> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inspect.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Inspect.dev API documentation and OpenAPI

> Official Inspect.dev HTTP API documentation, OpenAPI 3.1 specification, versioning, errors, pagination, rate limits, and agent resources.

The official Inspect.dev HTTP API supports release discovery, explicit CLI
feedback, OAuth compatibility, account subscriptions, and billing. Mobile
browser debugging itself runs locally through the
[Inspect CLI](https://inspect.dev/products/cli).

## Machine-readable Inspect API contract

* [Inspect OpenAPI 3.1 specification](https://inspect.dev/openapi.json)
* [Inspect API agent context](https://inspect.dev/api/llms.txt)
* [Inspect API catalog](https://inspect.dev/.well-known/api-catalog)
* [Inspect API discovery response](https://inspect.dev/api)

## Inspect API conventions

* Send `Inspect-Version: 2026-08-06`, or omit it to use the current version.
* Errors use stable `code`, `message`, and recovery `hint` fields.
* List endpoints use opaque cursors and return next-page state.
* Responses advertise rate limits; HTTP 429 includes `Retry-After`.
* Retriable billing writes accept `Idempotency-Key`.

## Submit Inspect CLI feedback

`POST https://inspect.dev/api/feedback` accepts explicit, user-authored
feedback from an authenticated Inspect user. Send the OAuth access token as a
Bearer `Authorization` header. The required JSON object contains:

* `id`: a caller-generated UUID. It is returned as the receipt and used to
  deduplicate delivery; reuse it when retrying the same submission.
* `message`: the feedback text, from 1 to 4000 characters after trimming.
* `category`: `bug`, `idea`, `friction`, or `other`.
* `cliVersion`, `platform`, `arch`, and `nodeVersion`: basic CLI/runtime
  metadata strings from 1 to 128 characters each.

A successful response is `{ "received": true, "id": "<same UUID>" }`. Invalid
JSON or fields return HTTP 400, delivery failures return HTTP 500, and clients
are limited to five submissions per authenticated user every 60 seconds. HTTP 429 includes
`Retry-After`.

The service derives the Clerk user ID from the validated bearer token and ties
the delivered feedback to that account; a client-supplied user ID is rejected.
The command sends only the generated receipt ID, explicit message, category,
and listed CLI/runtime metadata in the JSON body. It does not attach logs,
URLs, device or target identifiers, command history, or the working directory.
Missing or invalid credentials return HTTP 401.

## Authentication

Inspect uses OAuth 2.0 Authorization Code with PKCE through Clerk. See the
[Inspect authentication documentation](/developers/authentication) and
[least-privilege permission matrix](/developers/permissions).

<Note>
  Use the CLI for local device and browser actions. Do not invent cloud API
  endpoints for snapshots, console messages, network requests, or screenshots.
</Note>