Architecture and Features

Architecture and Features

System architecture

Chat4Openapi is a single FastAPI and Vue deployment backed by SQLite:

• FastAPI backend provides administration endpoints, browser chat, compatible model APIs, Tool execution, authentication, and static frontend delivery.
• Vue frontend provides the English and Simplified Chinese administration interface and browser chat.
• SQLite and Alembic store application state and apply schema migrations.
• Imported API sources turn Swagger 2.0 or OpenAPI 3.x operations into managed Tools.
• Skills organize explicitly selected Tools and instructions into reusable catalogs.
• Agents bind a provider, model settings, prompt, iteration limit, and an ordered list of Skills.

The main runtime flow is:

1. Import an API source and review the generated Tools.
2. Enable only trusted sources and Tools.
3. Create Skills and bind the required Tools.
4. Configure an OpenAI-compatible or Anthropic-compatible provider.
5. Create an Agent, bind its ordered Skills, and enable it.
6. Use the Agent through browser chat or a compatible API.

Administration model

The first-run wizard creates the sole backend administrator. Usernames are 3-128 characters using letters, numbers, ., _, or -; passwords are 6-256 characters.

Administrator state uses secure HTTP-only cookies. Every administrator mutation also requires the CSRF token supplied by the application.

An Agent can be enabled only when it has an available provider and at least one running bound Skill. Exactly one enabled Agent may be selected as the default. The current default cannot be disabled or deleted until another Agent becomes default.

Stopped Skills remain bound and visible but cannot load at runtime. An Agent can load only its own running bound Skills, in their configured order.

Tools and Skills

The Tools page supports persistent row selection across search, filters, and disclosure changes. Select visible affects only rendered rows. Bulk enable, disable, and soft delete operations accept 1-200 unique positive IDs and return ordered partial results, allowing failed items to remain selected for retry.

Tool parameter overrides may change descriptions and examples only. Imported names, types, required state, parameter location, and execution mappings remain authoritative.

Skills use a full-catalog index for source, Swagger tag, enabled state, name, description, path, and tag search. Ordinary matches render in batches of 100, while unavailable existing bindings remain visible for removal. Each Skill can bind at most 128 Tools.

Typing @ in a Skill prompt searches eligible Tools and inserts the canonical {{tool:name}} reference. Disabled, login, or source-disabled Tools cannot be newly bound or referenced.

Browser chat

Browser chat uses a high-entropy HTTP-only cookie for its public browser subject. This identity is separate from the administrator session and Agent API keys.

A new chat lists runnable Agents and initially selects the default Agent. After the first message, the Agent is locked for that conversation; starting a new chat allows another selection.

History is stored under the browser subject and contains the Agent snapshot, messages, loaded-Skill display state, and server conversation ID. It never stores Agent API keys, Tool Session tokens, or injected credentials. Historical inactive Agents remain visible but cannot be selected for a new conversation.

human_in_loop may request missing or ambiguous business input. It does not approve Tool calls or perform authentication. Compatible API requests always run non-interactively.