{
  "components": {
    "schemas": {
      "CommandStatusUpdate": {
        "additionalProperties": false,
        "properties": {
          "claim_token": {
            "type": "string",
            "writeOnly": true
          },
          "result_message": {
            "maxLength": 4000,
            "type": "string"
          },
          "status": {
            "enum": [
              "running",
              "completed",
              "stopped",
              "rejected",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "status",
          "claim_token"
        ],
        "type": "object"
      },
      "DesktopFrameUpload": {
        "additionalProperties": false,
        "properties": {
          "captured_at_utc": {
            "format": "date-time",
            "type": "string"
          },
          "content_type": {
            "enum": [
              "image/jpeg",
              "image/png",
              "image/webp"
            ],
            "type": "string"
          },
          "image_base64": {
            "contentEncoding": "base64",
            "maxLength": 5592408,
            "type": "string",
            "writeOnly": true
          },
          "pixel_height": {
            "maximum": 8192,
            "minimum": 1,
            "type": "integer"
          },
          "pixel_width": {
            "maximum": 8192,
            "minimum": 1,
            "type": "integer"
          },
          "sha256": {
            "pattern": "^[a-f0-9]{64}$",
            "type": "string"
          }
        },
        "required": [
          "content_type",
          "image_base64",
          "pixel_width",
          "pixel_height",
          "captured_at_utc",
          "sha256"
        ],
        "type": "object"
      },
      "DeviceCheckIn": {
        "additionalProperties": false,
        "properties": {
          "app_version": {
            "maxLength": 128,
            "type": "string"
          },
          "capabilities": {
            "items": {
              "maxLength": 80,
              "type": "string"
            },
            "maxItems": 64,
            "type": "array"
          },
          "extension_enabled": {
            "type": "boolean"
          }
        },
        "required": [
          "extension_enabled",
          "app_version"
        ],
        "type": "object"
      },
      "RegisterDeviceRequest": {
        "additionalProperties": false,
        "properties": {
          "app_instance_label": {
            "maxLength": 160,
            "type": "string"
          },
          "app_version": {
            "maxLength": 128,
            "type": "string"
          },
          "capabilities": {
            "items": {
              "maxLength": 80,
              "type": "string"
            },
            "maxItems": 64,
            "type": "array"
          },
          "device_label": {
            "maxLength": 160,
            "minLength": 1,
            "type": "string"
          },
          "installation_id": {
            "maxLength": 160,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "installation_id",
          "device_label",
          "app_version"
        ],
        "type": "object"
      }
    },
    "securitySchemes": {
      "AccountSession": {
        "description": "Account bearer or remote_account_session HttpOnly cookie.",
        "scheme": "bearer",
        "type": "http"
      },
      "AccountSessionCookie": {
        "description": "HttpOnly website account session cookie required by device-code approval.",
        "in": "cookie",
        "name": "remote_account_session",
        "type": "apiKey"
      },
      "DeviceAccessToken": {
        "description": "Short-lived single-use token from device authorization.",
        "scheme": "bearer",
        "type": "http"
      },
      "DeviceBearer": {
        "description": "Durable rotatable and revocable Connect installation credential.",
        "scheme": "bearer",
        "type": "http"
      }
    }
  },
  "info": {
    "description": "Persistent unattended remote control for account-paired LocalEndpoint Connect computers. Intentional extension enablement is the setup authorization event; no target-side per-prompt approval is required. RemoteEndpoints carries private pictures, prompts, work leases, state, results, stop, pause, rotation, and revoke signals. LocalEndpoint Connect AI performs and validates Windows execution. The reviewed Connect source implements the persistent client integration, but current public-download compatibility and an installed production round trip are not claimed.",
    "title": "RemoteEndpoints.com",
    "version": "2.1.0",
    "x-documentation-ownership": {
      "canonical_human_explanation_url": "https://remoteendpoints.com/documentation-ownership",
      "certification_claimed": false,
      "desktop_authority_required": true,
      "documentation_classification": "first-party technical reference",
      "documentation_owner": "RemoteEndpoints product owner",
      "documentation_ownership_url": "https://remoteendpoints.com/documentation-ownership",
      "external_validation_claimed": false,
      "first_party_documentation": true,
      "independent_third_party_documentation": false,
      "last_reviewed_utc": "2026-07-18T10:50:26Z",
      "local_approval_required": false,
      "private_data_allowed": false,
      "public_indexing_allowed": false,
      "related_first_party_domains": [
        "localendpoint.com",
        "localendpoints.com",
        "remoteendpoints.com",
        "mobileendpoints.com",
        "endpointserver.com",
        "networkendpoints.com",
        "intelligenceendpoint.com",
        "intelligenceendpoints.com",
        "agenticendpoints.com"
      ],
      "runtime_authority": false,
      "security_audit_claimed": false,
      "setup_authorization_required": true,
      "trust_boundary_statement": "RemoteEndpoints authenticates the remote operator and carries prompts, control messages, private desktop pictures, and status. The enabled RemoteEndpoints extension lets LocalEndpoint Connect AI perform the work on the target computer; the website itself does not invoke Windows APIs. Installing and enabling the RemoteEndpoints extension is the intentional authorization for unattended remote control. A person is not expected to be at the target computer to approve each prompt. The browser never scans localhost or opens an inbound tunnel; the enabled extension and authenticated Connect session are the remote-control path.",
