Directory API (gRPC)

src/grpc.rs exposes echo over gRPC so a website or backend can read the directory and manage accounts without touching IRC. The schema is proto/echo.proto. It is off unless you set [grpc]; every call carries a bearer token, and the transport can be TLS.

Four services share the one port.

Directory (read)

Mirror the account and channel directory into your own store.

Snapshot returns the current accounts and channels for the initial load.
Subscribe streams every change from that point on.

It rides the same committed-entry channel gossip uses, so a change reaches a subscriber in the same push, with no polling. It carries identity and metadata only: anything credential-shaped (password hashes, SCRAM verifiers, cert fingerprints) and the finer channel-ops events are left out.

The usual pattern is Snapshot once, then hold Subscribe open and apply each event as it arrives.

Accounts (write)

Manage accounts the way a NickServ user does, minus the command syntax, for a trusted backend that has already done its own login or session check.

Register, Provision, Authenticate, SetPassword, SetEmail, Confirm, Drop, ForceLogout, GroupNick, UngroupNick.

The bearer token is the authorization. Unlike the NickServ commands these mirror, most calls do not re-check the account's own password (an admin-level override); Register and Authenticate are the exceptions, since the password is the input there. Provision creates an already-confirmed account in one step, for a site that ran its own signup. A write committed this way replicates to every other node exactly like an IRC-originated one.

Pair this with [auth] external = true to let the website own account identity while echo owns channels, vhosts, and bans, keyed by the account name.

Stats and Admin

Stats (Get) returns the flat, namespaced counter map every service contributes to (the same numbers /metrics exposes), for a status page.
Admin (Version, Rehash, and other operational calls) drives the daemon from a trusted control plane.

Transport

Every call is bearer-token authenticated. TLS is optional and server-side only (a subscriber is a website backend, not a federation peer, so no client certificate is required). Keep the port on a private or loopback hop.