diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md
index 639bbdec..c5e59c09 100644
--- a/docs/web-ui/dashboard.md
+++ b/docs/web-ui/dashboard.md
@@ -193,7 +193,7 @@ each row keeps its `logs →` link out to the full L0GS history.
 **K3PT ST4T3** — destroyed-but-state-kept tombstones (size +
 age + claude-creds badge). Two actions: `⊕ R3V1V3` (queues a
 Spawn approval; existing state is reused), `PURG3` (wipes
-state + applied dirs; `POST /purge-tombstone/{name}`).
+state + applied dirs; `POST /api/purge-tombstone/{name}`).
 
 **C0NT41N3R L04D** — live CPU + memory per agent container, read
 straight from cgroup v2 on the host (`cpu.stat`, `memory.current`,
@@ -581,7 +581,7 @@ in and force awkward narrow-column wraps. `min-width: 0` keeps
 than its container. Sticky-bottom auto-scroll + "↓ N new" pill. Below the
 stream sits a terminal-style compose box: `@name` picks the recipient
 (sticky via localStorage; auto-complete from the live container list,
-Tab/Enter to confirm; `@*` broadcasts). `POST /op-send` drops
+Tab/Enter to confirm; `@*` broadcasts). `POST /api/op-send` drops
 `{from:"operator", to, body}` into the broker; the resulting SSE frame
 re-renders the terminal row. Manager is addressed as `@root`.
 
@@ -1007,10 +1007,10 @@ that's a browser-level decision, not ours.
 
 ## Dashboard endpoints
 
-- `POST /approve/{id}` — approve a pending approval. Fires
+- `POST /api/approve/{id}` — approve a pending approval. Fires
   `ApprovalResolved` on the dashboard event channel; client
   updates derived approvals state from the event.
-- `POST /deny/{id}` (`note=<reason>`, optional) — deny a pending
+- `POST /api/deny/{id}` (`note=<reason>`, optional) — deny a pending
   approval with an optional operator-supplied reason. The reason
   travels to the manager as `HelperEvent::ApprovalResolved.note`
   and also rides on the dashboard's `ApprovalResolved` event.
@@ -1018,14 +1018,14 @@ that's a browser-level decision, not ours.
   click — a resizable `<textarea>` where Enter submits and
   Shift+Enter inserts a newline (so multi-sentence rejection
   notes are possible).
-- `POST /{rebuild,kill,restart,start,destroy}/{name}` — lifecycle.
+- `POST /api/{rebuild,kill,restart,start,destroy}/{name}` — lifecycle.
   `destroy` accepts `purge=on` to also wipe state dirs.
-- `POST /purge-tombstone/{name}` — wipe a tombstone's state dirs.
-- `POST /answer-question/{id}` — answer a pending operator question.
-- `POST /cancel-question/{id}` — cancel a pending question with
+- `POST /api/purge-tombstone/{name}` — wipe a tombstone's state dirs.
+- `POST /api/answer-question/{id}` — answer a pending operator question.
+- `POST /api/cancel-question/{id}` — cancel a pending question with
   the sentinel `[cancelled]`. Same code path as a real answer.
-- `POST /request-spawn` — queue a Spawn approval.
-- `POST /update-all` — rebuild every stale container.
+- `POST /api/request-spawn` — queue a Spawn approval.
+- `POST /api/update-all` — rebuild every stale container.
 - `POST /api/rebuild-queue/{id}/cancel` — drop a `Queued` entry.
   Refuses `Running` / terminal-state entries (in-flight
   rebuilds can't be safely interrupted). Always 200; body is
@@ -1043,7 +1043,7 @@ that's a browser-level decision, not ours.
   `{ messages: [{ id, from, body, at, in_reply_to, file_refs }, …] }`,
   newest-first. Reuses `/api/agent/operator/mark-all-read` to ack (filters
   are identical so every listed row is exactly what mark-read clears).
-- `POST /op-send` (`to=<name>`, `body=<text>`) — drop an
+- `POST /api/op-send` (`to=<name>`, `body=<text>`) — drop an
   operator-authored message into `<name>`'s inbox. `to=*` fans
   out to every registered agent. Returns 200; the broker
   `Sent` event re-renders the message-flow terminal without a