control-api

# Jarvis Control API Jarvis exposes a local HTTP API at **`/api/control/*`** so an agent can do anything the user can do in the desktop app — without Computer-Use. This skill is the recipe a coding agent (Codex CLI, Claude Code) follows when the user asks it to change a Jarvis setting on this machine. ## 1. Get the key and base URL Every install generates its own per-user key (prefix `jctl_`). - **Base URL:** `http://127.0.0.1:<port>` where `<port>` is `[ui].admin_api_port` in `jarvis.toml` (the same port the desktop app/browser UI uses). - **Key:** copy it from the desktop app → **Settings → Jarvis API**, or read it on the loopback interface: ```bash curl -s http://127.0.0.1:<port>/api/control/api-key # => {"key":"jctl_...","masked":"jctl_…1234"} ``` Send the key as a Bearer header on every other call: ``` Authorization: Bearer jctl_... ``` Verify it works: ```bash curl -s -H "Authorization: Bearer $JARVIS_KEY" \ http://127.0.0.1:<port>/api/control/auth/probe # => {"ok":true} ``` ## 2. Discover what you can change ```bash curl -s -H "Authorization: Bearer $JARVIS_KEY" \ http://127.0.0.1:<port>/api/control/allowlist ``` Returns every mutable setting with its `path`, `risk_tier` (`safe`/`ask`), `needs_restart`, and a description. Validate a `path` against this before you write — a path that is not listed (or is a protected secret) is refused. ## 3. Read and write config ```bash # read curl -s -H "Authorization: Bearer $JARVIS_KEY" \ "http://127.0...