Agents over the data

The Investigator: a propose-only agent that assembles the evidence for a hold and streams a draft disposition.

Method	Path	Scope	Summary
POST	/ai/analyst/ask	read	Ask Analyst
POST	/ai/investigator/run	review + read	Run Investigator
GET	/ai/red-team/packs	read	List Red Team Packs
POST	/ai/red-team/packs/{pack_id}/{decision}	read	Decide Red Team Pack
POST	/ai/red-team/run	read	Run Red Team
GET	/ai/runs	read	List Runs
GET	/ai/runs/{run_id}	read	Get Run

Try it

curl -sf -H "Authorization: Bearer $VIGIL_KEY" "$VIGIL_URL/ai/runs?limit=5"

Routes

POST /ai/analyst/ask

Ask Analyst. Scope: read.

Stream a Fleet Analyst answer to one question over the caller's org's gold and silver tables.

Request body:

{
  "question": "string"
}

Field	Type	Required	Notes
question	string	yes

Response 200:

"any"

POST /ai/investigator/run

Run Investigator. Scope: review + read.

Stream an Investigator run for one enforcement action in the caller's org.

Request body:

{
  "action_id": 0
}

Field	Type	Required	Notes
action_id	integer	yes

Response 200:

"any"

GET /ai/red-team/packs

List Red Team Packs. Scope: read.

The org's runtime packs, newest first, each with its steps and the coverage record from the run that produced it.

Parameter	In	Required	Type	Notes
status	query	no	string | null
limit	query	no	integer

Response 200:

[
  {
    "id": 0,
    "name": "string",
    "origin": "string",
    "status": "string",
    "steps": [
      {}
    ],
    "coverage": {},
    "created_at": "string"
  }
]

POST /ai/red-team/packs/{pack_id}/{decision}

Decide Red Team Pack. Scope: read.

Accept or reject a proposed pack. Sets the status and nothing else; the frozen packs in api/scenarios.py change only by a commit.

Parameter	In	Required	Type	Notes
pack_id	path	yes	integer
decision	path	yes	string

Response 200:

{
  "id": 0,
  "name": "string",
  "origin": "string",
  "status": "string",
  "steps": [
    {}
  ],
  "coverage": {},
  "created_at": "string"
}

POST /ai/red-team/run

Run Red Team. Scope: read.

Stream a Red Team run: three new packs at the weakest detector, run against the sandbox agent, saved as proposed.

Response 200:

"any"

GET /ai/runs

List Runs. Scope: read.

Parameter	In	Required	Type	Notes
limit	query	no	integer

Response 200:

[
  {
    "id": 0,
    "agent": "string",
    "input": {},
    "status": "string",
    "tokens_in": 0,
    "tokens_out": 0,
    "cost_usd": 0,
    "output_text": "string | null",
    "started_at": "string",
    "finished_at": "string | null",
    "proposals": [
      {
        "id": 0,
        "run_id": 0,
        "action_id": 0,
        "kind": "string",
        "body": {},
        "status": "string",
        "created_at": "string"
      }
    ]
  }
]

GET /ai/runs/{run_id}

Get Run. Scope: read.

Parameter	In	Required	Type	Notes
run_id	path	yes	integer

Response 200:

{
  "id": 0,
  "agent": "string",
  "input": {},
  "status": "string",
  "tokens_in": 0,
  "tokens_out": 0,
  "cost_usd": 0,
  "output_text": "string | null",
  "started_at": "string",
  "finished_at": "string | null",
  "proposals": [
    {
      "id": 0,
      "run_id": 0,
      "action_id": 0,
      "kind": "string",
      "body": {},
      "status": "string",
      "created_at": "string"
    }
  ]
}

Generated from openapi.json (VIGIL 0.2.0). Scopes follow the router dependencies in VIGIL_SPEC.md section 4.2.