# Config, Models, and Databases API

## Configuration

| Method | Endpoint | Description |
|---|---|---|
| `GET` | `/api/config` | Get current config + MCP server statuses |
| `PATCH` | `/api/config` | Update model and/or system prompt |
| `GET` | `/api/config/explain/:dot_path` | Explain one effective config setting |
| `GET` | `/api/config/sources` | Inspect config source layers and pack contributions |
| `GET` | `/api/config/fields` | List or search config setting metadata |
| `POST` | `/api/config/validate` | Test API connection, list models |

### Get Config

```
GET /api/config
```

Returns the current configuration including MCP server connection statuses and user identity. The API key is returned as a boolean (`has_api_key`) --- never the actual value.

The response includes an `identity` field with `user_id` and `display_name` (the private key is never exposed via the API).

### Update Config

```
PATCH /api/config
```

Updates the model and/or system prompt. Before writing, the current `config.yaml` is snapshotted to `~/.anteroom/backups/config/` (source: `config_api`) so the previous state is recoverable via `aroom config restore`. The write itself is atomic — a temp file is flushed, `fsync`'d, and then renamed into place, so the file is never left in a partially written state. Changes take effect immediately on the running server.

### Validate Connection

```
POST /api/config/validate
```

Tests the API connection and lists available models. When `ai.allowed_models` is configured, the returned model list is filtered to only include allowed models.

### Explain Config

```
GET /api/config/explain/safety.approval_mode
GET /api/config/sources
```

`/config/explain/{dot_path}` returns the effective value, winning source layer, lower-precedence configured values, team-enforcement status, field metadata, notes, and pack overlay contributions for one setting. Sensitive values are redacted.

`/config/sources` returns configured fields by layer, enforced fields, pack overlay contributions, and same-priority pack conflicts. These endpoints use the same explanation service as `aroom config explain`, `aroom config sources`, and `/config explain`.

### Config Fields

```
GET /api/config/fields
GET /api/config/fields?query=approval&include_current=true
```

Returns the config setting registry: dot path, type, defaults, valid enum/range metadata, settable scopes, tags, aliases, sensitivity, and plain-language descriptions. Add `query` to search by field name or topic. Add `include_current=true` to include the effective value and source layer. Sensitive fields are omitted by default; if `include_sensitive=true` is supplied, their values are still redacted in current-value responses.

## Models

| Method | Endpoint | Description |
|---|---|---|
| `GET` | `/api/models` | List available models (sorted, filtered by `ai.allowed_models` when set) |

Both `GET /api/models` and `POST /api/config/validate` respect the `ai.allowed_models` configuration. When the allowlist is empty (default), all models from the provider are returned.

## Databases

| Method | Endpoint | Description |
|---|---|---|
| `GET` | `/api/databases` | List all connected databases |
| `POST` | `/api/databases` | Add database (name, path) |
| `DELETE` | `/api/databases/:name` | Remove database connection |
| `GET` | `/api/browse?path=` | Browse filesystem for `.db`/`.sqlite`/`.sqlite3` files |

## MCP Tools

| Method | Endpoint | Description |
|---|---|---|
| `GET` | `/api/mcp/tools` | List all available MCP tools with schemas |
