[AVAILABLE], every route below is mounted in
packages/api/src/app.ts. No other routes exist.Base URL
Local:http://localhost:3000 (see Quickstart for starting the server). The
raw spec is also served at GET /openapi.yaml, see Deploy
patterns.
Full reference
Every route, request/response shape, and status code is generated fromopenapi/openapi.yaml
in the sidebar under REST API, each with real captured examples and a working curl
snippet. This page and its siblings cover what a spec can’t express:
Authentication
The bearer key model, and how it differs from Policy evaluation and gateway attestation.
Error handling
The shared error envelope, and two verified gaps in it.
Idempotency and nonces
Why there’s no Idempotency-Key header, and what businessTransactionId does instead.
Error catalog
Every error this API returns, one table, cross-linked from the spec.
Errors
Non-2xx responses are{ "error": string }, sometimes with a code field. Full philosophy
and two verified gaps on Error handling; every specific
error this API returns on the Error catalog.
Both maintained SDKs raise a specific exception per status code. The Python SDK:
ValidationError/NotFoundError/ConflictError/ServerError/etc., see Python
SDK. The TypeScript SDK: ValidationError/AuthenticationError/
AuthorizationError/NotFoundError/ConflictError/ExecutionRejectedError/etc., see
TypeScript SDK.
Auth
Every route requires a caller bearer key, except
GET /health. See
Authentication for how to send one and what it does and
does not prove.Rate limiting
POST /execute is rate-limited per authenticated caller; GET /health and GET /ready carry a
separate, more permissive limit keyed by IP. See Authentication
for the mechanism and Error catalog for the exact 429 shape.