      "unattended_remote_control": true
    }
  },
  "openapi": "3.1.0",
  "paths": {
    "/api/account/device-authorizations": {
      "post": {
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "client_name": {
                    "maxLength": 160,
                    "minLength": 1,
                    "type": "string"
                  }
                },
                "type": "object"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "description": "Device and user codes created"
          },
          "400": {
            "description": "Malformed, oversized, mistyped, duplicated, or unexpected JSON input"
          },
          "415": {
            "description": "Content type is not application/json"
          },
          "429": {
            "description": "Source start throttle",
            "headers": {
              "Retry-After": {
                "schema": {
                  "minimum": 1,
                  "type": "integer"
                }
              }
            }
          },
          "503": {
            "description": "Shared account storage unavailable"
          }
        },
        "summary": "Start short-lived website device authorization",
        "tags": [
          "Pairing"
        ]
      }
    },
    "/api/account/device-authorizations/approve": {
      "post": {
        "description": "Requires the HttpOnly remote_account_session cookie. Account session values in JSON or Authorization are not accepted by this route.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "user_code": {
                    "maxLength": 32,
                    "minLength": 1,
                    "type": "string"
                  }
                },
                "required": [
                  "user_code"
                ],
                "type": "object"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "Device authorization approved"
          },
          "400": {
            "description": "Malformed, oversized, mistyped, duplicated, or unexpected JSON input"
          },
          "401": {
            "description": "Valid account session cookie missing"
          },
          "403": {
            "description": "Device authorization code invalid or expired"
          },
          "415": {
            "description": "Content type is not application/json"
          },
          "503": {
            "description": "Shared account storage unavailable"
          }
        },
        "security": [
          {
            "AccountSessionCookie": []
          }
        ],
        "summary": "Confirm a device code from the authenticated account",
        "tags": [
          "Pairing"
        ]
      }
    },
    "/api/account/device-authorizations/token": {
      "post": {
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "device_code": {
                    "maxLength": 512,
                    "minLength": 1,
                    "type": "string",
                    "writeOnly": true
                  }
                },
                "required": [
                  "device_code"
                ],
                "type": "object"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "Pending, approved with access token, or already issued"
          },
          "400": {
            "description": "Malformed input or invalid/expired device code"
          },
          "415": {
            "description": "Content type is not application/json"
          },
          "503": {
            "description": "Shared account storage unavailable"
          }
        },
        "summary": "Poll once for a short-lived device access token",
        "tags": [
          "Pairing"
        ]
      }
    },
    "/api/account/infrastructure": {
      "get": {
        "responses": {
          "200": {
            "description": "Display-safe readiness booleans and no credentials"
          }
        },
        "security": [],
        "summary": "Read boolean-only account and persistent-control readiness",
        "tags": [
          "Service"
        ]
      }
    },
    "/api/account/login": {
      "post": {
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "email": {
                    "format": "email",
                    "maxLength": 254,
                    "type": "string"
                  },
                  "password": {
                    "format": "password",
                    "maxLength": 1024,
                    "type": "string"
                  }
                },
                "required": [
                  "email",
                  "password"
                ],
                "type": "object"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "description": "Authenticated"
          },
          "400": {
            "description": "Invalid account input"
          },
          "403": {
            "description": "Invalid credentials"
          },
          "415": {
            "description": "Content type is not application/json"
          },
          "429": {
            "description": "Generic account/source sign-in throttle",
            "headers": {
              "Retry-After": {
                "schema": {
                  "minimum": 1,
                  "type": "integer"
                }
              }
            }
          },
          "500": {
            "description": "Generic internal account-service failure"
          },
          "503": {
            "description": "Shared account storage unavailable"
          }
        },
        "summary": "Create a shared account session",
        "tags": [
          "Account"
        ]
      }
    },
    "/api/account/register": {
      "post": {
        "description": "Syntactically valid requests return one generic response without account state, identifiers, delivery detail, or verification bearer values.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "email": {
                    "format": "email",
                    "maxLength": 254,
                    "type": "string"
                  },
                  "next": {
                    "description": "Optional allowlisted same-origin account destination.",
                    "maxLength": 2048,
