Mule’s API server exposes three classes of HTTP routes, all served from the same listener (the binary defaults to :8080; the shipped docker-compose.yml publishes it as 8140:8080, so http://localhost:8140 in the examples below):

ClassPrefixAuthPurpose
OpenAI-compatible/v1/*YesModel catalog + chat completions (drop-in for OpenAI SDKs)
Management/api/v1/*YesCRUD for providers, tools, skills, agents, workflows, jobs, wakes, policies, WASM modules, settings, memory config
Infrastructure/health, /ws, /voice/{job_id}/*, frontend catch-allNoHealth probes, WebSocket events, per-call voice audio, web UI shell

Authentication uses Authorization: Bearer sk_mule_<hex> on every /v1/* and /api/v1/* request. See Authentication & Tenancy for key minting, the MULE_NO_AUTH=1 dev mode, and restricted keys. Routes are defined in cmd/api/server.go; the auth middleware lives in internal/api/auth.go.

OpenAI-compatible surface (/v1)

MethodPathDescription
GET/v1/modelsList models across configured providers
POST/v1/chat/completionsChat completion (OpenAI request/response shape)

These endpoints let any OpenAI-compatible client talk to Mule. A restricted API key may still execute workflows through this surface — restricted keys are only blocked from writes under /api/v1/agents, /workflows, /jobs, and /policies.

Providers (/api/v1/providers)

MethodPathDescription
GET/api/v1/providersList AI providers
POST/api/v1/providersCreate a provider
GET/api/v1/providers/{id}Get a provider
PUT/api/v1/providers/{id}Update a provider
DELETE/api/v1/providers/{id}Delete a provider
GET/api/v1/providers/{id}/modelsList models reported by the provider

Tools (/api/v1/tools)

MethodPathDescription
GET/api/v1/toolsList tools
POST/api/v1/toolsCreate a tool
GET/api/v1/tools/{id}Get a tool
PUT/api/v1/tools/{id}Update a tool
DELETE/api/v1/tools/{id}Delete a tool

Tools are global (shared across users) by design.

Skills (/api/v1/skills)

MethodPathDescription
GET/api/v1/skillsList skills
POST/api/v1/skillsCreate a skill
GET/api/v1/skills/{id}Get a skill
PUT/api/v1/skills/{id}Update a skill
DELETE/api/v1/skills/{id}Delete a skill

Skills are assigned to agents through the agent-skills routes below. See Skills.

Agents (/api/v1/agents)

MethodPathDescription
GET/api/v1/agentsList agents (owner-scoped)
POST/api/v1/agentsCreate an agent — restricted keys blocked
GET/api/v1/agents/{id}Get an agent
PUT/api/v1/agents/{id}Update an agent — restricted keys blocked
DELETE/api/v1/agents/{id}Delete an agent — restricted keys blocked
GET/api/v1/agents/{id}/toolsList tools assigned to the agent
POST/api/v1/agents/{id}/toolsAssign a tool to the agent
DELETE/api/v1/agents/{id}/tools/{toolId}Remove a tool from the agent
GET/api/v1/agents/{id}/skillsList skills assigned to the agent
PUT/api/v1/agents/{id}/skillsReplace the agent’s skill assignment set
DELETE/api/v1/agents/{id}/skills/{skillId}Remove a skill from the agent

Workflows (/api/v1/workflows)

MethodPathDescription
GET/api/v1/workflowsList workflows (owner-scoped)
POST/api/v1/workflowsCreate a workflow — restricted keys blocked
GET/api/v1/workflows/{id}Get a workflow
PUT/api/v1/workflows/{id}Update a workflow — restricted keys blocked
DELETE/api/v1/workflows/{id}Delete a workflow — restricted keys blocked
GET/api/v1/workflows/{id}/stepsList workflow steps
POST/api/v1/workflows/{id}/stepsCreate a step
POST/api/v1/workflows/{id}/steps/reorderReorder steps
PUT/api/v1/workflows/{workflow_id}/steps/{step_id}Update a step
DELETE/api/v1/workflows/{workflow_id}/steps/{step_id}Delete a step

Jobs (/api/v1/jobs)

MethodPathDescription
GET/api/v1/jobsList jobs (owner-scoped)
POST/api/v1/jobsSubmit a job — restricted keys blocked
GET/api/v1/jobs/{id}Get a job
DELETE/api/v1/jobs/{id}Cancel a job — restricted keys blocked
GET/api/v1/jobs/{id}/stepsList a job’s step history

Wakes (/api/v1/wakes)

The wake engine stores scheduled/event-triggered proactivity (cron, webhook, event, and job-outcome wakes). See Wakes.

