[{"data":1,"prerenderedAt":1225},["ShallowReactive",2],{"navigation_docs":3,"-docs-api-reference-management-api":356,"-docs-api-reference-management-api-surround":1220},[4,8,34,64,90,139,157,171,193,227,241,266,312,334],{"title":5,"path":6,"stem":7},"Documentation","\u002Fdocs","docs\u002Findex",{"title":9,"path":10,"stem":11,"children":12},"Getting started","\u002Fdocs\u002Fgetting-started","docs\u002F01.getting-started\u002Findex",[13,14,18,22,26,30],{"title":9,"path":10,"stem":11},{"title":15,"path":16,"stem":17},"Introduction","\u002Fdocs\u002Fgetting-started\u002Fintroduction","docs\u002F01.getting-started\u002F01.introduction",{"title":19,"path":20,"stem":21},"Concepts","\u002Fdocs\u002Fgetting-started\u002Fconcepts","docs\u002F01.getting-started\u002F02.concepts",{"title":23,"path":24,"stem":25},"Quickstart (5 minutes)","\u002Fdocs\u002Fgetting-started\u002Fquickstart","docs\u002F01.getting-started\u002F03.quickstart",{"title":27,"path":28,"stem":29},"Local development","\u002Fdocs\u002Fgetting-started\u002Flocal-development","docs\u002F01.getting-started\u002F04.local-development",{"title":31,"path":32,"stem":33},"FAQ","\u002Fdocs\u002Fgetting-started\u002Ffaq","docs\u002F01.getting-started\u002F05.faq",{"title":35,"path":36,"stem":37,"children":38},"Architecture","\u002Fdocs\u002Farchitecture","docs\u002F02.architecture\u002Findex",[39,40,44,48,52,56,60],{"title":35,"path":36,"stem":37},{"title":41,"path":42,"stem":43},"Architecture overview","\u002Fdocs\u002Farchitecture\u002Foverview","docs\u002F02.architecture\u002F01.overview",{"title":45,"path":46,"stem":47},"Services","\u002Fdocs\u002Farchitecture\u002Fservices","docs\u002F02.architecture\u002F02.services",{"title":49,"path":50,"stem":51},"Request lifecycle","\u002Fdocs\u002Farchitecture\u002Frequest-lifecycle","docs\u002F02.architecture\u002F03.request-lifecycle",{"title":53,"path":54,"stem":55},"Data model","\u002Fdocs\u002Farchitecture\u002Fdata-model","docs\u002F02.architecture\u002F04.data-model",{"title":57,"path":58,"stem":59},"Status and evidence","\u002Fdocs\u002Farchitecture\u002Fstatus-and-evidence","docs\u002F02.architecture\u002F05.status-and-evidence",{"title":61,"path":62,"stem":63},"Target architecture and authority","\u002Fdocs\u002Farchitecture\u002Ftarget-architecture","docs\u002F02.architecture\u002F06.target-architecture",{"title":65,"path":66,"stem":67,"children":68},"Auth","\u002Fdocs\u002Fauth","docs\u002F03.auth\u002Findex",[69,70,74,78,82,86],{"title":65,"path":66,"stem":67},{"title":71,"path":72,"stem":73},"Overview","\u002Fdocs\u002Fauth\u002Foverview","docs\u002F03.auth\u002F01.overview",{"title":75,"path":76,"stem":77},"Organization and agent model","\u002Fdocs\u002Fauth\u002Forg-project-model","docs\u002F03.auth\u002F02.org-project-model",{"title":79,"path":80,"stem":81},"Issuing API keys","\u002Fdocs\u002Fauth\u002Fissuing-api-keys","docs\u002F03.auth\u002F03.issuing-api-keys",{"title":83,"path":84,"stem":85},"Multi-tenant RLS","\u002Fdocs\u002Fauth\u002Fmulti-tenant-rls","docs\u002F03.auth\u002F04.multi-tenant-rls",{"title":87,"path":88,"stem":89},"Operator sessions and step-up","\u002Fdocs\u002Fauth\u002Foperator-sessions","docs\u002F03.auth\u002F05.operator-sessions",{"title":91,"path":92,"stem":93,"children":94},"Proxy","\u002Fdocs\u002Fproxy","docs\u002F04.proxy\u002Findex",[95,96,99,103,107,111,115,119,123,127,131,135],{"title":91,"path":92,"stem":93},{"title":71,"path":97,"stem":98},"\u002Fdocs\u002Fproxy\u002Foverview","docs\u002F04.proxy\u002F01.overview",{"title":100,"path":101,"stem":102},"Authentication","\u002Fdocs\u002Fproxy\u002Fauthentication","docs\u002F04.proxy\u002F02.authentication",{"title":104,"path":105,"stem":106},"Request routing","\u002Fdocs\u002Fproxy\u002Frequest-routing","docs\u002F04.proxy\u002F03.request-routing",{"title":108,"path":109,"stem":110},"Sessions","\u002Fdocs\u002Fproxy\u002Fsessions","docs\u002F04.proxy\u002F04.sessions",{"title":112,"path":113,"stem":114},"Directives","\u002Fdocs\u002Fproxy\u002Fdirectives","docs\u002F04.proxy\u002F05.directives",{"title":116,"path":117,"stem":118},"Idempotency and budgets","\u002Fdocs\u002Fproxy\u002Fidempotency-and-budgets","docs\u002F04.proxy\u002F06.idempotency-and-budgets",{"title":120,"path":121,"stem":122},"Rate limiting","\u002Fdocs\u002Fproxy\u002Frate-limiting","docs\u002F04.proxy\u002F07.rate-limiting",{"title":124,"path":125,"stem":126},"Provider adapters","\u002Fdocs\u002Fproxy\u002Fprovider-adapters","docs\u002F04.proxy\u002F08.provider-adapters",{"title":128,"path":129,"stem":130},"Auth caching","\u002Fdocs\u002Fproxy\u002Fauth-caching","docs\u002F04.proxy\u002F09.auth-caching",{"title":132,"path":133,"stem":134},"Configuration","\u002Fdocs\u002Fproxy\u002Fconfiguration","docs\u002F04.proxy\u002F10.configuration",{"title":136,"path":137,"stem":138},"Provider routing and resilience","\u002Fdocs\u002Fproxy\u002Fprovider-routing-and-resilience","docs\u002F04.proxy\u002F11.provider-routing-and-resilience",{"title":140,"path":141,"stem":142,"children":143},"Memory","\u002Fdocs\u002Fmemory","docs\u002F05.memory\u002Findex",[144,145,149,153],{"title":140,"path":141,"stem":142},{"title":146,"path":147,"stem":148},"Memory overview","\u002Fdocs\u002Fmemory\u002Foverview","docs\u002F05.memory\u002F01.overview",{"title":150,"path":151,"stem":152},"Write path","\u002Fdocs\u002Fmemory\u002Fwrite-path","docs\u002F05.memory\u002F02.write-path",{"title":154,"path":155,"stem":156},"Search and lifecycle","\u002Fdocs\u002Fmemory\u002Fsearch-and-lifecycle","docs\u002F05.memory\u002F03.search-and-lifecycle",{"title":158,"path":159,"stem":160,"children":161},"Context","\u002Fdocs\u002Fcontext","docs\u002F06.context\u002Findex",[162,163,167],{"title":158,"path":159,"stem":160},{"title":164,"path":165,"stem":166},"Assembly pipeline","\u002Fdocs\u002Fcontext\u002Foverview","docs\u002F06.context\u002F01.overview",{"title":168,"path":169,"stem":170},"Ranking and packing","\u002Fdocs\u002Fcontext\u002Franking-and-packing","docs\u002F06.context\u002F02.ranking-and-packing",{"title":172,"path":173,"stem":174,"children":175},"Intelligence","\u002Fdocs\u002Fintelligence","docs\u002F07.intelligence\u002Findex",[176,177,181,185,189],{"title":172,"path":173,"stem":174},{"title":178,"path":179,"stem":180},"Workers","\u002Fdocs\u002Fintelligence\u002Fworkers","docs\u002F07.intelligence\u002F01.workers",{"title":182,"path":183,"stem":184},"Extraction","\u002Fdocs\u002Fintelligence\u002Fextraction","docs\u002F07.intelligence\u002F02.extraction",{"title":186,"path":187,"stem":188},"Embedder","\u002Fdocs\u002Fintelligence\u002Fembedder","docs\u002F07.intelligence\u002F03.embedder",{"title":190,"path":191,"stem":192},"Extraction evaluation","\u002Fdocs\u002Fintelligence\u002Fevaluation","docs\u002F07.intelligence\u002F04.evaluation",{"title":194,"path":195,"stem":196,"children":197},"API reference","\u002Fdocs\u002Fapi-reference","docs\u002F08.api-reference\u002Findex",[198,199,203,207,211,215,219,223],{"title":194,"path":195,"stem":196},{"title":200,"path":201,"stem":202},"Chat completions","\u002Fdocs\u002Fapi-reference\u002Fchat-completions","docs\u002F08.api-reference\u002F01.chat-completions",{"title":204,"path":205,"stem":206},"Responses","\u002Fdocs\u002Fapi-reference\u002Fresponses","docs\u002F08.api-reference\u002F02.responses",{"title":208,"path":209,"stem":210},"Errors","\u002Fdocs\u002Fapi-reference\u002Ferrors","docs\u002F08.api-reference\u002F03.errors",{"title":212,"path":213,"stem":214},"Health and metrics","\u002Fdocs\u002Fapi-reference\u002Fproxy-health","docs\u002F08.api-reference\u002F04.proxy-health",{"title":216,"path":217,"stem":218},"HTTP route inventory","\u002Fdocs\u002Fapi-reference\u002Fhttp-routes","docs\u002F08.api-reference\u002F05.http-routes",{"title":220,"path":221,"stem":222},"Management API","\u002Fdocs\u002Fapi-reference\u002Fmanagement-api","docs\u002F08.api-reference\u002F06.management-api",{"title":224,"path":225,"stem":226},"Auth gRPC (ValidateToken, ValidateAgent)","\u002Fdocs\u002Fapi-reference\u002Fauth-grpc","docs\u002F08.api-reference\u002F07.auth-grpc",{"title":228,"path":229,"stem":230,"children":231},"MCP","\u002Fdocs\u002Fmcp","docs\u002F09.mcp\u002Findex",[232,233,237],{"title":228,"path":229,"stem":230},{"title":234,"path":235,"stem":236},"Memory server","\u002Fdocs\u002Fmcp\u002Fmemory-server","docs\u002F09.mcp\u002F01.memory-server",{"title":238,"path":239,"stem":240},"Operator gateway","\u002Fdocs\u002Fmcp\u002Foperator-gateway","docs\u002F09.mcp\u002F02.operator-gateway",{"title":242,"path":243,"stem":244,"children":245},"Security","\u002Fdocs\u002Fsecurity","docs\u002F10.security\u002Findex",[246,247,251,254,258,262],{"title":242,"path":243,"stem":244},{"title":248,"path":249,"stem":250},"Security overview","\u002Fdocs\u002Fsecurity\u002Foverview","docs\u002F10.security\u002F01.overview",{"title":100,"path":252,"stem":253},"\u002Fdocs\u002Fsecurity\u002Fauthentication","docs\u002F10.security\u002F02.authentication",{"title":255,"path":256,"stem":257},"Tenant isolation","\u002Fdocs\u002Fsecurity\u002Ftenant-isolation","docs\u002F10.security\u002F03.tenant-isolation",{"title":259,"path":260,"stem":261},"Secrets and keys","\u002Fdocs\u002Fsecurity\u002Fsecrets-and-keys","docs\u002F10.security\u002F04.secrets-and-keys",{"title":263,"path":264,"stem":265},"Prompt injection","\u002Fdocs\u002Fsecurity\u002Fprompt-injection","docs\u002F10.security\u002F05.prompt-injection",{"title":267,"path":268,"stem":269,"children":270},"Operations","\u002Fdocs\u002Foperations","docs\u002F11.operations\u002Findex",[271,272,276,280,284,288,292,296,300,304,308],{"title":267,"path":268,"stem":269},{"title":273,"path":274,"stem":275},"Observability","\u002Fdocs\u002Foperations\u002Fobservability","docs\u002F11.operations\u002F01.observability",{"title":277,"path":278,"stem":279},"Traces and ClickHouse","\u002Fdocs\u002Foperations\u002Ftraces-and-clickhouse","docs\u002F11.operations\u002F02.traces-and-clickhouse",{"title":281,"path":282,"stem":283},"Health checks","\u002Fdocs\u002Foperations\u002Fhealth-checks","docs\u002F11.operations\u002F03.health-checks",{"title":285,"path":286,"stem":287},"Incident response","\u002Fdocs\u002Foperations\u002Fincident-response","docs\u002F11.operations\u002F04.incident-response",{"title":289,"path":290,"stem":291},"Troubleshooting","\u002Fdocs\u002Foperations\u002Ftroubleshooting","docs\u002F11.operations\u002F05.troubleshooting",{"title":293,"path":294,"stem":295},"Billing and budgets","\u002Fdocs\u002Foperations\u002Fbilling-and-budgets","docs\u002F11.operations\u002F06.billing-and-budgets",{"title":297,"path":298,"stem":299},"Evidence and relay","\u002Fdocs\u002Foperations\u002Fevidence-and-relay","docs\u002F11.operations\u002F07.evidence-and-relay",{"title":301,"path":302,"stem":303},"Console","\u002Fdocs\u002Foperations\u002Fconsole","docs\u002F11.operations\u002F08.console",{"title":305,"path":306,"stem":307},"Failure modes and recovery","\u002Fdocs\u002Foperations\u002Ffailure-and-recovery","docs\u002F11.operations\u002F09.failure-and-recovery",{"title":309,"path":310,"stem":311},"Data lifecycle and deletion","\u002Fdocs\u002Foperations\u002Fdata-lifecycle-and-deletion","docs\u002F11.operations\u002F10.data-lifecycle-and-deletion",{"title":313,"path":314,"stem":315,"children":316},"Deployment","\u002Fdocs\u002Fdeployment","docs\u002F12.deployment\u002Findex",[317,318,322,326,330],{"title":313,"path":314,"stem":315},{"title":319,"path":320,"stem":321},"Docker Compose (dev)","\u002Fdocs\u002Fdeployment\u002Fdocker-compose","docs\u002F12.deployment\u002F01.docker-compose",{"title":323,"path":324,"stem":325},"Environment variables","\u002Fdocs\u002Fdeployment\u002Fenvironment-variables","docs\u002F12.deployment\u002F02.environment-variables",{"title":327,"path":328,"stem":329},"Kubernetes","\u002Fdocs\u002Fdeployment\u002Fkubernetes","docs\u002F12.deployment\u002F03.kubernetes",{"title":331,"path":332,"stem":333},"Production readiness","\u002Fdocs\u002Fdeployment\u002Fproduction-readiness","docs\u002F12.deployment\u002F04.production-readiness",{"title":335,"path":336,"stem":337,"children":338},"Reference","\u002Fdocs\u002Freference","docs\u002F13.reference\u002Findex",[339,340,344,348,352],{"title":335,"path":336,"stem":337},{"title":341,"path":342,"stem":343},"Glossary","\u002Fdocs\u002Freference\u002Fglossary","docs\u002F13.reference\u002F01.glossary",{"title":345,"path":346,"stem":347},"Roadmap and gates","\u002Fdocs\u002Freference\u002Froadmap","docs\u002F13.reference\u002F02.roadmap",{"title":349,"path":350,"stem":351},"Architecture decisions","\u002Fdocs\u002Freference\u002Fadr","docs\u002F13.reference\u002F03.adr",{"title":353,"path":354,"stem":355},"Compatibility and versioning","\u002Fdocs\u002Freference\u002Fcompatibility","docs\u002F13.reference\u002F04.compatibility",{"id":357,"title":220,"audience":358,"author":359,"authorUrl":359,"body":360,"coverIndex":359,"coverLabel":359,"coverTone":359,"date":359,"decisionStatus":359,"description":1211,"excerpt":359,"extension":1212,"featured":1213,"historical":1213,"meta":1214,"navigation":1215,"path":221,"readingTime":359,"scope":1216,"seo":1217,"sourceOfTruth":1218,"status":371,"stem":222,"tags":359,"verifiedDate":372,"__hash__":1219},"docs\u002Fdocs\u002F08.api-reference\u002F06.management-api.md","integrator",null,{"type":361,"value":362,"toc":1199},"minimark",[363,367,373,378,386,418,425,459,463,508,515,519,788,798,802,838,841,845,902,905,909,1022,1028,1032,1039,1042,1045,1146,1149,1153,1156,1160,1195],[364,365,366],"p",{},"The management API is a Python FastAPI service. Established tenant-management routes and mounted-but-provisional operator read contracts share one process. A mounted route is not production operator readiness.",[368,369],"page-status",{"note":370,"status":371,"verified":372},"Routes are mounted and locally tested; hosted session, origin, CORS\u002FCSRF, and recovery evidence are not accepted","PROVISIONAL","2026-10-21",[374,375,377],"h2",{"id":376},"base-url-and-contract-artifacts","Base URL and contract artifacts",[364,379,380,381,385],{},"Local default: ",[382,383,384],"code",{},"http:\u002F\u002F127.0.0.1:8010",".",[387,388,389,401,412],"ul",{},[390,391,392,395,396,395,398],"li",{},[382,393,394],{},"GET \u002Fopenapi.json",", ",[382,397,6],{},[382,399,400],{},"\u002Fredoc",[390,402,403,395,406,395,409],{},[382,404,405],{},"GET \u002Fhealth",[382,407,408],{},"\u002Fready",[382,410,411],{},"\u002Fmetrics",[390,413,414,417],{},[382,415,416],{},"GET \u002Fv1\u002Ftenant\u002Fping"," — authenticated tenant smoke route",[364,419,420,421,424],{},"The mounted route inventory is generated from the FastAPI app and checked in under ",[382,422,423],{},"services\u002Fapi\u002Fscripts\u002Froute_inventory.json",". The OpenAPI snapshot is checked separately. Both must be regenerated when a route or schema changes.",[426,427,432],"pre",{"className":428,"code":429,"language":430,"meta":431,"style":431},"language-bash shiki shiki-themes material-theme-lighter vitesse-light vitesse-dark","services\u002Fapi\u002F.venv\u002Fbin\u002Fpython services\u002Fapi\u002Fscripts\u002Froute_inventory.py --check\nbash .github\u002Fscripts\u002Fcheck-openapi-snapshot.sh\n","bash","",[382,433,434,451],{"__ignoreMap":431},[435,436,439,443,447],"span",{"class":437,"line":438},"line",1,[435,440,442],{"class":441},"sYn-s","services\u002Fapi\u002F.venv\u002Fbin\u002Fpython",[435,444,446],{"class":445},"sTbE_"," services\u002Fapi\u002Fscripts\u002Froute_inventory.py",[435,448,450],{"class":449},"sz9Cv"," --check\n",[435,452,454,456],{"class":437,"line":453},2,[435,455,430],{"class":441},[435,457,458],{"class":445}," .github\u002Fscripts\u002Fcheck-openapi-snapshot.sh\n",[374,460,462],{"id":461},"two-authentication-modes","Two authentication modes",[464,465,466,482],"table",{},[467,468,469],"thead",{},[470,471,472,476,479],"tr",{},[473,474,475],"th",{},"Mode",[473,477,478],{},"Used by",[473,480,481],{},"Rules",[483,484,485,497],"tbody",{},[470,486,487,491,494],{},[488,489,490],"td",{},"Bearer PAT",[488,492,493],{},"Tenant management routes",[488,495,496],{},"Permission bitmap, path org must match the token org, role checks where declared",[470,498,499,502,505],{},[488,500,501],{},"Operator cookie",[488,503,504],{},"Console-facing D1\u002FD2 and operator session routes",[488,506,507],{},"Server-owned access\u002Frefresh cookies, CSRF on cookie mutations, session subject and permissions",[364,509,510,511,385],{},"A browser bearer token is not an alternative operator-session design. Operator session issuance is default-off and requires the auth\u002Fsession feature path; the development HS256 stub is not a production issuer. See ",[512,513,514],"a",{"href":88},"Operator sessions",[374,516,518],{"id":517},"route-families","Route families",[464,520,521,534],{},[467,522,523],{},[470,524,525,528,531],{},[473,526,527],{},"Family",[473,529,530],{},"Mounted paths",[473,532,533],{},"Boundary",[483,535,536,559,572,588,605,621,637,650,666,685,704,717,736,747,769],{},[470,537,538,541,552],{},[488,539,540],{},"Organizations",[488,542,543,395,546,395,549],{},[382,544,545],{},"GET\u002FPATCH \u002Fv1\u002Forganizations\u002F{org_id}",[382,547,548],{},"POST ...\u002Fsuspend",[382,550,551],{},"DELETE ...",[488,553,554,555,558],{},"Role\u002Fpermission check; deletion returns ",[382,556,557],{},"202"," and a job",[470,560,561,564,569],{},[488,562,563],{},"Deletion jobs",[488,565,566],{},[382,567,568],{},"GET \u002Fv1\u002Forganizations\u002F{org_id}\u002Fdeletion-jobs\u002F{job_id}",[488,570,571],{},"Owner\u002Fadmin read; per-store receipts",[470,573,574,577,585],{},[488,575,576],{},"Users",[488,578,579,395,582],{},[382,580,581],{},"GET\u002FPOST \u002Fv1\u002Fusers",[382,583,584],{},"GET\u002FPATCH\u002FDELETE \u002Fv1\u002Fusers\u002F{user_id}",[488,586,587],{},"Last-owner protection; admin\u002Fowner rules",[470,589,590,593,602],{},[488,591,592],{},"Agents",[488,594,595,395,598,601],{},[382,596,597],{},"GET\u002FPOST \u002Fv1\u002Fagents",[382,599,600],{},"GET\u002FPATCH\u002FDELETE \u002Fv1\u002Fagents\u002F{agent_id}",", `POST ...\u002F{agent_id}\u002Factivate",[488,603,604],{},"pause",[470,606,607,610,618],{},[488,608,609],{},"Tokens",[488,611,612,395,615],{},[382,613,614],{},"GET\u002FPOST \u002Fv1\u002Ftokens",[382,616,617],{},"GET\u002FDELETE \u002Fv1\u002Ftokens\u002F{token_id}",[488,619,620],{},"Plaintext returned only at creation; never re-readable",[470,622,623,626,634],{},[488,624,625],{},"Providers",[488,627,628,395,631],{},[382,629,630],{},"GET\u002FPOST \u002Fv1\u002Forganizations\u002F{org_id}\u002Fproviders",[382,632,633],{},"DELETE ...\u002F{provider_name}",[488,635,636],{},"Metadata only; secret sealing delegated to auth",[470,638,639,642,647],{},[488,640,641],{},"Rate limits",[488,643,644],{},[382,645,646],{},"GET\u002FPATCH \u002Fv1\u002Forganizations\u002F{org_id}\u002Frate-limits",[488,648,649],{},"Org and per-agent RPM overrides",[470,651,652,655,663],{},[488,653,654],{},"Model policies",[488,656,657,395,660],{},[382,658,659],{},"GET\u002FPOST \u002Fv1\u002Forganizations\u002F{org_id}\u002Fmodel-policies",[382,661,662],{},"GET\u002FPATCH\u002FDELETE ...\u002F{policy_id}",[488,664,665],{},"Tenant policy CRUD; proxy enforces the resolved policy",[470,667,668,671,682],{},[488,669,670],{},"Capture policies",[488,672,673,395,676,395,679],{},[382,674,675],{},"GET\u002FPOST \u002Fv1\u002Forganizations\u002F{org_id}\u002Fcapture-policies",[382,677,678],{},"GET ...\u002Fresolved",[382,680,681],{},"PATCH\u002FDELETE ...\u002F{policy_id}",[488,683,684],{},"Retention\u002Fredaction policy CRUD and resolution",[470,686,687,690,701],{},[488,688,689],{},"Billing",[488,691,692,395,695,395,698],{},[382,693,694],{},"GET\u002FPOST ...\u002Frate-cards",[382,696,697],{},"POST ...\u002Frate-cards\u002F{card_id}\u002Fversions",[382,699,700],{},"GET\u002FPOST ...\u002Fbudget-periods",[488,702,703],{},"Versioned rates, immutable published versions",[470,705,706,709,714],{},[488,707,708],{},"Usage",[488,710,711],{},[382,712,713],{},"POST \u002Fv1\u002Forganizations\u002F{org_id}\u002Fusage\u002Fquery",[488,715,716],{},"Token-scoped; requires an org predicate in generated ClickHouse SQL",[470,718,719,722,730],{},[488,720,721],{},"Legal holds",[488,723,724,395,727],{},[382,725,726],{},"GET\u002FPOST ...\u002Flegal-holds",[382,728,729],{},"POST ...\u002F{hold_id}\u002Fclear",[488,731,732,735],{},[382,733,734],{},"LegalHoldManage","; set\u002Fclear require a session subject",[470,737,738,741,744],{},[488,739,740],{},"Operator session",[488,742,743],{},"`POST \u002Fv1\u002Foperator\u002Fsession\u002Flogin",[488,745,746],{},"refresh",[470,748,749,752,766],{},[488,750,751],{},"Operator D1",[488,753,754,395,757,395,760,395,763],{},[382,755,756],{},"GET \u002Fv1\u002Foperator\u002Fcontext",[382,758,759],{},"\u002Foverview",[382,761,762],{},"\u002Fplatform\u002Fhealth",[382,764,765],{},"\u002Fevents\u002Fstream",[488,767,768],{},"Read\u002Fevent transport; provisional",[470,770,771,774,785],{},[488,772,773],{},"Operator D2",[488,775,776,395,779,395,782],{},[382,777,778],{},"GET \u002Fv1\u002Foperator\u002Ftraces",[382,780,781],{},"\u002Ftraces\u002F{trace_id}",[382,783,784],{},"\u002Ftraces\u002Fruns\u002F{run_id}",[488,786,787],{},"Metadata-only list and deterministic multi-run read",[364,789,790,791,794,795,385],{},"The D2 list uses an opaque, signed cursor and a bounded time range; invalid or expired cursors are ",[382,792,793],{},"VALIDATION_ERROR",", not a silent restart. A trace lookup that is unknown or outside the tenant returns ",[382,796,797],{},"NOT_FOUND",[374,799,801],{"id":800},"authorization-sequence","Authorization sequence",[803,804,805,808,815,818,825,831],"ol",{},[390,806,807],{},"Authenticate the credential (PAT bearer or operator session).",[390,809,810,811,814],{},"For a path-scoped route, compare the path ",[382,812,813],{},"org_id"," with the verified organization.",[390,816,817],{},"Check the required permission bit or role.",[390,819,820,821,824],{},"Open a tenant-scoped database session and set ",[382,822,823],{},"app.current_org_id"," for the transaction.",[390,826,827,828,830],{},"Apply explicit ",[382,829,813],{}," predicates even where RLS is enabled.",[390,832,833,834,837],{},"Map missing or cross-tenant resources to ",[382,835,836],{},"404"," where existence leakage is a risk.",[364,839,840],{},"A path mismatch is not permission to use the path organization. The token's organization wins, and the request is rejected.",[374,842,844],{"id":843},"example-list-token-metadata","Example: list token metadata",[426,846,848],{"className":428,"code":847,"language":430,"meta":431,"style":431},"curl -s \\\n  -H \"Authorization: Bearer ${IBEX_DEV_TOKEN}\" \\\n  \"http:\u002F\u002F127.0.0.1:8010\u002Fv1\u002Ftokens\"\n",[382,849,850,862,890],{"__ignoreMap":431},[435,851,852,855,858],{"class":437,"line":438},[435,853,854],{"class":441},"curl",[435,856,857],{"class":449}," -s",[435,859,861],{"class":860},"se3Ec"," \\\n",[435,863,864,867,871,874,878,882,885,888],{"class":437,"line":453},[435,865,866],{"class":449},"  -H",[435,868,870],{"class":869},"sbYkP"," \"",[435,872,873],{"class":445},"Authorization: Bearer ",[435,875,877],{"class":876},"soVBu","${",[435,879,881],{"class":880},"su_V2","IBEX_DEV_TOKEN",[435,883,884],{"class":876},"}",[435,886,887],{"class":869},"\"",[435,889,861],{"class":860},[435,891,893,896,899],{"class":437,"line":892},3,[435,894,895],{"class":869},"  \"",[435,897,898],{"class":445},"http:\u002F\u002F127.0.0.1:8010\u002Fv1\u002Ftokens",[435,900,901],{"class":869},"\"\n",[364,903,904],{},"A token response returns metadata such as ID, name, type, permissions, and timestamps. It never returns the plaintext secret after creation. Do not put the token in a URL.",[374,906,908],{"id":907},"error-behavior","Error behavior",[464,910,911,924],{},[467,912,913],{},[470,914,915,918,921],{},[473,916,917],{},"Condition",[473,919,920],{},"HTTP",[473,922,923],{},"Code examples",[483,925,926,937,950,962,973,984,996,1009],{},[470,927,928,931,934],{},[488,929,930],{},"Missing\u002Finvalid credential",[488,932,933],{},"401",[488,935,936],{},"Authentication failure from the auth layer",[470,938,939,942,945],{},[488,940,941],{},"Missing permission or role",[488,943,944],{},"403",[488,946,947],{},[382,948,949],{},"INSUFFICIENT_PERMISSIONS",[470,951,952,955,957],{},[488,953,954],{},"Step-up required",[488,956,944],{},[488,958,959,961],{},[382,960,949],{}," with step-up detail",[470,963,964,967,969],{},[488,965,966],{},"Path org mismatch",[488,968,944],{},[488,970,971],{},[382,972,949],{},[470,974,975,978,980],{},[488,976,977],{},"Unknown\u002Fcross-tenant resource",[488,979,836],{},[488,981,982],{},[382,983,797],{},[470,985,986,989,992],{},[488,987,988],{},"Invalid input, cursor, or query range",[488,990,991],{},"400",[488,993,994],{},[382,995,793],{},[470,997,998,1001,1004],{},[488,999,1000],{},"Last owner removal",[488,1002,1003],{},"409",[488,1005,1006],{},[382,1007,1008],{},"LAST_OWNER_PROTECTED",[470,1010,1011,1014,1017],{},[488,1012,1013],{},"Dependency\u002Fstore unavailable",[488,1015,1016],{},"503",[488,1018,1019],{},[382,1020,1021],{},"SERVICE_DEGRADED",[364,1023,1024,1025,1027],{},"The shared error envelope is defined by the API error package; do not return ad-hoc JSON. A ",[382,1026,557],{}," deletion response is an accepted request, not a completed purge.",[374,1029,1031],{"id":1030},"operator-d1d2-boundary","Operator D1\u002FD2 boundary",[364,1033,1034,1035,1038],{},"D1\u002FD2 are read-only and return ",[382,1036,1037],{},"Cache-Control: no-store",". D2 exposes approved run metadata only: no prompts, completions, hidden reasoning, raw tool arguments, or unredacted payloads. The Console must not fabricate a detail when the upstream returns unavailable.",[364,1040,1041],{},"The API has no general provenance inspector, replay action, export endpoint, or operator write tool in this slice. Mounted presentation in the Console is not an owning contract.",[374,1043,132],{"id":1044},"configuration",[464,1046,1047,1057],{},[467,1048,1049],{},[470,1050,1051,1054],{},[473,1052,1053],{},"Variable",[473,1055,1056],{},"Purpose",[483,1058,1059,1069,1083,1093,1103,1113,1126,1136],{},[470,1060,1061,1066],{},[488,1062,1063],{},[382,1064,1065],{},"IBEX_API_DATABASE_URL",[488,1067,1068],{},"Async PostgreSQL DSN",[470,1070,1071,1080],{},[488,1072,1073,1076,1077],{},[382,1074,1075],{},"IBEX_AUTH_GRPC_ADDR"," \u002F ",[382,1078,1079],{},"IBEX_API_AUTH_GRPC_ADDR",[488,1081,1082],{},"AuthService gRPC target",[470,1084,1085,1090],{},[488,1086,1087],{},[382,1088,1089],{},"IBEX_API_AUTH_TIMEOUT_MS",[488,1091,1092],{},"Auth deadline; default 50 ms",[470,1094,1095,1100],{},[488,1096,1097],{},[382,1098,1099],{},"IBEX_API_REDIS_URL",[488,1101,1102],{},"Suspension\u002Frate-limit pub\u002Fsub and idempotency support",[470,1104,1105,1110],{},[488,1106,1107],{},[382,1108,1109],{},"IBEX_API_CELERY_BROKER_URL",[488,1111,1112],{},"Required for organization-deletion enqueue; fail closed",[470,1114,1115,1123],{},[488,1116,1117,1076,1120],{},[382,1118,1119],{},"IBEX_API_HOST",[382,1121,1122],{},"IBEX_API_PORT",[488,1124,1125],{},"Bind settings; default port 8010",[470,1127,1128,1133],{},[488,1129,1130],{},[382,1131,1132],{},"IBEX_API_DOCS_BASE_URL",[488,1134,1135],{},"Public error-docs prefix",[470,1137,1138,1143],{},[488,1139,1140],{},[382,1141,1142],{},"DASHBOARD_JWT_PUBLIC_KEYS_PEM",[488,1144,1145],{},"Operator-session RS256 verification keys; distinct from auth issuer keys",[364,1147,1148],{},"Operator session feature flags and TOTP settings belong to the auth\u002FAPI session path; do not infer them from a Console environment variable.",[374,1150,1152],{"id":1151},"readiness-boundary","Readiness boundary",[364,1154,1155],{},"Production promotion still requires AuthService\u002Fsession\u002FMFA integration, deployment-origin and CORS\u002FCSRF evidence, two-tenant negative tests, redaction and hostile-content tests, performance\u002Favailability evidence, and rollback\u002Fincident runbooks. The full management product and provenance inspector are not complete until those gates are accepted.",[374,1157,1159],{"id":1158},"related","Related",[387,1161,1162,1167,1172,1180,1185,1190],{},[390,1163,1164,1166],{},[512,1165,514],{"href":88}," — cookie and step-up contract",[390,1168,1169,1171],{},[512,1170,204],{"href":205}," — data-plane response shapes",[390,1173,1174,1176,1177,1179],{},[512,1175,309],{"href":310}," — ",[382,1178,557],{},", receipts, and holds",[390,1181,1182,1184],{},[512,1183,293],{"href":294}," — rate cards and reservation limits",[390,1186,1187,1189],{},[512,1188,301],{"href":302}," — how the read slices are presented",[390,1191,1192,1194],{},[512,1193,255],{"href":256}," — path mismatch and 404 rules",[1196,1197,1198],"style",{},"html pre.shiki code .sYn-s, html code.shiki .sYn-s{--shiki-light:#E2931D;--shiki-default:#59873A;--shiki-dark:#80A665}html pre.shiki code .sTbE_, html code.shiki .sTbE_{--shiki-light:#91B859;--shiki-default:#B56959;--shiki-dark:#C98A7D}html pre.shiki code .sz9Cv, html code.shiki .sz9Cv{--shiki-light:#91B859;--shiki-default:#A65E2B;--shiki-dark:#C99076}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .se3Ec, html code.shiki .se3Ec{--shiki-light:#90A4AE;--shiki-default:#A65E2B;--shiki-dark:#C99076}html pre.shiki code .sbYkP, html code.shiki .sbYkP{--shiki-light:#39ADB5;--shiki-default:#B5695977;--shiki-dark:#C98A7D77}html pre.shiki code .soVBu, html code.shiki .soVBu{--shiki-light:#39ADB5;--shiki-default:#999999;--shiki-dark:#666666}html pre.shiki code .su_V2, html code.shiki .su_V2{--shiki-light:#90A4AE;--shiki-default:#B56959;--shiki-dark:#C98A7D}",{"title":431,"searchDepth":453,"depth":453,"links":1200},[1201,1202,1203,1204,1205,1206,1207,1208,1209,1210],{"id":376,"depth":453,"text":377},{"id":461,"depth":453,"text":462},{"id":517,"depth":453,"text":518},{"id":800,"depth":453,"text":801},{"id":843,"depth":453,"text":844},{"id":907,"depth":453,"text":908},{"id":1030,"depth":453,"text":1031},{"id":1044,"depth":453,"text":132},{"id":1151,"depth":453,"text":1152},{"id":1158,"depth":453,"text":1159},"Tenant management, billing, policies, deletion, operator sessions, and the read-only D1\u002FD2 contracts.","md",false,{},true,"provisional",{"title":220,"description":1211},"services\u002Fapi\u002FREADME.md; services\u002Fapi\u002Fscripts\u002Froute_inventory.json","YjNYwFaKQOfDGyvjmg_Wh5oHBZwLWaYuu-bdBThFlQw",[1221,1223],{"title":216,"path":217,"stem":218,"description":1222,"children":-1},"Implemented public and protected HTTP routes on the IBEX proxy (sourced from the Go router).",{"title":224,"path":225,"stem":226,"description":1224,"children":-1},"Internal AuthService RPCs consumed by the proxy — not exposed on the public internet.",1792875077152]