Skip to main content
The admin UI at /admin is the control panel for your AI-Implement orchestrator. It is protected by the ADMIN_ACCESS_CODE environment variable — if that variable is not set, the UI is disabled. All management tasks described on this page can be performed either through the browser UI or programmatically via the JSON API documented at the bottom of this page.

​
Team/repo mappings

The mappings panel is where you connect Linear teams to GitHub repositories and control how each team’s issues are dispatched. Each mapping includes the following fields:
FieldDescriptionDefault
teamKeyLinear team key (e.g. ENG)—
ownerGitHub org or user owning the target repo—
repoGitHub repository name—
workflowFileWorkflow file to dispatchclaude-implement.yml
defaultBranchBranch to check outmain
maxInProgressAiIssuesMax issues with AI-Working simultaneously3
executionModegithub-actions or fly-machinesgithub-actions
sessionModeautonomous, interactive, or hybridautonomous
machineCpusFly Machine CPU count (fly-machines mode only)2
machineMemoryMbFly Machine memory in MB (fly-machines mode only)4096
planningEnabledRun the planning phase before implementationtrue
planningWorkflowFileWorkflow file for the planning phaseclaude-plan.yml
autoApprovePlansAutomatically proceed to implementation after planningtrue
providerClaude provider: anthropic or bedrockanthropic
awsRegionAWS region for Bedrock (required when provider is bedrock)—
extraEnvExtra environment variables injected at dispatch time—
Setting provider to bedrock requires awsRegion and is not compatible with executionMode: fly-machines. You must also add AWS_BEDROCK_ROLE_ARN as a secret in the target repo and set the AI_IMPLEMENT_PROVIDER and AI_IMPLEMENT_AWS_REGION repo variables so comment-triggered gap-fill runs use the same auth path.

​
Dispatch log

The dispatch log shows the last 500 dispatches across all teams. Each entry records which issue was dispatched, to which repo, when, and the outcome. Use this log to audit activity or diagnose why an issue was or was not picked up.

​
Active sessions

The sessions panel lists all Fly Machine sessions that are currently in the started, starting, or created state. Each row shows the machine ID, region, and — where available — the Linear issue and repo it is working on. You can destroy a stuck session directly from this panel. Destroying a session also removes the AI-Working label from the associated Linear issue and clears it from the deduplication window, so the orchestrator can pick it up again on the next poll.
If a Fly Machine appears stuck and is not progressing, destroying it from the sessions panel is the cleanest recovery path.

​
Deduplication

Issues are deduplicated for 24 hours after dispatch to prevent the orchestrator from picking up the same issue repeatedly. The dedup panel shows every issue currently in the dedup window. You can manually remove an issue from the window if you want the orchestrator to re-dispatch it before the 24-hour window expires.

​
Runner mode

The runner mode panel lets you get or set the orchestrator’s runner mode. If the RUNNER_MODE environment variable is set on the orchestrator process, it takes precedence over the database value — the UI will indicate when this is the case.
If you change runner mode via the API while RUNNER_MODE is set in the environment, the new value is persisted to the database but has no effect until the environment variable is removed and the orchestrator is restarted.

​
Orchestrator settings

The settings panel manages two orchestrator-level values:
  • flySessionsApp — the Fly.io app name used for Fly Machine sessions
  • flySessionsRegion — the default region for new Fly Machine sessions
Both values can be overridden at the environment level via FLY_SESSIONS_APP and FLY_SESSIONS_REGION. When an env override is active, the UI shows the current runtime value alongside the database value and flags that the env var is winning. Changes to settings that differ from the running process take effect after a restart.

​
Secrets

​
Per-team secrets

Each team mapping has its own secrets panel at /api/mappings/:teamKey/secrets. Secrets are stored as Fly app secrets with the team key as a prefix (e.g. a secret named MY_TOKEN for team ENG is stored as ENG_MY_TOKEN). Secret names must contain only letters, digits, and underscores.

​
Global secrets

Global secrets are Fly app secrets that do not belong to any specific team. They are listed, created, and deleted from /api/global-secrets. Global secret names must not start with any team key prefix.

​
Admin API reference

All /api/* endpoints except /api/auth require a Bearer token obtained from /api/auth. Tokens expire after 24 hours.

​
Authentication

1

Obtain a bearer token

POST your access code to /api/auth:
curl -s -X POST https://your-orchestrator/api/auth \
  -H "Content-Type: application/json" \
  -d '{"code": "your-access-code"}' \
  | jq -r '.token'
The response contains a token field. Store it for subsequent requests.
2

Pass the token on subsequent requests

Include the token as a Bearer header:
TOKEN="<token from previous step>"
curl -s https://your-orchestrator/api/mappings \
  -H "Authorization: Bearer $TOKEN"

​
Endpoint reference

MethodPathDescription
POST/api/authAuthenticate with access code; returns bearer token
GET/api/mappingsList all team/repo mappings
POST/api/mappingsCreate or update a mapping
PATCH/api/mappings/:teamKeyUpdate a mapping’s concurrency cap
DELETE/api/mappings/:teamKeyDelete a mapping
GET/api/logDispatch audit log (last 500 entries)
GET/api/sessionsList active Fly Machine sessions
DELETE/api/sessions/:machineIdDestroy a session and reset the Linear issue
GET/api/dedupList issues in the 24-hour dedup window
DELETE/api/dedup/:issueIdRemove an issue from the dedup window
GET/api/runner-modeGet current runner mode
POST/api/runner-modeSet runner mode
GET/api/settingsGet orchestrator settings
POST/api/settingsUpdate orchestrator settings
GET/api/global-secretsList global Fly secrets
POST/api/global-secretsSet a global Fly secret
DELETE/api/global-secrets/:nameDelete a global Fly secret
GET/api/mappings/:teamKey/secretsList per-team Fly secrets
POST/api/mappings/:teamKey/secretsSet a per-team Fly secret
DELETE/api/mappings/:teamKey/secrets/:nameDelete a per-team Fly secret
/api/auth is the only endpoint that does not require a bearer token. All other /api/* routes return 401 Unauthorized if the token is missing or expired.