OpenAPI Endpoint Inventory

The route surface the api exposes per domain service — the source the OpenAPI spec and generated SDK are built from.

The route surface the api exposes, per domain service. This is the source the OpenAPI spec + generated SDK (packages/sdk) are built from. REST, versioned under /api/v1, all tenant-scoped via the JWT (no tenant id in the path). Fill in request/response bodies as services land (M0+).

Conventions

Auth: Authorization: Bearer <jwt> (claims tid/sub/role/cell). 401/403 with a reason code.
Pagination: cursor (?cursor=&limit=). Filtering: documented per list endpoint.
?asOf=<ISO8601> on read endpoints caps ingested_at/observed_at (bitemporal).
Errors: { error: { code, message } }; never leak internals.

canonical

GET   /observations            ?entity&property&since&until&bbox&cursor&asOf
GET   /observations/:id
GET   /entities                ?type&q&risk&cursor
GET   /entities/:id            (inspector payload: attrs, aliases, recent obs/events)
GET   /events                  ?entity&case&kind&since&cursor

cases & reports

GET   /cases                   ?status&priority&owner&cursor
POST  /cases                   { title, priority, hypothesis }
GET   /cases/:id               (bound events+entities, timeline)
PATCH /cases/:id               { status?, priority?, hypothesis? }
POST  /cases/:id/bindings      { ref_type, ref_id }
GET   /reports                 ?status&cursor
POST  /reports                 { title, origin, derived_from? }   → DRAFT
PATCH /reports/:id             { body? , title? }
POST  /reports/:id/publish     (PRIVILEGED — Q8, step-up MFA; sets signed_by/at)

agents & chat

POST  /chat/messages           { thread_id?, text, scope:{case?,entity?,asOf?} }  → SSE stream
GET   /chat/threads            ?cursor
POST  /agents/ontology/profile { source_id }                     → proposed mapping (Q9)
POST  /agents/run              { agent, input }                  (adjudicator/after-action; async → proposal)

autonomy (product §13)

GET   /watches                 ?cursor
POST  /watches                 { name, condition, output_kind }
GET   /proposals               ?status=needs-review&cursor
POST  /proposals/:id/decide    { decision: accept|modify|reject, patch? }   (Q10)
GET   /evals                   (trust/defensibility scorecard)

sources & ingestion

GET   /sources                 (catalog + status)
POST  /sources/onboard         { connector, config }             (Ontology Agent wizard backend)
POST  /sources/:id/test

admin (tenant)

GET   /members ; POST /members/invite ; PATCH /members/:id/role   (PRIVILEGED)
GET   /settings ; PATCH /settings

realtime

WS    /realtime                (subscribe to t:<tid> channels; payloads are cache-invalidation hints — backend/61)

control plane (separate service, owner-only; not part of tenant api)

See 62 + 83 for: /tenants (list/provision/suspend/decommission), /tenants/:id (detail), /billing, /incidents, /audit, /team, /breakglass.

Gaps to close

Define request/response schemas + the OpenAPI document location and the SDK-gen step (who runs it, when — CI on merge).
Confirm filtering/sorting params per list endpoint.

OpenAPI Endpoint Inventory

On this page