kern exposes a plain-http JSON api bound to `127.0.0.1` only (never the lan). kern-cli is a client of this api; anything else — scripts, editors, ci — can be too.

enable it under settings → automation & cli. the endpoint and bearer token are published to automation.json in the app data directory:

json
{
  "version": 2,
  "port": 7442,
  "token": "…64 hex chars…",
  "pid": 12345,
  "started_at": 1789237726
}

every request needs Authorization: Bearer <token>:

bash
TOKEN=$(jq -r .token "$APPDATA/com.ellio.kern/automation.json")
curl -s -H "Authorization: Bearer $TOKEN" http://127.0.0.1:7442/status

powershell
$ep = Get-Content "$env:APPDATA\com.ellio.kern\automation.json" | ConvertFrom-Json
Invoke-RestMethod -Uri "http://127.0.0.1:$($ep.port)/status" -Headers @{ Authorization = "Bearer $($ep.token)" }

• ·all requests and responses are JSON (content-type: application/json).
• ·errors are { "error": "message" } with a 4xx/5xx status.
• ·start/install answer 200 once the action is underway. stop/restart/backup/restore answer 202 accepted and finish in the background — poll the resource to observe completion.
• ·path segments are percent-encoded (backups/world%202026.zip/restore).
• ·request bodies are capped at 64 KiB; log reads at 2 MiB.

/servers/{id}/log is offset-based. start with offset=0 to get the tail, then keep the returned nextOffset:

bash
OFFSET=0
while true; do
  BODY=$(curl -s -H "Authorization: Bearer $TOKEN" \
    "http://127.0.0.1:7442/servers/srv_123/log?lines=200&offset=$OFFSET")
  echo "$BODY" | jq -r '.lines[]'
  OFFSET=$(echo "$BODY" | jq -r .nextOffset)
  sleep 1
done

reset: true means the log rotated or shrank; the response contains a fresh tail — clear your buffer and continue from nextOffset. a trailing partial line is held back until it completes, so no output is ever split mid-line.

/events merges audit entries with the current status map. with wait=30 it blocks until something new arrives or the wait elapses, which makes it a cheap push feed:

bash
SINCE=$(date +%s)
while true; do
  BODY=$(curl -s -H "Authorization: Bearer $TOKEN" \
    "http://127.0.0.1:7442/events?since=$SINCE&wait=30")
  echo "$BODY" | jq -r '.entries[] | "\(.at) \(.action) \(.detail)"'
  echo "$BODY" | jq -r '.statuses | to_entries[] | "\(.key): \(.value)"'
  SINCE=$(echo "$BODY" | jq -r .now)
done

entries are oldest-first ({ at, action, detail, serverId? }). statuses is the full id → status map; diff consecutive responses to catch crash/restart transitions that don't produce an audit entry.

wait is capped at 30 seconds; keep your http timeout above it.

bash
curl -s -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"name":"Prod API","serverType":"custom","path":"/srv/api","group":"prod","tags":["live"]}' \
  http://127.0.0.1:7442/servers
# → 201 { "id": "srv_a1b2c3", ... }

curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  http://127.0.0.1:7442/servers/srv_a1b2c3/start

kern-cli wraps every endpoint with typed output. for anything it doesn't cover, kern-cli api is a raw passthrough:

bash
kern-cli api GET /servers
kern-cli api PATCH /servers/srv_a1b2c3 --body '{"group":"staging"}'