Not a website API
Both services bind to loopback and reject browser Origins and non-loopback Host headers. This website does not call them. Do not publish their ports or tokens to the internet.
Two services, two tokens
| Service | Address | Token environment variable |
|---|---|---|
| Desktop control | 127.0.0.1:8766 | AIMX_API_TOKEN |
| Read-only data sidecar | 127.0.0.1:8765 | AIMX_DATA_API_TOKEN |
Use distinct 64-hex bearer tokens. Set them before launching the app. Never embed a real token in a website, shared screenshot, repository, or support report.
Read-only control endpoints
| GET route | Purpose |
|---|---|
/api/v1/health | Process liveness. |
/api/v1/status | Compatibility, gameplay state, and compact diagnostics. |
/api/v1/capabilities | Per-control availability and reasons. |
/api/v1/settings | Current settings. |
Read a local status
PowerShell example using a token already set in your environment:
if (-not $env:AIMX_API_TOKEN) {
throw 'Set your local API token before continuing.'
}
$headers = @{
Authorization = "Bearer $env:AIMX_API_TOKEN"
}
Invoke-RestMethod `
'http://127.0.0.1:8766/api/v1/status' `
-Headers $headersCommon responses
403: Host, Origin, or a disabled desktop API toggle.409: busy or no active session.429: rate limit.503: unavailable, not attached, missing game window, or concurrency limit.
The control service also has write-capable routes. This public guide intentionally focuses on status and diagnostics. Maintainers should use the access-controlled repository reference for the complete contract.