{"service": "core-service", "version": "0.56.348+gd51d2ee29d00", "endpoints": {"healthz": "GET /healthz", "capabilities": "GET /api/v1/capabilities.json (the GENERATED machine-readable capability manifest: every route's method/path/authz-relation/terminal-states as machine tokens \u2014 the same key set as this index)", "inspect_org": "GET /api/v1/external/orgs/{id}", "create_org": "POST /api/v1/external/orgs", "teardown_org": "DELETE /api/v1/external/orgs/{id}", "compose_fabric": "POST /api/v1/external/orgs/{id}/fabric [{roles: [...] | blueprint: \"bp-a\"}] \u2014 composes EXACTLY the declared role set (empty org composes nothing; a blueprint is explicit-only)", "inspect_fabric": "GET /api/v1/external/orgs/{id}/fabric", "scale_role_fleet": "POST /api/v1/external/orgs/{id}/roles/{role}/scale", "teardown_role_fleet": "DELETE /api/v1/external/orgs/{id}/roles/{role}", "org_approval_policy": "GET|POST /api/v1/external/orgs/{id}/approval-policy (org-chairman session)", "provision_tenant": "POST /api/v1/external/tenants (X-Provision-Key)", "inspect_tenant": "GET /api/v1/external/tenants/{id}", "list_tenants": "GET /api/v1/external/tenants", "scale_tenant": "POST /api/v1/external/tenants/{id}/scale", "teardown_tenant": "DELETE /api/v1/external/tenants/{id-or-name} (tenant's OWN key, or operator X-Provision-Key to reclaim any)", "list_my_orgs": "GET /api/v1/external/orgs", "console": "GET /console/app/ (the platform web app; /console/ 308s to it)", "observability_rollup": "GET /api/v1/external/observability/rollup?level=org|tree&node=<own-org-id>", "customer_holder_admission": "POST /api/v1/external/holder/sessions (X-Provision-Key | platform session) \u2014 mint a tenant-less HOLDER session bound to a first-party portfolio root org (operator-invited; fail-closed)", "customer_holder_placement": "POST /api/v1/external/holder/placements (X-Provision-Key | platform session) \u2014 link a placed org into a holder's org-of-orgs subtree (the SAME parent_org_id adjacency; fail-closed)", "customer_holder_portfolio": "GET /api/v1/external/holder/portfolio (holder session) \u2014 the portfolio home: the holder's placed org-of-orgs subtree, each org OpenFGA-checked and down-scoped", "customer_strategy": "GET|PUT /api/v1/external/orgs/{id}/strategy (can_operate) \u2014 compatibility projection over the kind='strategy', scope='company' governance document", "customer_policy": "GET|PUT /api/v1/external/orgs/{id}/policy (can_operate) \u2014 compatibility projection over the kind='policy', scope='company' governance document", "customer_policy_history": "GET /api/v1/external/orgs/{id}/policy/history (subtree_reader) \u2014 the merged company-scope strategy+policy version chain", "customer_documents": "GET /api/v1/external/orgs/{id}/documents (the tenant's OWN document set, role-filtered; tenant-scoped, three-zone) | POST \u2026/documents (create; capability-gated: the customer edits user-managed, the fleet's roles write agent-managed)", "customer_document": "GET|PUT /api/v1/external/orgs/{id}/documents/{doc_id} (read + body | append a new version; capability-gated)", "customer_document_history": "GET /api/v1/external/orgs/{id}/documents/{doc_id}/history (the append-only version chain) | GET \u2026/history/{version} (retrieve one prior version's body)", "customer_roles": "GET /api/v1/external/orgs/{id}/roles (can_operate|member) \u2014 the org's OWN declared role set resolved through the ONE role-type registry; each row carries name \u00b7 description \u00b7 the library `suggestion` (the \"why this role\" line) \u00b7 the neutral declaration `state` (card t_b42b86f0; spec roles-in-the-console \u00a75). GET-only; the operator role chart is untouched", "customer_document_set": "GET /api/v1/external/orgs/{id}/document-set (can_operate|member) \u2014 the org's declared document set: per declared role, its `documents:` entries resolved to the shipped address, plus the platform base company documents (card t_f4f56b95; spec role-declared-document-sets \u00a74.6/\u00a75). GET-only; a projection over the ONE role-type registry (no new store, no second registry)", "customer_kanban": "GET /api/v1/external/orgs/{id}/kanban[/boards/{bid}[/tasks]] (subtree_reader)", "customer_chat": "POST /api/v1/external/orgs/{id}/chat (REST) (member|can_operate)", "customer_chat_thread": "GET /api/v1/external/orgs/{id}/chat/threads/{tid} (member|can_operate)", "customer_chat_threads": "GET /api/v1/external/orgs/{id}/chat/threads?before=&limit= (member|can_operate) \u2014 the org's chat THREAD LIST (card t_037485d1, design \u00a72.1 R2.1): the caller's own org's threads, newest-activity first (by last event id, tie-broken by created_at), keyset-paged with `before=<last_event_id>`. A foreign tenant/org thread is ABSENT (no existence disclosure). Each row is a DERIVED projection \u2014 thread_id \u00b7 agent_id \u00b7 created_at \u00b7 last_event_id \u00b7 message_count \u00b7 updated_at \u00b7 title \u2014 where `title` is derived from the first user message at the read (whitespace-collapsed, bounded, escaped at render) and NEVER stored; no new store/index/schema. A read may be one replication beat behind", "customer_chat_search": "GET /api/v1/external/orgs/{id}/chat/search?q=\u2026&thread_id=\u2026&limit=\u2026 (member|can_operate) \u2014 search the org's conversation history (card t_fd11133b, design \u00a74.2): a DERIVED, in-memory, rebuildable index over the ONE conversation log (SQLite FTS5 with a NAMED lexical fallback when FTS5 is absent; NOT a durable index, NOT a second store). Results are org-scoped and filtered at READ time through the conversation-erasure lever's predicate, so an erased message/thread is never surfaced on any replica state; a malformed query refuses `search_query_invalid`", "customer_chat_bot": "the chat reply/thread carries the org-fabric bot representation + `runtime_stream: connected` / `connected: true` (\u00a79; SPEC t_1b5084aa \u2014 the model-backed customer-face runtime IS bound, flipped by card t_a9cc520b after C3's green live acceptance; the honest-state era of DEFECT t_f21ad29c is SUPERSEDED); obfuscation \u00a76 (scoped context, canned non-answers, allow-list toolset, storage gate)", "customer_chat_stream": "POST /api/v1/external/orgs/{id}/chat/stream (SSE; resume via Last-Event-ID)", "customer_chat_attachment": "POST /api/v1/external/orgs/{id}/chat/attachments (member|can_operate) \u2014 DECLARE an attachment (filename \u00b7 content_type \u00b7 size \u00b7 sha256, optional thread_id); a per-file ceiling of 100 MB is refused above at declaration (`attachment_too_large`) and there is NO content-type allow-list (design \u00a73.1/\u00a73.6, card t_da140061)", "customer_chat_attachment_upload": "PUT /api/v1/external/orgs/{id}/chat/attachments/{aid}/content (member|can_operate) \u2014 STREAM the raw bytes (Content-Length enforced against the declared size, sha256 recomputed); peak memory is a bounded chunk, never the whole file. Bytes live in the platform object store under a derived org-scoped key; metadata is the ONE `_attachments` journal root", "customer_chat_attachment_read": "GET /api/v1/external/orgs/{id}/chat/attachments/{aid}[?content=1] (member|can_operate) \u2014 metadata (LOW-integrity) or the BYTES. \u00a73.2a HARD RULE: bytes are ALWAYS a download with a non-renderable Content-Type, Content-Disposition: attachment, nosniff and a sandboxing CSP \u2014 no user-uploaded content ever renders in our origin; attach ids are carried on the user message via `attachment_ids` on POST /chat|/chat/stream", "customer_results": "GET /api/v1/external/orgs/{id}/results[/{rid}] (subtree_reader)", "customer_inbox": "GET|POST /api/v1/external/orgs/{id}/inbox[/{iid}] (subtree_reader) \u2014 the chairman's inbox: GET the open items newest-first plus the closed for the fold, POST sends a report (a decision/approval item is minted by the board, not sent), POST \u2026/inbox/{iid}/answer or \u2026/clear is the chairman's own act (never a second answer path for a pointer kind)", "customer_metering": "GET /api/v1/external/orgs/{id}/metering (subtree_cost_reader)", "customer_offers": "GET|POST /api/v1/external/orgs/{id}/offers (can_operate) \u2014 provider-agnostic offer search over real provider catalogues (read-only); resource_kind \u2208 cluster|object_storage|database|server|domain", "customer_provision_resource": "POST /api/v1/external/orgs/{id}/provision (can_operate) \u2014 provision the chosen resource so it is PROVABLY the tenant's (ownership ledger + resource-scoped credential + immutable audit); over-cap refused fail-closed 402 + ledgered", "customer_cluster_unit": "POST /api/v1/external/orgs/{id}/cluster-unit (can_operate) \u2014 SET UP the cluster UNIT (M-21 \u00a75.2): one stack per unit on the org's sub-account, ONE `provision_unit` ownership record with an enumerated member set, ONE scoped credential; plan-first (`commit:false` default) surfaced VERBATIM before any apply; ONE pre-action unit admission; a matrix-absent member refused fail-closed with a named code", "customer_resources": "GET /api/v1/external/orgs/{id}/resources (subtree_reader) \u2014 the tenant's OWN provisioned resources (down-scoped)", "customer_repositories": "GET /api/v1/external/orgs/{id}/repositories (subtree_reader) \u2014 the repositories the org manages: its OWN managed repository (the `git.<org-id>.seriously.cloud` customer VCS instance) + the joint repositories it holds a READ grant on; one row per repository, references only (no credential value, no handle, no provider-native id)", "customer_secret_disclosure": "GET /api/v1/external/orgs/{id}/secret-disclosure (can_operate; PUT by the OWNER to set it) \u2014 the org's secret-disclosure posture (M-20 \u00a75.4): the ORG'S OWNER alone may enable raw disclosure; with it disabled (the default) the agent world receives a clearly marked, stable masked pseudonym, never [REDACTED]", "customer_resource_scale": "POST /api/v1/external/orgs/{id}/resources/{ref}/scale (can_operate) \u2014 re-provision the org's OWN resource against a new/resize spec into the SAME binding (scale verb; the ONE quota authority bounds it pre-action; plan surfaced before the apply; ledgered)", "customer_resource_destroy": "DELETE /api/v1/external/orgs/{id}/resources/{ref} (can_operate) \u2014 destroy the org's OWN resource: provider teardown + release the binding + revoke its scoped credential (destroy verb; ledgered)", "customer_resource_access": "GET /api/v1/external/resources/{ref} \u2014 reachable ONLY under the resource's own SCOPED credential (Bearer); cross-tenant/foreign -> fail-closed", "customer_resource_poll": "GET /api/v1/external/orgs/{id}/resources/{ref} (subtree_reader|can_operate) \u2014 the RESUMABLE-HANDLE poll read a long provider verb's `202` names (M-21 \u00a75.5c D-1 residual): the resource's TRUE state \u2014 `applying`/`in_flight` while the apply runs (a durable pre-apply marker), else the LIVE binding; fail-closed `not_found` otherwise", "cost_velocity": "GET /api/v1/external/orgs/{id}/cost-velocity?window_hours=&horizon_hours= (subtree_cost_reader|can_operate)", "safe_limit": "GET|POST /api/v1/external/orgs/{id}/safe-limit (can_operate)", "envelope_warn_boundary": "PUT /api/v1/external/orgs/{id}/envelope-warn-boundary {days:<number>|null} (can_operate) \u2014 set the warn runway threshold; null clears it back to the platform default (never off); REFUSED 400 for zero/negative or a value above the org's own current runway (the prior value stands)", "account_safe_limit": "GET|POST /api/v1/external/accounts/{id}/safe-limit (account key only) \u2014 bounds the account-scoped provisioning seam (org create)", "customer_provision": "GET /api/v1/external/orgs/{id}/provision (product-level status only)", "customer_agents": "POST /api/v1/external/agents | GET|DELETE .../agents/{aid} | POST .../agents/{aid}/scale|chat (operator)", "customer_agent_results": "GET /api/v1/external/agents/{aid}/results (consumer|operator)", "customer_agent_ledger": "GET /api/v1/external/agents/{aid}/ledger (cost_reader)", "customer_sessions": "POST /api/v1/external/sessions (tenant-scoped product token)", "introductions": "POST /api/v1/external/introductions {org, contact, basis?} -> 200 {state:\"held\", position, held_at, basis} \u2014 the register-of-introductions' ONE write (spec register-of-introductions.md \u00a76.2): an UNAUTHENTICATED claim intake whose row is an unverified CLAIM (no account, no access); every refusal is ONE fixed shape (400 introduction_refused, NO `code`) so the response is an ANTI-ORACLE, never a per-code one", "onboard": "POST /api/v1/external/onboard {token|signature, mode?} -> product-level status \u2014 the compose-onboard SIGN-IN verifier (design \u00a74.1/\u00a77): a VERIFIED sign-in identity self-onboards the customer end-to-end (tenant + root org + four grants + default fabric + fail-closed envelope), NO operator step; fail-closed on an unverifiable sign-in", "customer_org_run": "POST /api/v1/external/orgs/{id}/agents/{role}/run {task} (can_operate)", "customer_activity": "GET /api/v1/external/orgs/{id}/activity[?cursor=N][&stream=1] (can_operate|subtree_reader; allow-list projection, SSE-resumable)", "customer_observability": "GET /api/v1/external/orgs/{id}/observability[?cursor=N][&window_hours=][&horizon_hours=] (can_operate|subtree_reader; down-scoped plane, fail-closed 503)", "list_blueprints": "GET /api/v1/external/blueprints", "inspect_blueprint": "GET /api/v1/external/blueprints/{id}", "blueprint_org_create": "POST /api/v1/external/orgs {name, blueprint:<id>}", "tenant_metering": "GET /api/v1/external/tenants/{id}/metering", "tenant_bill": "GET /api/v1/external/tenants/{id}/bill", "external_org_bill": "GET /api/v1/external/orgs/{id}/bill", "external_org_price": "GET /api/v1/external/orgs/{id}/price", "account_pricing": "GET /api/v1/external/accounts/{id}/pricing", "create_external_envelope": "POST /api/v1/external/orgs/{id}/budget (409 envelope_exists if an approved envelope is already in force \u2014 re-post with {\"replace\": true} to change it)", "inspect_external_budget": "GET /api/v1/external/orgs/{id}/budget", "external_agents": "GET /api/v1/external/orgs/{id}/agents", "external_action": "POST /api/v1/external/orgs/{id}/actions", "external_ledger": "GET /api/v1/external/orgs/{id}/ledger", "incubator_terms": "GET /api/v1/external/incubator/terms", "incubator_tier": "GET /api/v1/external/incubator/tier (the sellable tier definition)", "incubator_request": "POST /api/v1/external/incubator/requests (customer opens a request)", "incubator_requests": "GET /api/v1/external/incubator/requests", "incubator_request_inspect": "GET /api/v1/external/incubator/requests/{id}", "incubator_request_withdraw": "POST /api/v1/external/incubator/requests/{id}/withdraw", "incubator_request_decision": "POST /api/v1/external/incubator/requests/{id}/decision (X-Provision-Key)", "incubator_grant": "POST /api/v1/external/incubator/grants (X-Provision-Key)", "incubator_grants": "GET /api/v1/external/incubator/grants", "incubator_grant_inspect": "GET /api/v1/external/incubator/grants/{id}", "incubator_grant_expire": "POST /api/v1/external/incubator/grants/{id}/expire (X-Provision-Key)", "incubator_grant_reapply": "POST /api/v1/external/incubator/grants/{id}/reapply (X-Provision-Key; \u03943 selection)", "tenant_incubator": "GET /api/v1/external/tenants/{id}/incubator", "pooled_tier": "GET /api/v1/external/pooled/tier (the sellable pooled-capacity tier definition)", "customer_pooled": "GET /api/v1/external/orgs/{id}/pooled (can_operate) \u2014 the org's pooled subscription + the charge presentation (self_cost)", "customer_pooled_subscribe": "POST /api/v1/external/orgs/{id}/pooled {slots} | {opt_out:true} (can_operate; the customer path authors no commercial value)", "pooled_reapply": "POST /api/v1/external/orgs/{id}/pooled/reapply (X-Provision-Key; \u03943 selection)", "customer_matrix": "GET|POST|DELETE /api/v1/external/orgs/{id}/matrix (can_operate) \u2014 the org's Matrix bot interface (@bot-<org>:seriously.cloud): state / provision / revoke via the matrix-provisioner; no token is ever returned", "create_account": "POST /api/v1/external/accounts {currency?, terms_ref?}", "inspect_account": "GET /api/v1/external/accounts/{id}", "list_my_account": "GET /api/v1/external/accounts", "attach_account_org": "POST /api/v1/external/accounts/{id}/orgs {org_id}", "attach_principal": "POST /api/v1/external/accounts/{id}/principals {name, orgs:[...], role?: director-bot|product-owner|coder|qa-engineer|infra-owner} (a principal's declared role is its document capability binding)", "list_principals": "GET /api/v1/external/accounts/{id}/principals", "inspect_principal": "GET /api/v1/external/accounts/{id}/principals/{pid}", "revoke_principal": "DELETE /api/v1/external/accounts/{id}/principals/{pid}", "suspend_account": "POST /api/v1/external/accounts/{id}/suspend {reason?}", "resume_account": "POST /api/v1/external/accounts/{id}/resume", "close_invoice": "POST /api/v1/external/accounts/{id}/invoices {period?} -> 201 itemized invoice (unbilled if terms unset)", "list_invoices": "GET /api/v1/external/accounts/{id}/invoices", "inspect_invoice": "GET /api/v1/external/accounts/{id}/invoices/{invoice_id}", "pay_invoice": "POST /api/v1/external/accounts/{id}/invoices/{invoice_id}/pay {success_url?} -> 202 rail handoff (regtest; fail-closed)", "create_account_envelope": "POST /api/v1/external/accounts/{id}/budget {envelope_cents, per_action_cents?, actions?, replace?} -> 201 approved funded envelope (cap <= settled funding)", "inspect_account_envelope": "GET /api/v1/external/accounts/{id}/budget", "fund_account": "POST /api/v1/external/accounts/{id}/fund {amount_ref} -> rail handoff (fail-closed)", "account_balance": "GET /api/v1/external/accounts/{id}/balance (available/pending/reserved)", "account_funding_state": "GET /api/v1/external/accounts/{id}/funding-state", "rail_webhook": "POST /api/v1/payments/rail/webhook (signature-verified, idempotent)"}, "listener": "public"}