Dashboard proxy behavior

The dashboard provides same-origin proxies so the signed-in browser can reach authorized backend services. A proxy path is not a second public API with independent credentials.

Engine proxy

A request to /api/akasha/v1/... is rewritten to /api/akasha?akashaPath=v1/.... The proxy:

1. Verifies the browser session.
2. Resolves the active organization and an accessible service, using the saved service preference where possible.
3. Builds a capability grant for the method, path, and—in the case of MCP tool calls—the requested tool and arguments.
4. Forwards to the service's provider endpoint with x-akasha-capability and organization, tenant, and service headers.
5. Returns the upstream body, status, and content type, except for explicitly optional dashboard fallback paths.

It supports GET, POST, PUT, PATCH, DELETE, and HEAD. Request bodies are forwarded for methods that carry them. Unsupported operation mappings can return 405. The incoming browser cookie is not copied to the dedicated daemon.

The base /api/akasha route also has an installer-compatibility POST mode selected by op; that branch has a different upstream and contract. It is not a memory request.

Management proxy

/api/control-plane/v1/... is rewritten to /api/control-plane?controlPlanePath=v1/.... It uses the configured management origin and forwards the session access token as Bearer authentication with x-l1fe-platform: minds.

Missing session returns 401. Missing/invalid proxy path returns 400. An unconfigured upstream normally returns 503 CONTROL_PLANE_UNCONFIGURED; a failed upstream fetch normally returns 502. Upstream bodies and statuses otherwise pass through.

Optional fallbacks are not measurements

Some panels are allowed to render when a backend capability is unavailable. Those paths can receive local fallback responses instead of the upstream error.

The management proxy's region catalog fallback contains Oregon and Virginia records. Its region-health fallback can return healthy:true, kubernetesConnected:true, ingressHealthy:true, and certificatesValid:true alongside an epoch lastCheck. Those values are catalog defaults, not live probe results. A 200 response for this fallback does not certify infrastructure health.

The engine proxy has a separate optional-path fallback map. An empty list or zero-filled summary on those paths can mean that no active service or supported upstream route was available. Do not use a dashboard fallback as an authoritative export, billing source, or monitoring alert.

For operational verification, inspect the chosen endpoint, response provenance, and direct backend status with an appropriately scoped credential.

Other proxies

The dashboard's /api/omerta route is an independent proxy with its own path and forwarding rules. The exact contract is documented here. Do not apply the Akasha capability model to it by analogy.

Source: minds-ui/apps/app/next.config.*, app/api/akasha/proxy.ts, and app/api/control-plane/route.ts.