API

Base: https://auto.hacker.pit.world/api/v1. Authenticate with Authorization: Bearer ah_… (make a key on your account page).

# who am I (401 when logged out)
GET  /api/v1/me/profile

# targets + proof
GET  /api/v1/targets
POST /api/v1/targets                 { "host": "example.com" }   -> { target, proof }
GET  /api/v1/targets/:id
POST /api/v1/targets/:id/verify      { "method": "dns|file|meta" }  (optional)

# runs — the gate refuses an unproven host with 403
POST /api/v1/runs                    { "host": "example.com" }  or { "target_id": "…" }
GET  /api/v1/runs
GET  /api/v1/runs/:id
GET  /api/v1/runs/:id/stream         (text/event-stream, live)
GET  /api/v1/runs/:id/export.json
GET  /api/v1/runs/:id/export.csv
GET  /api/v1/stats

The autohacker CLI and the MCP server speak the same verbs: add, verify, scan, runs, report.