Authentication
Use the bearer token from your CitadelGate session. Admin and Owner accounts must have completed MFA. Provider staff working in a client workspace use the client-scoped session token.
AI investigations
Start an investigation
POST /api/ai/investigations
{ "prompt": "Accounts can't print since this morning", "ticketId": "<optional ticket id>", "deviceId": "<optional device id>" }Roles: Technician, Admin, Owner. Prompt length 1 to 4,000 characters. Returns 202 Accepted with the investigation. If ticketId is set and deviceId isn't, the ticket's device is used. At most 5 investigations can be queued or running per client at a time (429 beyond that).
Get an investigation
GET /api/ai/investigations/{id}Fields include status (Queued, Running, Completed, Unavailable, Failed), report (Markdown), proposedActions, toolCalls, model, token counts and timestamps.
List investigations
GET /api/ai/investigations?ticketId={optional}The 50 most recent for the client, newest first.
Script library
| Call | Purpose | Roles |
|---|---|---|
POST /api/scripts | Create a draft script (fields: name, language, content, platform, riskLevel, aiDescription, parameters, category, tags) | Technician, Admin, Owner |
PUT /api/scripts/{id} | Edit; resets approval to Draft | Technician, Admin, Owner |
POST /api/script-library/{id}/submit-for-review | Submit a draft for review | Technician, Admin, Owner |
POST /api/script-library/{id}/approve | Approve, with optional {"notes": "...", "riskLevel": "Low"}; records the content fingerprint | Admin, Owner (not the author) |
POST /api/script-library/{id}/reject | Reject with notes | Admin, Owner |
GET /api/script-library/pending-reviews | Scripts waiting for review | Signed-in staff |
GET /api/script-library | Search and filter the library | Signed-in staff |
Errors
400 invalid input · 401 not signed in · 403 role or MFA requirement not met · 404 not found in your organisation · 429 too many requests.