30  AG-UI

2 operations.

30.0.1 getAguiCapabilities

GET /chat/agui/capabilities

What the AG-UI surface can do

Return backend capabilities for AG-UI client discovery.

Authentication: not declared

Responses

Status	Meaning	Body
200	Successful Response

30.0.2 streamAguiRun

POST /chat/agui/stream

Run an agent and stream AG-UI events back

Stream chat response in AG-UI format. Authenticated like the other twenty-one non-health routes. This one was not, and the gap was not a data leak — every path ends at Supabase with the anon key plus the caller’s JWT, so RLS returns nothing to a caller without a valid one. It was an unauthenticated entry point to paid work: the model ran and the tools ran before the empty result came back. See docs/issues/20260821_agui_stream_forwards_a_token_it_never_verifies.md. require_auth reads this route’s wire shape — the Authorization header, then jwt_token from the body, which is how the web app sends it. Starlette caches request.json(), so the dependency reading the body does not consume it before the handler below does. Accepts optional system_type parameter to route to specific backend: - dataadk (default) - DataADK (Google ADK Sequential Agent Pipeline) - orion - Next-gen 3-agent sequential pipeline - kawa - API 584 IOW workflow agent

Authentication: bearerAuth

Responses

Status	Meaning	Body
200	Successful Response