API

argocd-server exposes a single API surface in three flavors:

• gRPC over HTTP/2 — the canonical wire protocol.
• gRPC-Web — for browser and HTTP/1.1 proxies.
• REST — auto-generated from the proto via gRPC-Gateway, commonly under /api/v1/....

All three share the same proto definitions.

Service surface

Each server/<group>/ directory contains its own *.proto and Go implementation. The CLI client is generated under pkg/apiclient/<group>/.

Service	Proto	Implementation
ApplicationService	server/application/application.proto	server/application/application.go
ApplicationSetService	server/applicationset/...	server/applicationset/
ProjectService	server/project/...	server/project/
RepositoryService	server/repository/repository.proto	server/repository/repository.go
RepoCredsService	server/repocreds/...	server/repocreds/
ClusterService	server/cluster/...	server/cluster/
AccountService	server/account/...	server/account/
SessionService	server/session/session.proto	server/session/session.go
SettingsService	server/settings/...	server/settings/
CertificateService	server/certificate/...	server/certificate/
GPGKeyService	server/gpgkey/...	server/gpgkey/
NotificationService	server/notification/...	server/notification/
VersionService	server/version/...	server/version/

Plus several REST-only or special-purpose endpoints:

• /api/webhook — incoming webhooks (util/webhook/webhook.go).
• /api/badge — sync/health badge SVGs (server/badge/badge.go).
• /api/v1/stream/applications — server-sent events stream (server/broadcast/).
• /api/v1/extensions/* — UI extensions proxy (server/extension/extension.go).
• /api/v1/account/can-i — RBAC capability lookup.
• /metrics — Prometheus metrics on a separate listener.

Authentication

Every API request must be authenticated unless --disable-auth is set (dev-only). Mechanisms:

• Authorization: Bearer <jwt> header — issued by argocd login, by argocd account generate-token, or by argocd proj role create-token.
• A session cookie set by the OIDC flow.
• TLS client certs (when configured).

JWT verification is in util/jwt/. Session management is in util/session/ and server/session/. RBAC enforcement happens in server/rbacpolicy/ using the Casbin engine in util/rbac/.

Streaming RPCs

Several services use server-streaming RPCs:

• ApplicationService.Watch — stream Application updates.
• ApplicationService.PodLogs — stream pod logs.
• ApplicationService.PodExec — bidirectional WebSocket terminal (server/application/terminal.go, websocket.go).
• RepositoryService.GetHelmCharts — large list streaming.

CLI as a reference client

The argocd CLI is the canonical Go client for the API. Reading cmd/argocd/commands/app.go is often the quickest way to learn how a particular RPC is invoked. The auto-generated clients live under pkg/apiclient/<service>/.

Rate limiting

Rate limiting at the controller side uses pkg/ratelimiter/ratelimiter.go. The API server itself relies on standard grpc-go flow control plus per-request authentication checks.

See also

• argocd-server — the host runtime and request pipeline.
• argocd CLI — the canonical client.
• features/sso-and-rbac — how authentication and RBAC plug into requests.