API Reference

Summary

This document catalogs the API surfaces found in the Velox source code as it exists today. It covers the Velox API Service REST runtime, the Designer API/OpenAPI module, webhook-related behavior found in the codebase, command-line switches, Cromis IPC calls, and script-facing request/response APIs used by REST flows.

The source code is the authority for this document. Where behavior could not be determined from the reviewed code, it is marked as unclear.

Related PKB Documents

• Architecture
• Domain Model
• Feature Inventory
• Flow Execution
• Service Reference
• Security Reference
• Logging Reference
• Error Reference
• Data Format Reference
• Module Library
• Technical Debt

Source Code Locations

Area	Source location
Velox API Service executable	VeloxAPIService/VeloxAPIService.dpr
Velox API Service lifecycle and IPC	VeloxAPIService/classMain.pas
WebBroker dispatch module	VeloxAPIService/vxWebModule.pas
REST endpoint manager	Classes/Service/vxManagerREST.pas
REST action execution thread	Classes/Service/vxActionThread.pas
Flow REST configuration	Classes/vxActionMan.pas
Flow REST setup UI	Forms/frmSetupActions.pas
API/OpenAPI module	Classes/vxAPI.pas
API/OpenAPI setup UI	Forms/frmSetupAPI.pas
Request/response wrappers	Classes/Tools/vxAPIStream.pas
Pascal Script API imports	Scripting/Imports/VxClasses/uPSI_vxAPIStream.pas
Script runtime accessors	Classes/vxScripter.pas
Cromis IPC wrapper	Classes/Tools/vxIPC.pas
Velox Service IPC handler	VeloxService/classMain.pas
Designer service/IPC manager	Classes/GUI/vxManagerService.pas
Command-line parameter parsing	Classes/Tools/vxCommon.pas
Designer executable startup	Velox.dpr
Velox Service executable startup	VeloxService/VeloxService.dpr
Modified service manager switches	Modified/Vcl/Vcl.SvcMgr.pas

Important Classes, Forms, and Services

Type	Name	Purpose
Service	VeloxAPIService	Windows service hosting configured REST flow endpoints through Indy/WebBroker.
Service	VeloxService	Windows service executing non-REST orchestration and exposing service IPC commands.
Class	TvxRESTManager	Loads active REST flows and routes HTTP requests to matching endpoint items.
Class	TvxRESTItem	Represents one runtime REST endpoint backed by a flow.
Class	TRESTActionThread	Executes a REST flow and bridges HTTP request/response objects into the flow runtime.
Class	TvxActionMan	Flow module class; stores REST endpoint metadata and runtime request/response references.
Class	TvxAPI	Designer API module that groups REST flows and generates OpenAPI JSON.
Class	TvxAPIRequest	Script-visible wrapper around TIdHTTPAppRequest.
Class	TvxAPIResponse	Script-visible wrapper around TIdHTTPAppResponse.
Class	TvxIPC	Client wrapper over Cromis IPC for service control and diagnostics.
Form	TfrmSetupActions	Designer flow setup form, including REST endpoint fields.
Form	TfrmSetupAPI	Designer API setup form for grouping REST flows and exporting OpenAPI schemas.

Related Configuration

Configuration	Where used	Notes
gSetup.VeloxAPIPort	VeloxAPIService/classMain.pas	HTTP listener port. If zero, the API service defaults to 8359.
gSetup.VeloxAPIDomain	Service setup and security-related code	Used as the configured API domain. Exact listener binding behavior was not confirmed in the reviewed API service startup code.
gSetup.VeloxAPIEnableSSL	Service setup/security-related code	SSL configuration exists, but active TLS binding behavior was not fully confirmed in reviewed API startup code.
gSetup.VeloxAPICertificate	Service setup/security-related code	Certificate configuration exists. Runtime certificate loading behavior is unclear from the reviewed API startup path.
gSetup.VeloxAPIUrl	Forms/frmSetupActions.pas	Used by Designer to display a link for a configured REST endpoint.
gSetup.VeloxWebInstallPath	Classes/vxAPI.pas	Used as the base path for exported OpenAPI JSON under wwwroot\openapi\.
gSetup.ServiceState	VeloxService/classMain.pas, REST manager sync	Controls whether service-managed runtime endpoints are enabled.
VX_ACTION.RESTMETHOD	Classes/vxActionMan.pas, Classes/vxAPI.pas	Configured method used by Designer/OpenAPI generation. Runtime dispatch behavior is described below.
VX_ACTION.RESTENDPOINT	Classes/vxActionMan.pas, Classes/Service/vxManagerREST.pas	Runtime REST route key.
VX_ACTION.RESTALLOWANON	Classes/vxActionMan.pas, Forms/frmSetupActions.pas	Stored and edited. Runtime enforcement was not found in the reviewed dispatcher.
VX_ACTION.REQUESTFID / VX_ACTION.RESPONSEFID	Classes/vxActionMan.pas, Classes/vxAPI.pas	Optional request/response data definitions for REST/OpenAPI metadata and runtime binding.

