CodeJackRabbit client/server protocol
This is CodeJackRabbit's own protocol, version 0.2. Any implementation that honors this document can serve the CLI and editor integrations.
Default origins
| Purpose | Default origin | Paths |
|---|---|---|
| API and reviews | https://api.codejackrabbit.com | /v1/*, /rpc, /trpc/*, /cli/validate-api-key |
| Review WebSocket | wss://api.codejackrabbit.com | /ws |
| Releases | configured server origin | /releases/latest.json |
| Configuration schema | configured server origin | /integrations/schema.json |
Region hosts are api.codejackrabbit.com (US) and api.eu.codejackrabbit.com (EU). The CLI derives WebSocket and API paths from the selected origin.
Authentication
The server accepts bearer API keys, x-codejackrabbit-api-key, or an OAuth access token issued by its authorization-code exchange. Clients also send x-codejackrabbit-client, CLI version, client id and active organization headers. Token exchange and refresh are exempt from the key gate because they are how clients obtain access. Browser login can run through GitHub OAuth or an explicitly enabled development flow.
HTTP surfaces
Core REST covers reviews, tasks, usage, learnings, attachments, organizations, users, roles, repositories, metrics, reports and audit logs. POST /extension/product-tier reports the self-hosted feature set. Webhooks are exposed at /github/webhook, /gitlab/webhook and /bitbucket/webhook.
Coding-agent compatibility routes are /api/coding-agent/events (server-sent trace replay), /api/coding-agent/files/content and attachment creation/upload.
RPC
POST /rpc accepts {path, input} and returns {result:{type:"data",data}}. Batched calls can use /trpc/<path> with the same procedure names. All 64 externally catalogued procedure names from the functional research are implemented by the server, plus CodeJackRabbit aliases for review, tasks, usage and learnings:
- access token exchange and refresh
- session, organizations and extension profiles
- metered usage summaries
- pull-request prompts and review threads
- editor capabilities and full/remote reviews
- coding-task creation, handoff, messages, queues, steering, plans, approvals, comments, implementation, patch revision/application, traces, outputs, files, side chats, skills, automations, attachments, subscriptions, pin/archive/visibility, PR health/fix context and autopilot
Unknown procedures return a JSON-RPC-style method error. Plan stale and author-approval violations return stable machine-readable codes.
WebSocket review protocol
Clients send text PING for literal PONG, connection parameters, a review subscription and a full or remote review mutation. Subscription events are review_status, review_comment, state_update, review_completed, rate_limit_exceeded and error. State contains a content fingerprint. Sending it back with unchanged contents lets the server mark the review reused: true while replaying findings; changed contents are always analyzed again.
Other RPC procedures can be called over the same WebSocket. Errors use {id,error:{message,code,data:{code}}}.
File and finding shapes
Review files carry filename, unified diff, current fileContent, and new/deleted/renamed flags. Findings carry file, line range, severity, title, comment, code-generation instructions, suggestions, rule id and stable fingerprint. Suggestions are only included when a mechanical edit is known to be safe.