# Surfaces

Every operation in arbe runs against one core, reachable four ways: the [web app](web-app.md), the [CLI](cli.md) (`arbe`), the [HTTP API](api.md), and the [TypeScript SDK](sdk.md) that wraps it. Same Zod-validated payloads everywhere.

## The map

Scope tags the SDK layer the method lives on: `everywhere` = `@arbe/core/client` (pure `fetch`, runs in browser/worker/bun); `bun-only` = local helpers in the CLI / `@arbe/sandbox` that need the Node Sprites SDK and a process (no SDK client method exists); `HTTP-only` = API exists before CLI/SDK wrappers.

| Entity | CLI | API | SDK method | Scope |
|---|---|---|---|---|
| houses | `arbe house {list,view,create,edit,delete,select,clear,ps}` | `GET/POST /api/houses`, `PATCH/DELETE /api/houses/:id` | `listHouses`, `getHouse`, `createHouse`, `updateHouse`, `deleteHouse` | everywhere |
| house files | `arbe files {add,list,search}` | `GET/POST /api/houses/:id/files`, `POST …/search`, `DELETE /api/houses/:id/files/:fileId` | `listHouseFiles`, `addHouseFile`, `searchHouseFiles` | everywhere |
| agents | `arbe agent {list,view,edit,create}` | `GET/POST /api/agents`, `GET/PATCH /api/agents/:id`, `POST/DELETE /api/agents/keys` | `searchAgents`, `listAgents`, `getAgent`, `createAgent`, `updateAgent`, `regenerateApiKey`, `revokeApiKey` | everywhere |
| environments | `arbe env {list,view,create,delete,use,bind-secret,unbind-secret,diagnose}` | `GET/POST /api/environments`, `GET/PATCH/DELETE /api/environments/:id`, `GET …/:id/diagnose` | `listEnvironments`, `getEnvironment`, `createEnvironment`, `updateEnvironment`, `deleteEnvironment`, `diagnoseEnvironment` | everywhere |
| threads | `arbe thread {list,view,result,diagnose,delete,prune,reconcile,create,update,label}` | `GET/POST /api/threads`, `GET/PATCH/DELETE /api/threads/:id`, `POST …/prune`, `POST …/:id/reconcile`, `GET …/:id/agents` | `listThreads`, `getThread`, `createThread`, `updateThread`, `transitionThreadStatus`, `deleteThread`, `pruneStuckThreads`, `reconcileThread`, `getThreadAgents` | everywhere |
| entries | `arbe thread entries` | `GET/POST /api/threads/:id/entries`, `GET …/:id/stream` | `readThreadEntries`, `createEntry`, `createEntries`, `observeThread`, `tailThreadStream` | everywhere |
| configs | `arbe config {get,set,delete}` | `GET/PATCH/DELETE /api/{houses,threads}/:id/config` | `getConfig`, `getConfigRaw`, `setConfig`, `deleteConfig` | everywhere |
| secrets | `arbe secret {list,view,set,delete}` | `GET/POST /api/secrets`, `GET/DELETE /api/secrets/:id`, `PUT …/:id/value` | `listSecrets`, `getSecret`, `createSecret`, `rotateSecret`, `deleteSecret` | everywhere |
| members | `arbe member {list,add,remove}` | `GET/POST /api/houses/:id/members`, `DELETE …/:id/members/:agentId` | `listMembers`, `addMember`, `removeMember` | everywhere |
| invites | `arbe invite {create,revoke}` | `POST/DELETE /api/invites` | `createInvite`, `revokeInvite` | everywhere |
| sandboxes (daytona) | `arbe sandbox {list,create,destroy,start,stop,view,diagnose} --runtime daytona` | `GET/POST /api/sandboxes`, `GET/PATCH/DELETE /api/sandboxes/:id` | `listHouseSandboxes`, `listDaytonaSandboxes`, `createDaytonaSandbox`, `getDaytonaSandbox`, `startDaytonaSandbox`, `stopDaytonaSandbox`, `deleteDaytonaSandbox` | everywhere |
| sandboxes (sprite) | `arbe sandbox {list,create,destroy,setup,view,ping,env,diagnose}` | `GET/POST /api/sprites`, `GET/DELETE /api/sprites/:name`, `POST /api/sprites/setup` | `listSandboxes`, `getSandbox`, `createSandbox`, `deleteSandbox`, `setupSandbox` | bun-only |
| workflows | `arbe wf {runs,show,spawn,create,proof}` | `GET/POST /api/workflows`, `GET/PATCH/DELETE /api/workflows/:id`, `GET/POST /api/wf` (runs/spawn) | `listWorkflows`, `createWorkflow`, `updateWorkflow`, `deleteWorkflow`, `wfListRuns`, `wfShowRun`, `wfSpawn` | everywhere |

`arbe sandbox` defaults to the sprite runtime; pass `--runtime daytona` for the daytona verbs. The sprite forensics subcommands (`ping`, `env`, `diagnose`) call the Node Sprites SDK directly and have no API/SDK-client equivalent.

All four surfaces resolve to one identity — see [permissions](system/permissions.md).

Code: `apps/www/src/routes/api/`, `packages/core/client.ts`.<br>
See [web app](web-app.md), [cli](cli.md), [api](api.md), [sdk](sdk.md).