API Surface Overview

REST API Runtime

The REST API runtime is hosted by VeloxAPIService.exe. Startup creates a TvxRESTManager, synchronises active REST flows from the system database, starts an Indy TIdHTTPWebBrokerBridge, and dispatches each HTTP request through TRESTModule.WebModuleBeforeDispatch.

TvxRESTManager.Synchronise loads active, non-archived actions where EXECUTION = fstREST. Each flow becomes a TvxRESTItem stored by configured RESTEndpoint.

REST Dispatch Flow

REST Endpoint Catalog

Endpoint	Method	Purpose	Request	Response	Authentication	Source
/	GET or any method dispatched to path /	Lists active REST API services as generated HTML.	No required body. Uses the request object to build debug details in the generated HTML.	HTML endpoint listing. On failure, HTTP 500 with Error listing API services. Please try again.	No authentication check was found in the default endpoint handler.	Classes/Service/vxManagerREST.pas
/favicon.ico	GET or any method dispatched to path /favicon.ico	Returns the configured API favicon.	No body.	Favicon content with icon content type.	No authentication check was found.	Classes/Service/vxManagerREST.pas
<RESTEndpoint>	GET	Executes the flow configured for the endpoint. Query fields are copied into flow locals.	Query string fields; request headers; optional X-UserNum header; no request body behavior specific to GET was found.	Flow response. Success status defaults to configured RESTSuccessResult; flow log errors may return configured client or server status. Fatal exceptions return configured server status or HTTP 500. Timeout returns HTTP 500.	Central authentication enforcement was not found. RESTAllowAnonymous is stored but not enforced in reviewed dispatcher code. Flow logic may perform its own checks.	Classes/Service/vxManagerREST.pas, Classes/Service/vxActionThread.pas
<RESTEndpoint>	POST	Executes the flow configured for the endpoint with access to the request body through TvxAPIRequest.	Request body stream/string; query fields; request headers; optional X-UserNum header.	Flow response. Success status defaults to configured RESTSuccessResult; issue/error statuses may return configured client status; fatal exceptions return configured server status or HTTP 500. Timeout returns HTTP 500.	Central authentication enforcement was not found. Flow logic may perform its own checks.	Classes/Service/vxManagerREST.pas, Classes/Service/vxActionThread.pas, Classes/Tools/vxAPIStream.pas
<RESTEndpoint>	PUT, PATCH, DELETE, HEAD, other	Method values exist in TvxAPIRequest.HTTPMethod, but TvxRESTItem.WebActionHandler only dispatches mtGet and mtPost in reviewed code.	Unclear.	No explicit response behavior for unsupported methods was found in the reviewed TvxRESTItem.WebActionHandler code.	Unclear.	Classes/Service/vxManagerREST.pas, Classes/Tools/vxAPIStream.pas

Configured REST Flow Endpoint

REST endpoints are not hard-coded routes. They are configured on flows and stored in VX_ACTION.