                    "type": "string"
                  }
                },
                "required": [
                  "email"
                ],
                "type": "object"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "description": "Generic request accepted; an eligible verification message may be sent"
          },
          "400": {
            "description": "Invalid account input"
          },
          "415": {
            "description": "Content type is not application/json"
          },
          "500": {
            "description": "Generic internal account-service failure"
          },
          "503": {
            "description": "Shared account storage or verification email unavailable"
          }
        },
        "summary": "Accept a generic account registration or verification reissue request",
        "tags": [
          "Account"
        ]
      }
    },
    "/api/account/session": {
      "get": {
        "responses": {
          "200": {
            "description": "Current display-safe account session"
          },
          "401": {
            "description": "Authenticated account session missing or expired"
          },
          "503": {
            "description": "Shared account storage unavailable"
          }
        },
        "security": [
          {
            "AccountSession": []
          }
        ],
        "summary": "Read the current authenticated account session",
        "tags": [
          "Account"
        ]
      }
    },
    "/api/health": {
      "get": {
        "responses": {
          "200": {
            "description": "Display-safe service health without private infrastructure detail"
          }
        },
        "security": [],
        "summary": "Read minimal anonymous service health",
        "tags": [
          "Service"
        ]
      }
    },
    "/api/operator/devices": {
      "get": {
        "responses": {
          "200": {
            "description": "Token-free device records"
          }
        },
        "security": [
          {
            "AccountSession": []
          }
        ],
        "summary": "List account-owned paired computers",
        "tags": [
          "Operator"
        ]
      }
    },
    "/api/operator/devices/{device_id}": {
      "get": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Device, commands, latest picture metadata, and server-authored activity"
          }
        },
        "security": [
          {
            "AccountSession": []
          }
        ],
        "summary": "Read one private computer workspace snapshot",
        "tags": [
          "Operator"
        ]
      }
    },
    "/api/operator/devices/{device_id}/commands": {
      "post": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "A retry with the same key and prompt returns the original command; binding the key to different text is rejected.",
            "in": "header",
            "name": "Idempotency-Key",
            "required": false,
            "schema": {
              "maxLength": 200,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "properties": {
                  "idempotency_key": {
                    "maxLength": 200,
                    "type": "string"
                  },
                  "prompt": {
                    "maxLength": 4096,
                    "minLength": 1,
                    "type": "string"
                  }
                },
                "required": [
                  "prompt"
                ],
                "type": "object"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "description": "Prompt queued"
          },
          "403": {
            "description": "An authority gate is paused or revoked"
          }
        },
        "security": [
          {
            "AccountSession": []
          }
        ],
        "summary": "Queue a private prompt for Connect AI",
        "tags": [
          "Operator"
        ]
      }
    },
    "/api/operator/devices/{device_id}/commands/{command_id}/stop": {
      "post": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "command_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "description": "Stop applied or signaled"
          }
        },
        "security": [
          {
            "AccountSession": []
          }
        ],
        "summary": "Stop queued work or signal a running Connect worker",
        "tags": [
          "Operator"
        ]
      }
    },
    "/api/operator/devices/{device_id}/pause": {
      "post": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Account gate paused; active work is stopped/signaled"
          }
        },
        "security": [
          {
            "AccountSession": []
          }
        ],
        "summary": "Pause account-side prompt delivery",
        "tags": [
          "Operator"
        ]
      }
    },
    "/api/operator/devices/{device_id}/resume": {
      "post": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Account gate enabled; effective state still reflects the local gate"
          }
        },
        "security": [
          {
            "AccountSession": []
          }
        ],
        "summary": "Resume account delivery only if the local extension remains enabled",
        "tags": [
          "Operator"
        ]
      }
    },
    "/api/operator/devices/{device_id}/revoke": {
      "post": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Pairing permanently revoked until fresh device authorization"
          }
        },
        "security": [
          {
            "AccountSession": []
          }
        ],
        "summary": "Revoke device token, stop work, and delete retained pictures",
        "tags": [
          "Operator"
        ]
      }
    },
    "/api/public-route-index.json": {
      "get": {
        "responses": {
          "200": {
            "description": "Public route inventory"
          }
        },
        "security": [],
        "summary": "Read the public route visibility and indexing inventory",
        "tags": [
          "Service"
        ]
      }
    },
    "/api/remote/devices/register": {
      "post": {
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RegisterDeviceRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "description": "Durable device registered; device_token is returned once"
          },
          "403": {
