REST API

Everything the Boot app does, your own tools can do too. The API acts as one account — yours — with the permissions you grant the key, and applies the same plan limits as the app.

Quick start

1. Create a key. In Boot, go to Account → API Keys and create one. The raw key is shown once; it starts with boot_.

2. Call something.

terminal

curl -s https://boot.techdyn.co.uk/api/agent/me \
  -H "Authorization: Bearer boot_YOUR_KEY"

3. Read the state before you change it. Boot is a state machine, not a CRUD store — see BOS state machine below.

Prefer an agent? If you are wiring up ChatGPT, Claude, Cursor or Codex, use the MCP server instead. It exposes the same abilities as tools, with the argument schemas and guidance already written for a model.

Authentication

Send the key on every request, either way:

Authorization: Bearer boot_YOUR_KEY
X-API-Key: boot_YOUR_KEY

Keys can be given an expiry and revoked at any time from the same screen. A revoked, expired or unknown key all answer 401 identically — the API never confirms whether a credential once existed.

Scopes

Scope	Grants
`read`	Read your projects, tasks, blocks, forecast and history
`write`	Create, change and delete projects, tasks, milestones and tags
`bos`	Drive your day: start and end focus blocks, run timers, shut down and reboot the BOS
`admin`	Reserved. Grants no endpoint today.

Conventions

Request and response bodies are JSON. Send Content-Type: application/json on writes.
PATCH changes only the fields you supply; anything omitted keeps its current value.
DELETE is permanent, and cascades where the resource owns others — deleting a project deletes its tasks.
Ids are integers scoped to your account. Asking for one that is not yours answers exactly as if it did not exist.
Batch endpoints cap at 8 items per call (20 for projects), so one request cannot become unbounded work.

Errors

Status	Meaning
`400`	The request was malformed, or the arguments were rejected.
`401`	No key, or the key is not usable.
`403`	A plan limit, or a capability the plan does not include. Retrying will not help.
`404`	Nothing with that id belongs to you.
`409`	Refused by the state machine — the command is not legal from the current state.
`429`	Rate limited. Wait for `Retry-After`.

The BOS state machine

Boot models a day as a machine with states S0 Offline, S1 Activation, S2 Execution, S3 Maintenance, S4 Shutdown and Sx Degraded. Commands that are not legal from the current state are refused, not queued.

Authority runs Kernel > NSIL > execution state > RAB > SRW > your request. While NSIL is armed the API declines new execution planning — that is the rule working, not a fault.

Always call GET /api/agent/bos/state first: it reports the current state and exactly which commands are available from it.

Endpoints

Base URL https://boot.techdyn.co.uk. This table is generated from the router, so it lists what is actually mounted right now.

Account 3

Who the credential belongs to, and what the plan allows.

GET	`/api/agent/api-keys`
GET	`/api/agent/me`
GET	`/api/agent/stats`

Projects 11

The top of the hierarchy. Everything else hangs off a project.

GET	`/api/agent/projects`
POST	`/api/agent/projects`
POST	`/api/agent/projects/batch`
DELETE	`/api/agent/projects/{id}`
PATCH	`/api/agent/projects/{id}`
GET	`/api/agent/projects/{id}/dependencies`
POST	`/api/agent/projects/{id}/dependencies`
GET	`/api/agent/projects/{id}/milestones`
POST	`/api/agent/projects/{id}/milestones`
POST	`/api/agent/projects/{id}/milestones/batch`
POST	`/api/agent/projects/{id}/milestones/sequential`

Milestones 8

Phases within a project.

DELETE	`/api/agent/milestones/{id}`
GET	`/api/agent/milestones/{id}`
PATCH	`/api/agent/milestones/{id}`
GET	`/api/agent/milestones/{id}/deliverables`
POST	`/api/agent/milestones/{id}/deliverables`
POST	`/api/agent/milestones/{id}/deliverables/batch`
GET	`/api/agent/milestones/{id}/dependencies`
POST	`/api/agent/milestones/{id}/dependencies`

Deliverables 4

Concrete outputs within a milestone.

DELETE	`/api/agent/deliverables/{id}`
PATCH	`/api/agent/deliverables/{id}`
GET	`/api/agent/deliverables/{id}/dependencies`
POST	`/api/agent/deliverables/{id}/dependencies`

Tasks 9

The unit of work. Attach to a project, milestone or deliverable.

GET	`/api/agent/tasks`
POST	`/api/agent/tasks`
POST	`/api/agent/tasks/batch`
POST	`/api/agent/tasks/reorder`
DELETE	`/api/agent/tasks/{id}`
PATCH	`/api/agent/tasks/{id}`
POST	`/api/agent/tasks/{id}/dependency`
GET	`/api/agent/tasks/{id}/tags`
POST	`/api/agent/tasks/{id}/tags`

Tags 4

Free-form labels applied to tasks.

GET	`/api/agent/tags`
POST	`/api/agent/tags`
DELETE	`/api/agent/tags/{id}`
PATCH	`/api/agent/tags/{id}`

BOS state machine 6

Day state and transitions. Read the state before you try to change it.

POST	`/api/agent/bos/command`
POST	`/api/agent/bos/reboot`
GET	`/api/agent/bos/state`
POST	`/api/agent/energy`
GET	`/api/agent/resume`
POST	`/api/agent/shutdown`

Focus blocks 5

90-minute blocks and the plan attached to each.

GET	`/api/agent/blocks`
POST	`/api/agent/blocks/start`
POST	`/api/agent/blocks/{id}/complete`
GET	`/api/agent/blocks/{id}/plan`
POST	`/api/agent/blocks/{id}/switch-urge`

Timers 5

The countdown behind a block, drivable on its own.

GET	`/api/agent/timer`
POST	`/api/agent/timer/pause`
POST	`/api/agent/timer/resume`
POST	`/api/agent/timer/start`
POST	`/api/agent/timer/stop`

Forecast and bias 5

Ranked candidate tasks, and the transient bias that bends the ranking.

GET	`/api/agent/forecast`
POST	`/api/agent/forecast/reroll`
DELETE	`/api/agent/score-bias`
GET	`/api/agent/score-bias`
POST	`/api/agent/score-bias`

NSIL and SRW 7

The shutdown lock and the reflection window. Both refuse more than they permit.

POST	`/api/agent/nsil/arm`
POST	`/api/agent/nsil/breach`
POST	`/api/agent/nsil/run`
GET	`/api/agent/nsil/status`
POST	`/api/agent/srw/arm`
POST	`/api/agent/srw/close`
GET	`/api/agent/srw/status`

Journal, events, history 4

What was written, what happened, and what the past days looked like.

GET	`/api/agent/events`
GET	`/api/agent/history`
GET	`/api/agent/journal`
POST	`/api/agent/journal`

Agent memories 5

Durable context, scored and recalled against the current day.

GET	`/api/agent/memories`
POST	`/api/agent/memories`
GET	`/api/agent/memories/recall`
DELETE	`/api/agent/memories/{id}`
PATCH	`/api/agent/memories/{id}`

Rate limits

Limits apply per credential. A 429 carries Retry-After in seconds. The MCP endpoint publishes its remaining allowance on every response — see the MCP limits.