MethodPathDescription
GET/api/v1/wakesList wakes (owner-scoped)
POST/api/v1/wakesCreate a wake
POST/api/v1/wakes/fireFire wake(s) immediately
POST/api/v1/wakes/pauseScheduler kill-switch: bulk-pause
GET/api/v1/wakes/activityRecent wake activity feed
GET/api/v1/wakes/{id}Get a wake
PATCH/api/v1/wakes/{id}Update a wake (enable/disable, edit)
DELETE/api/v1/wakes/{id}Delete a wake
GET/api/v1/wakes/{id}/logPer-wake fire log

Static segments (/fire, /pause, /activity) are registered before the {id} routes because the router matches in registration order.

Policies (/api/v1/policies)

The policy engine gates forge tool calls with deterministic allow/deny/ask verdicts. See Policy Engine.

MethodPathDescription
GET/api/v1/policiesList policy rules (owner-scoped)
POST/api/v1/policiesCreate a rule — restricted keys blocked
POST/api/v1/policies/evaluateSynchronous before_tool decision query — open to restricted keys
POST/api/v1/policies/memoRecord a human approved/denied verdict — open to restricted keys
POST/api/v1/policies/proposalsAgent-drafted rule proposal — open to restricted keys
POST/api/v1/policies/proposals/{id}/approveApprove a proposal (non-restricted key required)
GET/api/v1/policies/{id}Get a rule
PATCH/api/v1/policies/{id}Update a rule — restricted keys blocked
DELETE/api/v1/policies/{id}Delete a rule — restricted keys blocked

The three exempt POST routes are deliberate: asking about an action, recording a decision, and drafting a proposal are not policy mutations.

WASM modules (/api/v1/wasm-modules)

MethodPathDescription
GET/api/v1/wasm-modulesList modules (global)
POST/api/v1/wasm-modulesCreate a module
POST/api/v1/wasm-modules/compileCompile source to WASM
POST/api/v1/wasm-modules/testTest-compile without persisting
GET/api/v1/wasm-modules/exampleFetch the example module source
GET/api/v1/wasm-modules/{id}Get a module
PUT/api/v1/wasm-modules/{id}Update a module
DELETE/api/v1/wasm-modules/{id}Delete a module
GET/api/v1/wasm-modules/{id}/sourceGet stored source
PUT/api/v1/wasm-modules/{id}/sourceUpdate stored source (hot-reload)

See Building a WASM Module.

Settings & memory config

MethodPathDescription
GET/api/v1/settingsList all settings (global)
GET/api/v1/settings/{key}Get one setting
PUT/api/v1/settings/{key}Update one setting
GET/api/v1/memory-configGet RAG/memory configuration
PUT/api/v1/memory-configUpdate RAG/memory configuration

Unauthenticated routes

MethodPathNotes
GET/healthReturns 200 OK with body OK; used by container health probes
GET/wsWebSocket event stream (job/agent events). No Bearer header on WS upgrades
GET/POST/voice/{job_id}/in, /voice/{job_id}/outVoice-loop per-call audio sockets; the 128-bit job id is the capability
GET/* (catch-all)Serves the embedded web frontend

Quick example 

# List your agents
curl -s http://localhost:8140/api/v1/agents \
  -H "Authorization: Bearer sk_mule_<hex>"

# Chat completion via the OpenAI-compatible surface
curl -s http://localhost:8140/v1/chat/completions \
  -H "Authorization: Bearer sk_mule_<hex>" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o","messages":[{"role":"user","content":"ping"}]}'
Was this page helpful?