Field/property	Purpose	Default or valid values	Source
RESTEndpoint	URL path used as the runtime route key.	If blank when a flow is added, Designer/code defaults to /api/<FID without braces>. Setter prepends / if missing.	Classes/vxActionMan.pas, Forms/frmSetupActions.pas
RESTMethod	Designer/OpenAPI method metadata.	Defaults to hmGET. Designer may default DB-source flows to GET and file-source flows to POST.	Classes/vxActionMan.pas, Forms/frmSetupActions.pas
RESTGroups	Semicolon-separated groups/tags for API documentation.	Free text.	Classes/vxActionMan.pas, Classes/vxAPI.pas
RESTSummary	Short endpoint summary.	Free text.	Classes/vxActionMan.pas, Classes/vxAPI.pas
RESTDescription	Longer endpoint description.	Rich text/plain text stored by module persistence.	Classes/vxActionMan.pas, Classes/vxAPI.pas
RESTDocumentation	External endpoint documentation URL used in OpenAPI generation.	URL/free text.	Classes/vxActionMan.pas, Classes/vxAPI.pas
RESTParams	Query parameter metadata for OpenAPI generation.	Name, description, type metadata edited in Designer.	Forms/frmSetupActions.pas, Classes/vxAPI.pas
RESTSuccessResult	HTTP status code used after successful execution.	Defaults to 200.	Classes/vxActionMan.pas, Classes/Service/vxManagerREST.pas
RESTClientErrorResult	HTTP status code used when flow log status is issue/error.	Defaults to 400.	Classes/vxActionMan.pas, Classes/Service/vxManagerREST.pas
RESTServerErrorResult	HTTP status code used for fatal exceptions.	Defaults to 500.	Classes/vxActionMan.pas, Classes/Service/vxManagerREST.pas
RESTAllowAnonymous	Designer-configured flag for anonymous access.	Defaults to false. Runtime enforcement was not found in reviewed dispatcher code.	Classes/vxActionMan.pas, Forms/frmSetupActions.pas
RequestDef	Optional request data definition.	Data definition module reference. Used by Designer/OpenAPI and bound to runtime request.	Classes/vxActionMan.pas, Classes/vxAPI.pas
ResponseDef	Optional response data definition.	Data definition module reference. Used by Designer/OpenAPI and bound to runtime response.	Classes/vxActionMan.pas, Classes/vxAPI.pas

REST Request Handling

For REST flow execution:

• A TRESTActionThread is created for the request.
• The flow is acquired from gActionPool.
• FAction.REST is set to True.
• Query fields are copied into flow locals through FAction.SetLocals(FRequest.QueryFields).
• FAction.UserNum is set from the X-UserNum request field using StrToIntDef; missing or invalid values become 0.
• FAction.Request and FAction.Response are assigned.
• The flow executes synchronously from the HTTP caller's perspective because the handler waits up to FIVE_MINS_MILLI.
• Connection pools are released at thread cleanup.

REST Response and Error Behavior

The reviewed code shows these response behaviors:

Condition	Response behavior	Source
Endpoint manager disabled	HTTP 503 with The API endpoint is unavailable right now. Please try again later.	Classes/Service/vxManagerREST.pas
Endpoint not found	HTTP 500 with No API Flow configured for endpoint - <endpoint>.	Classes/Service/vxManagerREST.pas
GET flow completes with flsError	HTTP status is configured client error result.	Classes/Service/vxManagerREST.pas
POST flow completes with flsIssue or flsError	HTTP status is configured client error result.	Classes/Service/vxManagerREST.pas
Flow fatal exception	HTTP status is configured server error result, or 500 if unavailable.	Classes/Service/vxManagerREST.pas
Flow timeout	HTTP 500 with timeout message.	Classes/Service/vxManagerREST.pas
Flow log status is not successful	TvxLog.GetLogAPIResponse can write application/problem+json with error details.	Classes/vxModule.pas, Classes/vxActionMan.pas

TvxLog.GetLogAPIResponse builds an application/problem+json payload with type, status, title, detail, instance, and errors fields from flow log items.

REST Authentication

No central inbound REST authentication check was found in the reviewed dispatch path.

Important observed behavior:

• RESTAllowAnonymous is stored in VX_ACTION and edited in Designer, but no runtime enforcement was found in TvxRESTManager, TvxRESTItem, or TRESTActionThread.
• Authorization is available on TvxAPIRequest and exposed to scripts.
• X-UserNum is accepted from the request and copied into TvxActionMan.UserNum.
• OpenAPI generation adds API key and bearer security schemes, but matching runtime enforcement was not found in the reviewed code.
• Flow-specific script/module logic may implement authentication or authorization. That behavior depends on individual flows and cannot be inferred globally.

REST Examples

Default endpoint list:

GET http://<host>:8359/

Configured GET flow endpoint:

curl "http://<host>:8359/api/<endpoint>?id_client=123" ^
  -H "X-UserNum: 123"

Configured POST flow endpoint:

curl -X POST "http://<host>:8359/api/<endpoint>" ^
  -H "Content-Type: application/json" ^
  -H "X-UserNum: 123" ^
  --data "{\"example\":true}"

The exact endpoint paths, accepted fields, and response schemas are flow-specific and must be read from the configured flow, request data definition, response data definition, and scripts.

