copaw-api-chat

# CoPaw API Chat Use this skill to work with **CoPaw over HTTP API**, not through the web UI. ## When to use - You need to talk to a local CoPaw instance programmatically. - You need the correct sequence: **create chat/session → send message → read SSE**. - You need to understand agent scoping, auth layers, or related API groups before building automation. ## Workflow 1. Read `references/overview-auth-scoping.md` first. 2. If the task is about chatting with CoPaw, then read `references/chats-console-sse.md`. 3. If the task touches agent/model/skill/tool management, read `references/agents-models-skills-tools.md`. 4. If the task touches workspace, MCP, or cron, read `references/workspace-mcp-cron.md`. 5. If you need ready-to-run examples, read `references/practical-recipes.md`. ## Minimal practical path 1. Confirm agent id (`default` unless proven otherwise). 2. Create a chat with `POST /api/chats`. 3. Reuse the returned `session_id/user_id/channel` context. 4. Send the message with `POST /api/agents/{agentId}/console/chat`. 5. Read the response as **SSE**. ## Important rules - Do not assume stateless request/response. CoPaw is **chat/session-centric**. - Distinguish confirmed API behavior from interpretation. - Prefer agent-scoped routes (`/api/agents/{agentId}/...`) or set `X-Agent-Id` explicitly. - In the current deployment, auth may be provided by **nginx Basic Auth** even if internal CoPaw auth is off. - Treat `/api/workspace` and some `/api/agents/*/files/*` surfaces as dangerous/admin-level APIs. ## References - `references/overview-auth-scoping.md` — API surface, auth, scoping, priorities - `references/chats-console-sse.md` — chat lifecycle, session context, SSE mechanics - `references/agents-models-skills-tools.md` — management surfaces around agents/models/skills/tools - `references/workspace-mcp-cron.md` — workspace, MCP, cron boundaries and risks - `references/practical-recipes.md` — short request examples and file structure examples ## Output expectations When using this skill, answer with: - the minimal correct endpoint sequence, - the required payload shape, - auth/scoping caveats, - and only the API groups relevant to the task.