Enable, prove, and call the Forge API

Add --api to the active launcher arguments and fully restart Forge. Then open /docs on the running address and confirm that POST /sdapi/v1/txt2img appears. The presence of /docs alone is not proof because the Gradio server exposes other routes without the core API.

With the normal UI plus --api, use the same local server, normally http://127.0.0.1:7860. With --nowebui and no explicit --port, the inspected code uses http://127.0.0.1:7861. A custom --port replaces those defaults.

The usual cause is that the running process did not receive --api. Confirm the printed launch arguments, close the full process, restart through the launcher you edited, then search /docs again. If --nowebui is active, check port 7861 unless you set --port.

Yes. Send JSON to POST /sdapi/v1/txt2img with Content-Type: application/json. Start with a small request, save the JSON response, verify that images[0] exists, and decode that base64 value to a file.

The txt2img response model contains an images array of base64 strings plus parameters and info. Decode the first string before opening it as an image. Setting send_images to false intentionally returns no encoded images.

No. In the inspected request model, send_images controls whether image strings are returned, while save_images controls whether Forge writes samples and grids through its own output path. They are separate switches.

Query /sdapi/v1/samplers and /sdapi/v1/schedulers on the running instance and send an exact returned name. Do not copy a name from a different build or fork. An unknown sampler is rejected by the core API.

For the first proof, select and test the model in the UI before calling txt2img. The API exposes /sdapi/v1/sd-models, /sdapi/v1/sd-modules and mutable settings, but checkpoint and companion-module changes affect shared process state and need an exact-build test before concurrent use.

Current code exposes the same txt2img processing model and module inventory used by Forge, but a universal FLUX payload is not verified here. Community reports show commit- and module-dependent behavior around checkpoint, VAE and text-encoder selection. Prove one working FLUX setup in the UI, record every module, then test the same commit through the API.

A shorter API payload leaves many fields at code defaults and may omit scripts, always-on extensions, model/module state, Hires. fix controls, styles, or other UI values. Compare the returned info and parameters with the PNG metadata from a UI baseline before adding fields.

Generation paths use a shared queue lock in the inspected core API, so requests can wait rather than execute as independent GPU jobs. Options and model state are also shared. Serialize model-changing operations in your client and treat progress as global process state.

FastAPI rejected the request shape or a script name/argument failed validation. Read the response detail, compare the body with the schema shown by your own /docs page, and remove optional fields until the minimal payload passes.

The process was started with --api-auth and the request did not supply a matching HTTP Basic username and password. Add curl -u user:password or the equivalent client setting. Do not place real credentials in screenshots, shell history, or source control.

No. CORS tells browsers which web origins may read a response. It does not stop curl, Python, another server, or a non-browser client. Use it only for a browser integration and keep access control as a separate boundary.

This guide does not certify direct public exposure. The core API can change settings, inspect paths and extensions, generate costly work, and optionally stop the server. Keep the first deployment on loopback; any network deployment needs an independently reviewed access, TLS, firewall, logging, and extension-route design.

The inspected helper adds HTTP Basic auth to the 37 routes registered through the core Api class. Built-in and third-party extensions can register routes separately, so this page does not claim that --api-auth protects every route on the server. Inspect the actual /openapi.json and extension code.

Open /docs for interactive Swagger documentation or fetch /openapi.json from the running server. Treat that runtime schema as the inventory for your exact commit and enabled extensions; the ledger on this page covers only the inspected core Api class.