API/OpenAPI Designer Module

The TvxAPI module is a Designer module for grouping REST flows and generating/exporting OpenAPI JSON. It is not itself an HTTP endpoint in the reviewed code.

Purpose

TvxAPI lets a developer:

• define API metadata such as version, description, terms, contact, license, and documentation URL;
• define production and test server URLs;
• group REST flows into an API document;
• generate OpenAPI 3.0.4 JSON;
• export the schema to a file or to the Velox Web install path.

OpenAPI Generation Flow

API Module Configuration

Setting	Purpose	Source
Version	API document version. Required for schema creation.	Classes/vxAPI.pas
APIDescription	OpenAPI info description.	Classes/vxAPI.pas
OpenAPISchemaName	Generated JSON filename. Defaults to safe module name plus version.	Classes/vxAPI.pas
ProdURL / ProdURLDescription	Production server entry. At least production or test URL is required.	Classes/vxAPI.pas
TestURL / TestURLDescription	Test server entry. At least production or test URL is required.	Classes/vxAPI.pas
Groups / GroupDescription	OpenAPI tags. Groups are semicolon-separated; descriptions are split by ~.	Classes/vxAPI.pas
Terms	OpenAPI terms of service.	Classes/vxAPI.pas
ContactName, ContactURL, ContactEmail	OpenAPI contact object.	Classes/vxAPI.pas
LicenseName, LicenseURL	OpenAPI license object.	Classes/vxAPI.pas
DocumentationURL	OpenAPI external documentation URL.	Classes/vxAPI.pas
API actions	Linked REST flows included in the document.	Classes/vxAPI.pas, Forms/frmSetupAPI.pas

OpenAPI Security Schemes

Generated OpenAPI documents include:

Scheme	OpenAPI type	Location/name
API key	apiKey	Header X-ApiKey
Bearer token	HTTP bearer	JWT Bearer Token

Runtime enforcement of these schemes was not found in the reviewed REST dispatcher. Treat them as generated documentation metadata unless a specific flow implements matching validation.

OpenAPI Export API

Operation	Purpose	Request	Response	Authentication	Source
Create OpenAPI document	Builds TOpenAPIDocument from linked REST flows.	Designer action in TfrmSetupAPI; requires module name, version, and production or test URL.	JSON text stored in TvxAPI.OpenAPISchema. Logs validation errors if required fields are missing.	Designer/module access rules; no HTTP auth.	Forms/frmSetupAPI.pas, Classes/vxAPI.pas
Export OpenAPI schema	Saves generated schema to gSetup.VeloxWebInstallPath + 'wwwroot\openapi\'.	Existing OpenAPISchema.	UTF-8 JSON file.	Designer/module access rules; no HTTP auth.	Classes/vxAPI.pas, Forms/frmSetupAPI.pas
Export to selected file	Saves generated schema to a user-selected .json file.	Existing OpenAPISchema; save dialog path.	UTF-8 JSON file.	Designer/module access rules; no HTTP auth.	Forms/frmSetupAPI.pas

WebHooks

No dedicated WebHook subsystem, WebHook class, WebHook module type, or WebHook endpoint catalog was found in the reviewed source code.

Webhook-style inbound integrations can be represented by configured REST flow endpoints because external systems can call VeloxAPIService using HTTP GET or POST. However, no separate WebHook-specific behavior was found for:

• provider registration;
• callback subscription management;
• webhook secret storage;
• signature verification;
• replay protection;
• webhook retry policy;
• webhook delivery log separate from normal flow/API logging.

WebHook-Style REST Ingress

Endpoint	Method	Purpose	Request	Response	Authentication	Source
<RESTEndpoint>	Usually POST	External system calls a configured REST flow as an inbound integration callback.	Provider-specific body and headers. Exact schema depends on the flow's request data definition and scripts.	Flow-specific response.	No global webhook authentication or signature verification was found. Any verification would need to be implemented in the flow.	Classes/Service/vxManagerREST.pas, Classes/Service/vxActionThread.pas, flow modules/scripts

Example webhook-style call:

curl -X POST "http://<host>:8359/api/<webhook-like-endpoint>" ^
  -H "Content-Type: application/json" ^
  -H "X-Provider-Signature: <provider-signature>" ^
  --data "{\"event\":\"example.created\"}"

The source code does not show a standard Velox-level interpretation of provider signature headers.

Command-Line APIs

Command-line switches are parsed by helper functions in Classes/Tools/vxCommon.pas. The parser removes the first character from a tagged parameter and therefore accepts tag prefixes such as -, /, or \.

Shared Command-Line Parsing

Function	Purpose	Behavior
GetParamExists	Tests whether a tagged command-line parameter exists.	Strips the first character from each ParamStr, compares tag before = if present.
GetParamVal	Reads a tagged command-line value.	Strips the first character, matches tag=, removes surrounding quotes from the value.
GetParamSignature	Rebuilds a parameter signature for service startup preservation.	Adds quotes around values containing spaces.

Velox.exe

Switch	Purpose	Request/syntax	Response/behavior	Authentication	Source
-c=<config-key>	Loads the system connection configuration.	Velox.exe -c="ConfigKey"	If gSystemConnection.Load fails, startup exits.	OS/user context plus Velox login/runtime permissions.	Velox.dpr
-test	Starts in test system connection mode after startup checks.	Velox.exe -c="ConfigKey" -test	Calls gSystemConnection.SwitchSystemConnectionMode(True).	Same as Designer startup.	Velox.dpr
-st=true	Alternate test-mode switch.	Velox.exe -c="ConfigKey" -st=true	Calls gSystemConnection.SwitchSystemConnectionMode(True).	Same as Designer startup.	Velox.dpr
-tm=true	Enables test master mode.	Velox.exe -c="ConfigKey" -tm=true	Sets TestMasterMode := True.	Same as Designer startup.	Velox.dpr
-testmaster	Alternate test master switch.	Velox.exe -c="ConfigKey" -testmaster	Sets TestMasterMode := True.	Same as Designer startup.	Velox.dpr
-a=true	Enables alpha mode.	Velox.exe -c="ConfigKey" -a=true	Sets EnableAlpha := True.	Same as Designer startup.	Velox.dpr

The reviewed Velox.dpr also contains commented-out startup options for corrupt imports and custom config handling. Because those branches are commented out, they are not documented here as active command-line APIs.

VeloxService.exe

Switch	Purpose	Request/syntax	Response/behavior	Authentication	Source
-c=<config-key>	Loads the system connection configuration and contributes to service name.	VeloxService.exe -c="ConfigKey" -n="Production"	Required by service class. Missing value is logged as an error. Startup exits if system connection load fails.	Windows service account / SCM permissions.	VeloxService/VeloxService.dpr, VeloxService/classMain.pas
-n=<display-name>	Supplies the unique display name used by service registration/lifecycle code.	VeloxService.exe -c="ConfigKey" -n="Production"	Required by service class. Missing value is logged as an error.	Windows service account / SCM permissions.	VeloxService/classMain.pas
-test	Runs the service against the test system connection mode and appends the test suffix to service identity.	VeloxService.exe -c="ConfigKey" -test -n="Test"	Calls SwitchSystemConnectionMode(True) and preserves the switch in service startup params.	Windows service account / SCM permissions.	VeloxService/VeloxService.dpr, VeloxService/classMain.pas
-u=<user>	User value accessor exists.	VeloxService.exe -c="ConfigKey" -n="Production" -u="user"	Usage beyond reading the parameter was not found in reviewed service startup code.	Unclear.	VeloxService/classMain.pas
-p=<password>	Password value accessor exists.	VeloxService.exe -c="ConfigKey" -n="Production" -p="secret"	Usage beyond reading the parameter was not found in reviewed service startup code.	Unclear.	VeloxService/classMain.pas

VeloxAPIService.exe

Switch	Purpose	Request/syntax	Response/behavior	Authentication	Source
-c=<config-key>	Loads the system connection configuration and contributes to service name.	VeloxAPIService.exe -c="ConfigKey" -n="Production"	Required by service class. Missing value is logged as an error. Startup exits if system connection load fails.	Windows service account / SCM permissions.	VeloxAPIService/VeloxAPIService.dpr, VeloxAPIService/classMain.pas
-n=<display-name>	Supplies the unique display name used by service registration/lifecycle code.	VeloxAPIService.exe -c="ConfigKey" -n="Production"	Required by service class. Missing value is logged as an error.	Windows service account / SCM permissions.	VeloxAPIService/classMain.pas
-test	Runs the API service against the test system connection mode and appends the test suffix to service identity.	VeloxAPIService.exe -c="ConfigKey" -test -n="Test"	Calls SwitchSystemConnectionMode(True) and preserves the switch in service startup params.	Windows service account / SCM permissions.	VeloxAPIService/VeloxAPIService.dpr, VeloxAPIService/classMain.pas
-u=<user>	User value accessor exists.	VeloxAPIService.exe -c="ConfigKey" -n="Production" -u="user"	Usage beyond reading the parameter was not found in reviewed API service startup code.	Unclear.	VeloxAPIService/classMain.pas
-p=<password>	Password value accessor exists.	VeloxAPIService.exe -c="ConfigKey" -n="Production" -p="secret"	Usage beyond reading the parameter was not found in reviewed API service startup code.	Unclear.	VeloxAPIService/classMain.pas

Windows Service Registration Switches

The modified VCL service manager recognizes install-related switches:

Switch	Purpose	Request/syntax	Response/behavior	Authentication	Source
-install	Installs service through service executable path.	VeloxService.exe -install -c="ConfigKey" -n="Production"	Calls RegisterServices(True, ...). Modified code uses Service.StartupParams as the service path.	Requires Windows service installation permissions.	Modified/Vcl/Vcl.SvcMgr.pas
-uninstall	Uninstalls service.	VeloxService.exe -uninstall -c="ConfigKey" -n="Production"	Calls RegisterServices(False, ...).	Requires Windows service removal permissions.	Modified/Vcl/Vcl.SvcMgr.pas
-silent	Suppresses service registration UI/messages where supported.	VeloxService.exe -install -silent ...	Passed into RegisterServices.	Requires Windows service installation/removal permissions.	Modified/Vcl/Vcl.SvcMgr.pas

Designer service installation code uses ServiceRegister directly and builds service startup paths like:

VeloxService.exe -c="<config-key>" [-test] -n="<display-name>"
VeloxAPIService.exe -c="<config-key>" [-test] -n="<display-name>"

That is the normal installation path found in Classes/GUI/vxManagerService.pas.

Internal Cromis IPC APIs

Velox uses Cromis IPC for local communication between Designer and the Windows services. The wrapper class is TvxIPC.

IPC Transport

Property	Value/behavior	Source
IPC library	Cromis IPC	Classes/Tools/vxIPC.pas
Client computer name	Empty string, with source comment indicating local computer	Classes/Tools/vxIPC.pas
Timeout	3000 ms	Classes/Tools/vxIPC.pas
Velox Service server name	VX_SERVICENAME + ConfigKey + GetTestModeSuffix	VeloxService/classMain.pas
API Service server name	VX_APISERVICENAME + ConfigKey + GetTestModeSuffix	VeloxAPIService/classMain.pas
Request ID	Usually action GUID or new GUID depending on call	Classes/Tools/vxIPC.pas

IPC Authentication

No explicit authentication or authorization check was found inside TvxIPC request creation or the reviewed service OnIPCExecuteRequest handlers. Access appears to rely on local machine access, Windows process/service boundaries, and any Designer-side permission checks before issuing commands.

IPC Action Catalog

IPC action	Purpose	Request	Response	Authentication	Service support	Source
EnableService	Enables the Velox service runtime.	Action=EnableService; request ID is a new GUID.	Status boolean. Velox Service updates gSetup.ServiceState and synchronises managers.	No handler-level auth found.	Implemented in VeloxService; branch exists but no response behavior found in VeloxAPIService.	Classes/Tools/vxIPC.pas, VeloxService/classMain.pas, VeloxAPIService/classMain.pas
DisableService	Disables the Velox service runtime.	Action=DisableService; request ID is a new GUID.	Status boolean. Velox Service disables managers and waits/frees executing items.	No handler-level auth found.	Implemented in VeloxService; branch exists but no response behavior found in VeloxAPIService.	Same as above
ChangeAction	Synchronises an action or transport after configuration changes.	Action=ChangeAction, request ID is action GUID, ExecutionType, ModuleType.	Status boolean.	No handler-level auth found.	Implemented in VeloxService; VeloxAPIService returns Status=True but reviewed branch does not resynchronise a REST action.	Same as above
EnableAction	Enables a service-managed action.	Action=EnableAction, request ID is action GUID, ExecutionType, ModuleType.	Status boolean.	No handler-level auth found.	Implemented in VeloxService; branch exists but no response behavior found in VeloxAPIService.	Same as above
DisableAction	Disables a service-managed action.	Action=DisableAction, request ID is action GUID, ExecutionType, ModuleType.	Status boolean.	No handler-level auth found.	Implemented in VeloxService; branch exists but no response behavior found in VeloxAPIService.	Same as above
ActionStatus	Gets runtime status for schedule or monitor flow.	Action=ActionStatus, request ID is action GUID, ExecutionType.	Status, ActionStatus, LastRunTime, NextRunTime, PendingFiles.	No handler-level auth found.	Implemented for schedule/monitor in VeloxService. Not implemented in reviewed VeloxAPIService handler.	Same as above
EndTask	Requests termination/end of a schedule or monitor task.	Action=EndTask, request ID is action GUID, ExecutionType.	Status boolean.	No handler-level auth found.	Implemented for schedule/monitor in VeloxService. Not implemented in reviewed VeloxAPIService handler.	Same as above
RequestTaskCount	Returns active runtime item counts.	Action=RequestTaskCount; request ID is a new GUID.	Status, ScheduleCount, FileMonitorCount, TransportInCount, TransportOutCount, RESTCount.	No handler-level auth found.	Implemented in both services. Velox Service reports REST count as 0; API Service reports gRESTManager.RESTItemCount and zeros for other counts.	Same as above
DBConDetails	Returns database connection pool details.	Action=DBConDetails; request ID is a new GUID.	Status, TextDetails.	No handler-level auth found.	Implemented in VeloxService. Not implemented in reviewed VeloxAPIService handler.	Same as above
SysConDetails	Returns system connection pool details.	Action=SysConDetails; request ID is a new GUID.	Status, TextDetails.	No handler-level auth found.	Implemented in VeloxService. Not implemented in reviewed VeloxAPIService handler.	Same as above
MemoryDump	Returns diagnostic bug report text.	Action=MemoryDump; request ID is a new GUID.	Status, TextDetails.	No handler-level auth found.	Implemented in VeloxService. Not implemented in reviewed VeloxAPIService handler.	Same as above

IPC Example

The IPC API is not HTTP. Requests are Cromis IPC data messages. Conceptual request for action status:

ServerName = "VeloxService" + <ConfigKey> + <TestSuffix>
Request.Id = <ActionFID>
Request.Data["Action"] = "ActionStatus"
Request.Data["ExecutionType"] = Ord(fstSchedule)

Response.Data["Status"] -> Boolean
Response.Data["ActionStatus"] -> Integer/string enum value
Response.Data["LastRunTime"] -> DateTime
Response.Data["NextRunTime"] -> DateTime
Response.Data["PendingFiles"] -> Integer

Conceptual request for API service REST endpoint count:

ServerName = "VeloxAPIService" + <ConfigKey> + <TestSuffix>
Request.Id = <new GUID>
Request.Data["Action"] = "RequestTaskCount"

Response.Data["Status"] -> Boolean
Response.Data["RESTCount"] -> Integer

Script-Facing REST APIs

REST flows can access the current HTTP request and response from Pascal Script through Request and Response functions registered by TvxScripter.

This is an internal runtime API, not a public HTTP endpoint.

Request API

API	Purpose	Request	Response	Authentication	Source
Request: TvxAPIRequest	Returns the current REST request object for the executing flow.	Called from script during REST flow execution.	TvxAPIRequest instance for the current request.	Inherits the inbound REST request context. No additional auth check found.	Classes/vxScripter.pas, Scripting/Imports/VxClasses/uPSI_vxAPIStream.pas
TvxAPIRequest.Content	Exposes request body stream.	Script reads stream.	TStream.	Same as request context.	Classes/Tools/vxAPIStream.pas
TvxAPIRequest.ContentString	Exposes request body as decoded string.	Script reads property.	String decoded from raw content and content type.	Same as request context.	Classes/Tools/vxAPIStream.pas
TvxAPIRequest.HTTPMethod	Exposes request method as TvxHTTPMethod.	Script reads property.	Method enum mapped from Indy method type.	Same as request context.	Classes/Tools/vxAPIStream.pas

