http://localhost:11345 (default)
- Header:
x-api-key: your_keyorkey: your_key - Authorization Header:
Authorization: Bearer your_key - Request Body:
{"apiKey": "your_key"}or{"key": "your_key"}
Health
GET /api/health
Returns the server status and storage backend connectivity. Use this endpoint for uptime monitoring, load-balancer health checks, or verifying that Figranium is ready to accept work.
Response (healthy):
200 when healthy and 503 when degraded. This endpoint does not require authentication.
Authentication
If enabled, authentication must be provided via one of the following methods:- Header:
x-api-key: your_keyorkey: your_key - Authorization Header:
Authorization: Bearer your_key - Request Body:
{"apiKey": "your_key"}or{"key": "your_key"}
Tasks
GET /api/tasks
GET /api/tasks
description field is optional and only present if the task has one.GET /api/tasks/list
GET /api/tasks/list
POST /api/tasks/:id/touch
POST /api/tasks/:id/touch
updatedAt timestamp of a task to the current time without modifying its configuration.Response:POST /api/tasks
POST /api/tasks
id already exists, it is overwritten. Include ?version=true in the query string to save a version snapshot before overwriting.Body:description field is optional. When set, it appears on the canvas trigger card and in the tasks[] entries returned by GET /api/tasks/list so external tools and AI agents have context about the task without fetching its full definition.PATCH /api/tasks/:id
PATCH /api/tasks/:id
id and versions fields are ignored if supplied. Figranium takes a version snapshot of the task before applying the update, so you can restore the previous state from the version history.Use this endpoint when you want to change a single attribute (for example, a schedule, a variable, or one action) without re-sending the full task definition.Body: Any subset of the task’s top-level fields.DELETE /api/tasks/:id
DELETE /api/tasks/:id
POST /api/tasks/:id/api
POST /api/tasks/:id/api
Content-Type: application/json header, Figranium treats the body as {} and runs the task with its default variables. This lets tools that can’t set request headers (for example, Clay’s HTTP action) trigger a task with a bare POST to the endpoint URL.To pass variables, webhookUrl, statelessExecution, or sessionId, you must send Content-Type: application/json and a JSON body.Completion webhook
When you include awebhookUrl, Figranium sends a POST request to that URL after the task finishes. The webhook URL is validated against the same SSRF rules as all other outbound requests (see Security). If the URL points to a private network and ALLOW_PRIVATE_NETWORKS is false, the request returns 400 INVALID_WEBHOOK_URL.The callback payload looks like this:POST /api/tasks/generate-selector
POST /api/tasks/generate-selector
POST /api/tasks/generate-script
POST /api/tasks/generate-script
Executions
GET /api/executions
GET /api/executions
limit: Number of results (default 50).status: Filter by status code.
GET /api/executions/list
GET /api/executions/list
executions array. Useful for dashboards and external integrations that need summary metadata without full logs or result payloads. Requires API-key authentication.Response:GET /api/executions/list
GET /api/executions/list
GET /api/executions/:id. Requires API-key authentication.Response:GET /api/executions/:id
GET /api/executions/:id
DELETE /api/executions/:id
DELETE /api/executions/:id
POST /api/executions/clear
POST /api/executions/clear
Data
GET /api/data/captures
GET /api/data/captures
DELETE /api/data/captures/:name
DELETE /api/data/captures/:name
Settings
AI provider keys
Manage API keys for each AI provider. All providers support multiple keys for automatic failover.GET /api/settings/gemini-api-key
GET /api/settings/gemini-api-key
POST /api/settings/gemini-api-key
POST /api/settings/gemini-api-key
GET /api/settings/openai-api-key
GET /api/settings/openai-api-key
POST /api/settings/openai-api-key
POST /api/settings/openai-api-key
GET /api/settings/claude-api-key
GET /api/settings/claude-api-key
POST /api/settings/claude-api-key
POST /api/settings/claude-api-key
GET /api/settings/ollama-api-key
GET /api/settings/ollama-api-key
POST /api/settings/ollama-api-key
POST /api/settings/ollama-api-key
"http://localhost:11434"), in which case the default model gemma4:e2b is used.AI model settings
GET /api/settings/ai-models
GET /api/settings/ai-models
POST /api/settings/ai-models
POST /api/settings/ai-models
GET response).Proxies
GET /api/settings/proxies
GET /api/settings/proxies
POST /api/settings/proxies
POST /api/settings/proxies
400 with INVALID_URL.POST /api/settings/proxies/import
POST /api/settings/proxies/import
POST /api/settings/proxies. Every entry is validated individually against the SSRF blocklist — if any entry fails, the entire import is rejected.PUT /api/settings/proxies/:id