            "description": "Access token missing, expired, or already consumed"
          }
        },
        "security": [
          {
            "DeviceAccessToken": []
          }
        ],
        "summary": "Consume a one-time access token and register the enabled extension",
        "tags": [
          "Pairing"
        ]
      }
    },
    "/api/remote/devices/{device_id}/check-in": {
      "post": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeviceCheckIn"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "Device authority and heartbeat updated"
          },
          "403": {
            "description": "Invalid or revoked device token"
          }
        },
        "security": [
          {
            "DeviceBearer": []
          }
        ],
        "summary": "Publish heartbeat and local extension-enabled state",
        "tags": [
          "Connect"
        ]
      }
    },
    "/api/remote/devices/{device_id}/commands/{command_id}/status": {
      "post": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "command_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CommandStatusUpdate"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "Transition accepted or identical terminal acknowledgement replayed"
          },
          "403": {
            "description": "Invalid or revoked device token"
          },
          "409": {
            "description": "The device credential is valid, but the command claim is stale or not held by this worker"
          }
        },
        "security": [
          {
            "DeviceBearer": []
          }
        ],
        "summary": "Apply a claim-bound strict command-state transition",
        "tags": [
          "Connect"
        ]
      }
    },
    "/api/remote/devices/{device_id}/desktop-frames": {
      "post": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DesktopFrameUpload"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "description": "Private picture validated, stored, and retention applied"
          },
          "400": {
            "description": "Invalid MIME, signature, hash, dimensions, age, or size"
          }
        },
        "security": [
          {
            "DeviceBearer": []
          }
        ],
        "summary": "Upload one bounded private JPEG, PNG, or WebP desktop picture",
        "tags": [
          "Connect"
        ]
      }
    },
    "/api/remote/devices/{device_id}/token/rotate": {
      "post": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Replacement device_token returned once; old token invalid"
          }
        },
        "security": [
          {
            "DeviceBearer": []
          }
        ],
        "summary": "Atomically rotate the durable device credential",
        "tags": [
          "Connect"
        ]
      }
    },
    "/api/remote/devices/{device_id}/work-items": {
      "get": {
        "description": "With no query, atomically leases at most one prompt and returns stop signals. While a command is running, use exactly control_only=1 to return stop_requests and the extension, account, and effective authority gates without claiming or mutating queued commands. Other query strings are rejected.",
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Set exactly to 1 for a zero-claim stop-and-authority poll.",
            "in": "query",
            "name": "control_only",
            "required": false,
            "schema": {
              "enum": [
                "1"
              ],
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "A normal lease response, or a zero-command control-only response with stop requests and current authority gates"
          },
          "400": {
            "description": "Query string is not absent or exactly control_only=1"
          },
          "403": {
            "description": "Invalid or revoked device token"
          }
        },
        "security": [
          {
            "DeviceBearer": []
          }
        ],
        "summary": "Atomically lease prompts or poll controls without claiming work",
        "tags": [
          "Connect"
        ]
      }
    },
    "/control/{device_id}/desktop-picture": {
      "get": {
        "parameters": [
          {
            "in": "path",
            "name": "device_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "JPEG, PNG, or WebP with private no-store and nosniff headers"
          },
          "404": {
            "description": "No owned picture exists"
          }
        },
        "security": [
          {
            "AccountSession": []
          }
        ],
        "summary": "Read the newest account-private desktop picture",
        "tags": [
          "Operator"
        ]
      }
    }
  },
  "servers": [
    {
      "url": "https://remoteendpoints.com"
    }
  ],
  "tags": [
    {
      "description": "Anonymous health, readiness, and public route-discovery documents.",
      "name": "Service"
    },
    {
      "description": "Shared account registration, verification delivery, and sign-in.",
      "name": "Account"
    },
    {
      "description": "Short-lived device-code setup and durable extension registration.",
      "name": "Pairing"
    },
    {
      "description": "Durable device heartbeat, private pictures, work leases, command state, and token rotation.",
      "name": "Connect"
    },
    {
      "description": "Account-private computer, prompt, stop, pause, resume, and revoke controls.",
      "name": "Operator"
    }
  ],
  "x-authorization-model": {
    "connect_ai_performs_computer_work": true,
    "effective_authority": "extension_enabled AND account_enabled AND NOT revoked",
    "setup_event": "Install and enable the independent RemoteEndpoints extension, then pair an account once.",
    "target_side_per_prompt_approval": false,
    "website_calls_windows_apis_directly": false
  },
  "x-availability": {
    "authenticated_workspace_implemented": true,
    "autonomous_multi_turn_visual_agent_implemented": false,
    "connect_client_source_integration_implemented": true,
    "current_public_download_compatibility_claimed": false,
    "durable_crash_proof_external_side_effect_idempotency_implemented": false,
    "installed_production_round_trip_proven": false,
    "persistent_server_api_implemented": true,
    "production_round_trip_claimed": false
  }
}