium.example.com/api/tasks/task_1/api) with a POST badge, and its copy button copies the full URL.
Body:
Response: Returns the execution result (JSON).
The request body is optional. If you send the request without a body or without a Content-Type: application/json header, Figranium treats the body as {} and runs the task with its default variables. This lets tools that can’t set request headers (for example, Clay’s HTTP action) trigger a task with a bare POST to the endpoint URL.To pass variables, webhookUrl, statelessExecution, or sessionId, you must send Content-Type: application/json and a JSON body.

Completion webhook

When you include a webhookUrl, Figranium sends a POST request to that URL after the task finishes. The webhook URL is validated against the same SSRF rules as all other outbound requests (see Security). If the URL points to a private network and ALLOW_PRIVATE_NETWORKS is false, the request returns 400 INVALID_WEBHOOK_URL.The callback payload looks like this:
The webhook request times out after 10 seconds. Delivery failures are logged on the server but do not affect the execution result returned to the original caller.
Uses the configured AI provider to generate a CSS selector from a plain-language description and the current page DOM. The endpoint runs the task up to the specified action index to capture the live HTML, then sends it to the AI provider chain (Gemini -> OpenAI -> Claude -> Ollama) and returns the first successful result. Requires authentication.Body:
Response (success):
Error responses:
Ollama requests from this endpoint go through redirect-safe fetching with SSRF validation at every hop. See Ollama URL validation for details.
Uses the configured AI provider to generate a JavaScript extraction script from a plain-language description. The endpoint tries each provider in order (Gemini -> OpenAI -> Claude -> Ollama) and returns the first successful result. Requires authentication.Body:
Response (success):
Error responses:
Ollama requests from this endpoint go through redirect-safe fetching with SSRF validation at every hop. See Ollama URL validation for details.

Executions

Lists execution history.Query Parameters:
  • limit: Number of results (default 50).
  • status: Filter by status code.
Returns a lightweight list of execution records wrapped in an executions array. Useful for dashboards and external integrations that need summary metadata without full logs or result payloads. Requires API-key authentication.Response:
Returns a lightweight list of execution records with summary metadata (ID, task ID, status, timestamps, duration) without full logs or result payloads. Use this for dashboard views and history listings when you don’t need the per-execution detail returned by GET /api/executions/:id. Requires API-key authentication.Response:
Gets detailed logs and result for a specific execution.
Deletes a single execution record by ID.Response:
Deletes all execution records. Use this endpoint to free disk space or reset history after large batch runs.Response:

Data

Lists all captured files (screenshots, recordings).
Deletes a specific capture file.

Settings

AI provider keys

Manage API keys for each AI provider. All providers support multiple keys for automatic failover.
Returns the configured Gemini API keys.
Saves one or more Gemini API keys.Body:
Returns the configured OpenAI API keys.
Saves one or more OpenAI API keys.Body:
Returns the configured Claude (Anthropic) API keys.
Saves one or more Claude API keys.Body:
Returns the configured Ollama instances.
Saves one or more Ollama instance configurations. Each entry is a JSON string containing the base URL and model name.Body:
You can also pass a plain URL string (e.g., "http://localhost:11434"), in which case the default model gemma4:e2b is used.

AI model settings

Returns the currently configured default model for each AI provider. Requires authentication.Response:
Updates the default model for one or more AI providers. Omitted providers keep their current value. Requires authentication.Body:
Response: Returns the full updated model configuration (same shape as the GET response).

Proxies

Lists configured proxies, rotation settings, and the default proxy.Response:
Adds a new proxy.Body:
The server address is validated against the SSRF blocklist. If it points to a private or internal network address, the request returns 400 with INVALID_URL.
Bulk imports proxies. Existing proxies with matching server addresses are updated; new addresses are added.Body:
Each entry supports the same fields as POST /api/settings/proxies. Every entry is validated individually against the SSRF blocklist — if any entry fails, the entire import is rejected.
Updates an existing proxy by ID.Body: Same fields as POST /api/settings/proxies. The server field is required and re-validated against the SSRF blocklist.
Deletes a single proxy by ID.
Deletes multiple proxies by ID.Body:
Updates rotation settings.Body:

Credentials

Lists all saved credentials. Tokens are redacted in the response.Response:
Creates a new output provider credential.Body:
The baseUrl is validated against SSRF rules. If the URL points to a private or internal network address (and ALLOW_PRIVATE_NETWORKS is false), the request returns:
Updates an existing credential. The same URL validation applies when updating the baseUrl.
Deletes a credential by ID.Response:
Lists all Baserow databases accessible by the credential. This proxies the request through Figranium so your Baserow token is never exposed to the browser.Response:
Lists all tables within a specific Baserow database. The databaseId parameter must be a numeric value.Response:
Error responses:These proxy endpoints are used by the task editor’s Output tab to let you browse and select a destination table without leaving Figranium.
Generates or regenerates the system API key. If you include an apiKey field in the request body, that value is saved as the new key (max 512 characters). If omitted, a new key is generated automatically.Body (optional):
Error responses:
Returns the default selector finder preference.Response:
Possible values: "highlight" (standard point-and-click picker) or "ai" (AI Selector Finder).
Sets the default selector finder tool.Body:
Returns the currently persisted UI theme.Response:
Possible values: "dark", "light", "solarized-light", "solarized-dark".If no theme has been saved yet, Figranium falls back to any figranium_theme or theme cookie sent with the request, writes that value to the backend data store, and returns it. When neither the store nor a cookie has a valid value, Figranium returns "dark".Error responses:
Persists the UI theme to the backend data store so it follows the user across browsers and devices on the same instance. The response also sets a figranium_theme cookie (path /, SameSite=Lax, 1-year max-age) for fast initial page loads.Body:
Any value outside "dark", "light", "solarized-light", "solarized-dark" is silently coerced to "dark".Response:
Error responses:

Browser

Programmatic control of the managed headful browser session. Use these endpoints when an external tool or agent needs to open a browser, drive it, and inspect the page without going through the Figranium UI.
Launches a headful browser session, or reattaches to the one already running. Returns a sessionId you can pass to other endpoints and a WebSocket endpoint suitable for connecting a Playwright or Chrome DevTools client.Accepts either a signed-in dashboard session or an API key. Session-authenticated callers (the Figranium UI) can launch the browser without adding a header. External callers such as MCP servers or scripts authenticate with x-api-key, Authorization: Bearer, or an apiKey body field, as described under Authentication.Body:
Response (200):
Automatic headless fallback: if the initial headful launch fails because no display is available, Figranium retries once in headless mode automatically and returns the running session. You only need to pass headless: true explicitly if you want to skip the failed first attempt.Error responses:Example:
Example (explicit headless):

Inspector

Activates the inspect overlay on the active browser session and, given a targetHint, returns up to five candidate elements with CSS selectors, XPath, and a confidence score. Optionally returns a base64-encoded JPEG snapshot of the current viewport with the top match visually outlined.Accepts either a signed-in dashboard session or an API key. This lets the Figranium UI drive the inspector directly while external clients (for example, an MCP server resolving a plain-language target into a selector) authenticate with an API key. See Authentication for accepted formats.Use this endpoint from an external agent or CLI to resolve a plain-language target (for example, "Sign in" or input[name="q"]) into a selector you can feed back into a task action. Match strategy, in order:
  1. Treat targetHint as a CSS selector and run querySelectorAll.
  2. Match common attributes (name, placeholder, aria-label, title, alt, value, data-testid, data-test-id).
  3. Match visible text on button, a, label, span, div, h1h4, li, and p.
If no browser session is running and you supply url, Figranium launches one first.Body:
Response (200):
Error responses:Example:

Headful

Returns the current state of the headful (VNC) browser session. Requires authentication.Response (VNC enabled, session active):
Response (VNC disabled):
Use this endpoint to check if a headful session is running before starting a new one, or to display connection status in a custom integration.
Returns the auto-generated VNC password used by x11vnc for the headful browser session. Requires authentication (session or API key).Response (200):
Error responses:The password is generated on first start and persisted at data/vnc_password.txt. The embedded noVNC viewer fetches it automatically. You only need to call this endpoint when building a custom VNC client — for example, connecting a standalone VNC viewer through an SSH tunnel. See Headful browser — Access control.

Schedules

Lists all tasks with an associated schedule.Response:
Creates or updates a schedule for a task.Body:
For advanced scheduling, use a cron expression:
Response:
Disables the schedule for a task.Response:
Returns the schedule configuration and current status for a specific task, including the computed cron expression, human-readable description, and validation status.Response:
Validates and describes a proposed schedule configuration without saving it to the task. Pass the schedule parameters in the request body.Body:
Response:
Returns runtime status of the scheduler and all active jobs.Response: