API Documentation

Browser admin session

The /tokens page uses the login session cookie. Configure ADMIN_USERNAME, ADMIN_PASSWORD, and SESSION_SECRET before browser login is available.

Bootstrap admin key

Initial admin automation can use header x-bootstrap-admin-key with the value from BOOTSTRAP_ADMIN_KEY. Use it only to create the first scoped admin token or recover access.

Admin bearer scopes

admin:tokens manages tokens. admin:functions manages function state. Function runners should use only function:run.

Request body

{
  "function": "regex.replace",
  "input": {
    "input": "Order 123 ships on 2026-06-22",
    "pattern": "\\d+",
    "flags": "g",
    "replacement": "#"
  }
}

Success response

{
  "ok": true,
  "data": {
    "result": "Order # ships on #-#-#",
    "count": 4
  },
  "meta": {
    "function": "regex.replace"
  }
}

regex.match

Returns matched and a matches array. Without g, only the first match is returned. Withg, all matches are returned.

regex.replace

Requires replacement. Returns result and count. Without g, replacement changes only the first match.

replacement is the text written back for each match. Use a literal value like X, an empty string to delete matches, or JavaScript replacement tokens:$1 for the first capture group, $& for the full match, $<name> for a named group, and $$ for a literal dollar sign.

regex.split

Returns parts and count after splitting input by a regex separator. Use it for comma-or-semicolon lists, whitespace-delimited values, and line-based field cleanup.

regex.validate

Returns valid after checking whether the entire input matches the pattern. This is stricter thanregex.match, which can succeed on a substring.

regex.extract

Returns captures. Each item includes match, positional groups, and namedGroups for patterns like (?<id>\d+).

regex.replaceMany

Applies ordered replacement rules and returns the finalresult, total count, and per-rule counts. Use it to combine several Power Automate cleanup steps into one HTTP action.

Create body

{
  "name": "Power Automate Flow",
  "scopes": [
    "function:run"
  ]
}

Scope selection

• function:run for Power Automate and runtime API callers.
• admin:tokens for token automation.
• admin:functions for function state management.

Which endpoint should I use?

Use /api/v1/run for a consistent long-term contract. Use regex convenience endpoints when the caller benefits from a flatter body.

Why did replace change only one match?

Add g to flags. Regex replacement changes only the first match without the global flag.

How do I use lookaround?

Add engine: "js" for JavaScript-only regex syntax. The default Rust engine is safer for untrusted patterns but does not support lookaround or backreferences.

Can I expose admin scopes to a Flow?

Avoid it. Most Flows need only function:run. Keep admin scopes for operational tooling and recovery.

How do I discover available parameters?

Use GET /api/v1/functions or this page. The function list includes the same input schema shown here.

Why is an older token not visible?

Tokens created before visible token storage kept only a hash. Hashes cannot be reversed, so create a replacement token if an older plaintext value is missing.