PUT /api/settings/proxies/:id
POST /api/settings/proxies. The server field is required and re-validated against the SSRF blocklist.DELETE /api/settings/proxies/:id
DELETE /api/settings/proxies/:id
DELETE /api/settings/proxies
DELETE /api/settings/proxies
POST /api/settings/proxies/rotation
POST /api/settings/proxies/rotation
Credentials
GET /api/credentials
GET /api/credentials
POST /api/credentials
POST /api/credentials
baseUrl is validated against SSRF rules. If the URL points to a private or internal network address (and ALLOW_PRIVATE_NETWORKS is false), the request returns:PUT /api/credentials/:id
PUT /api/credentials/:id
baseUrl.DELETE /api/credentials/:id
DELETE /api/credentials/:id
GET /api/credentials/:id/proxy/baserow/databases
GET /api/credentials/:id/proxy/baserow/databases
GET /api/credentials/:id/proxy/baserow/databases/:databaseId/tables
GET /api/credentials/:id/proxy/baserow/databases/:databaseId/tables
databaseId parameter must be a numeric value.Response:POST /api/settings/api-key
POST /api/settings/api-key
apiKey field in the request body, that value is saved as the new key (max 512 characters). If omitted, a new key is generated automatically.Body (optional):GET /api/settings/selector-finder
GET /api/settings/selector-finder
"highlight" (standard point-and-click picker) or "ai" (AI Selector Finder).POST /api/settings/selector-finder
POST /api/settings/selector-finder
GET /api/settings/theme
GET /api/settings/theme
"dark", "light", "solarized-light", "solarized-dark".If no theme has been saved yet, Figranium falls back to any figranium_theme or theme cookie sent with the request, writes that value to the backend data store, and returns it. When neither the store nor a cookie has a valid value, Figranium returns "dark".Error responses:POST /api/settings/theme
POST /api/settings/theme
figranium_theme cookie (path /, SameSite=Lax, 1-year max-age) for fast initial page loads.Body:"dark", "light", "solarized-light", "solarized-dark" is silently coerced to "dark".Response:Browser
Programmatic control of the managed headful browser session. Use these endpoints when an external tool or agent needs to open a browser, drive it, and inspect the page without going through the Figranium UI.POST /api/browser/open
POST /api/browser/open
sessionId you can pass to other endpoints and a WebSocket endpoint suitable for connecting a Playwright or Chrome DevTools client.Accepts either a signed-in dashboard session or an API key. Session-authenticated callers (the Figranium UI) can launch the browser without adding a header. External callers such as MCP servers or scripts authenticate with x-api-key, Authorization: Bearer, or an apiKey body field, as described under Authentication.Body:200):headless: true explicitly if you want to skip the failed first attempt.Error responses:Inspector
POST /api/inspector/highlight
POST /api/inspector/highlight
targetHint, returns up to five candidate elements with CSS selectors, XPath, and a confidence score. Optionally returns a base64-encoded JPEG snapshot of the current viewport with the top match visually outlined.Accepts either a signed-in dashboard session or an API key. This lets the Figranium UI drive the inspector directly while external clients (for example, an MCP server resolving a plain-language target into a selector) authenticate with an API key. See Authentication for accepted formats.Use this endpoint from an external agent or CLI to resolve a plain-language target (for example, "Sign in" or input[name="q"]) into a selector you can feed back into a task action. Match strategy, in order:- Treat
targetHintas a CSS selector and runquerySelectorAll. - Match common attributes (
name,placeholder,aria-label,title,alt,value,data-testid,data-test-id). - Match visible text on
button,a,label,span,div,h1–h4,li, andp.
url, Figranium launches one first.Body:200):Headful
GET /api/headful/status
GET /api/headful/status
GET /api/headful/vnc-password
GET /api/headful/vnc-password
x11vnc for the headful browser session. Requires authentication (session or API key).Response (200):data/vnc_password.txt. The embedded noVNC viewer fetches it automatically. You only need to call this endpoint when building a custom VNC client — for example, connecting a standalone VNC viewer through an SSH tunnel. See Headful browser — Access control.Schedules
GET /api/schedules
GET /api/schedules
POST /api/schedules/:taskId
POST /api/schedules/:taskId
DELETE /api/schedules/:taskId
DELETE /api/schedules/:taskId
GET /api/schedules/:taskId/status
GET /api/schedules/:taskId/status
POST /api/schedules/:taskId/describe
POST /api/schedules/:taskId/describe
GET /api/schedules/status/all
GET /api/schedules/status/all