Script-visible request properties imported in uPSI_vxAPIStream.pas include:

HTTPMethod, Method, CookieFields, QueryFields, ProtocolVersion, URL, Query,
PathInfo, PathTranslated, Authorization, CacheControl, Cookie, Date, Accept,
From, Host, IfModifiedSince, Referer, UserAgent, ContentEncoding, ContentType,
ContentLength, ContentVersion, RawContent, Content, ContentString, Connection,
DerivedFrom, Expires, Title, RemoteAddr, RemoteHost, ScriptName, ServerPort,
RawPathInfo, RemoteIP

Response API

API	Purpose	Request	Response	Authentication	Source
Response: TvxAPIResponse	Returns the current REST response object for the executing flow.	Called from script during REST flow execution.	TvxAPIResponse instance for the current response.	Inherits the inbound REST request context. No additional auth check found.	Classes/vxScripter.pas, Scripting/Imports/VxClasses/uPSI_vxAPIStream.pas
TvxAPIResponse.ContentString	Sets or reads response body content.	Script writes/reads property.	Response body sent by WebBroker/Indy.	Same as request context.	Scripting/Imports/VxClasses/uPSI_vxAPIStream.pas
TvxAPIResponse.Content	Sets or reads response content stream.	Script writes/reads stream.	Response content stream.	Same as request context.	Scripting/Imports/VxClasses/uPSI_vxAPIStream.pas
TvxAPIResponse.SetCookieField	Sets a response cookie field.	Script method call.	Cookie header behavior through response object.	Same as request context.	Scripting/Imports/VxClasses/uPSI_vxAPIStream.pas
TvxAPIResponse.SetCustomHeader	Sets a custom response header.	Script method call.	Header added to response.	Same as request context.	Scripting/Imports/VxClasses/uPSI_vxAPIStream.pas

Script-visible response properties imported in uPSI_vxAPIStream.pas include:

Version, ReasonString, Server, WWWAuthenticate, Realm, Allow, Location,
ContentEncoding, ContentType, ContentVersion, DerivedFrom, Title, StatusCode,
ContentLength, Date, Expires, LastModified, CustomHeaders, FreeContentStream,
ContentString, Content

Script Example

var
  Body: string;
begin
  Body := Request.ContentString;

  Response.ContentType := 'application/json';
  Response.StatusCode := 200;
  Response.ContentString := '{"ok":true}';
end.

Exact script behavior depends on the flow, request data definition, response data definition, and modules used inside the flow.

Outbound HTTP/API Client Behavior

Velox contains HTTP client and transport code for outbound integrations, including Classes/Tools/vxHTTP.pas and HTTP transport classes. These do not define fixed Velox-hosted endpoints. Instead, destination URLs, methods, authentication, payloads, and response handling are configured by the relevant transport/module/script.

Because the request asks for endpoint-level API documentation, outbound APIs are documented here as a configurable integration capability rather than a fixed endpoint catalog.

API surface	Purpose	Request	Response	Authentication	Source
HTTP transport/client modules	Call external HTTP APIs from Velox flows/transports.	Configured URL, method, headers, body, and data definitions.	External API response consumed by transport/module logic.	Configured per transport/module/script. Exact options should be read from the transport documentation and setup code.	Classes/Tools/vxHTTP.pas, transport classes

Dependency Graph

High-Level Data Flow

Unclear or Not Found

The following points were not determinable from the reviewed source code:

• No dedicated WebHook subsystem was found.
• No central REST authentication/authorization enforcement was found in the reviewed dispatch path.
• RESTAllowAnonymous is stored and edited, but runtime enforcement was not found.
• Generated OpenAPI security schemes are not matched by runtime enforcement in the reviewed dispatcher.
• TvxRESTItem.WebActionHandler dispatches based on the actual request method and only handles GET/POST; it does not visibly compare the request method with the flow's configured RESTMethod.
• Runtime behavior for unsupported HTTP methods is unclear because no explicit response handling was found after the GET/POST switch.
• VeloxAPIService IPC branches for service/action enable/disable exist but do not show response behavior in the reviewed handler.
• -u and -p service command-line accessors exist, but no active usage was found in the reviewed startup code.
• SSL/TLS configuration fields exist, but complete runtime certificate binding behavior was not confirmed from the reviewed API service startup path.