{ "components": { "schemas": { "ConnectorActivationInput": { "additionalProperties": false, "properties": { "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" } }, "required": [ "schemaVersion" ], "type": "object" }, "ConnectorAgentNamePolicy": { "additionalProperties": false, "properties": { "displayName": { "additionalProperties": false, "properties": { "controlCharactersAllowed": { "const": false }, "maxLength": { "const": 80 }, "minLength": { "const": 1 }, "normalization": { "const": "trim_and_collapse_whitespace" } }, "required": [ "minLength", "maxLength", "normalization", "controlCharactersAllowed" ], "type": "object" }, "guidance": { "type": "string" }, "maxLength": { "const": 64 }, "minLength": { "const": 3 }, "normalization": { "const": "lowercase" }, "pattern": { "type": "string" }, "scope": { "const": "company" }, "uniqueness": { "const": "normalized_name_within_company" } }, "required": [ "scope", "uniqueness", "normalization", "minLength", "maxLength", "pattern", "guidance", "displayName" ], "type": "object" }, "ConnectorAgentRegistrationResult": { "additionalProperties": false, "properties": { "alreadyRegistered": { "const": true }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "registration": { "additionalProperties": false, "properties": { "agentId": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" }, "created": { "const": false }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "status": { "const": "already_registered" }, "workspaceId": { "type": "string" } }, "required": [ "status", "workspaceId", "agentId", "created", "scopeDigest" ], "type": "object" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "registration", "alreadyRegistered", "idempotentReplay", "approvedScopes", "scopeDigest", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorApprovalInput": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "canonicalAgentApproved": { "const": true }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "workspaceSelection": { "oneOf": [ { "additionalProperties": false, "properties": { "mode": { "const": "existing" }, "workspaceRef": { "type": "string" } }, "required": [ "mode", "workspaceRef" ], "type": "object" }, { "additionalProperties": false, "properties": { "mode": { "const": "new" }, "projectLabel": { "maxLength": 120, "minLength": 1, "type": "string" }, "workspaceLabel": { "maxLength": 120, "minLength": 1, "type": "string" } }, "required": [ "mode", "workspaceLabel", "projectLabel" ], "type": "object" } ] } }, "required": [ "schemaVersion", "canonicalAgentApproved", "approvedScopes", "workspaceSelection" ], "type": "object" }, "ConnectorApprovalResult": { "additionalProperties": false, "properties": { "approval": { "additionalProperties": false, "properties": { "agentDisplayName": { "type": "string" }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "claimExpiresAt": { "format": "date-time", "type": "string" }, "clientDisplayName": { "type": "string" }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "status": { "const": "approved_awaiting_connector_claim" }, "valuesRedacted": { "const": true } }, "required": [ "status", "clientDisplayName", "agentDisplayName", "approvedScopes", "scopeDigest", "claimExpiresAt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "claimExpiresInSeconds": { "const": 60 }, "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "status": { "const": "approved_awaiting_connector_claim" }, "valuesRedacted": { "const": true }, "wakeUp": { "additionalProperties": false, "properties": { "authorizing": { "const": false }, "automaticNavigation": { "const": false }, "parametersAdded": { "const": false }, "userActivationRequired": { "const": true } }, "required": [ "userActivationRequired", "authorizing", "parametersAdded", "automaticNavigation" ], "type": "object" }, "wakeUpUrl": { "description": "Registered redirect URI byte-for-byte, parameter-free and non-authorizing.", "format": "uri", "type": "string" } }, "required": [ "ok", "schemaVersion", "status", "approval", "wakeUpUrl", "wakeUp", "claimExpiresInSeconds", "approvedScopes", "scopeDigest", "receipt", "idempotentReplay", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorAuthorizationCodeClaimInput": { "additionalProperties": false, "properties": { "clientId": { "enum": [ "localendpoints-connect", "remoteendpoints-connect" ], "type": "string" }, "pairingRequestProof": { "type": "string", "writeOnly": true }, "redirectUri": { "type": "string" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "state": { "maxLength": 128, "minLength": 43, "type": "string", "writeOnly": true } }, "required": [ "schemaVersion", "clientId", "redirectUri", "pairingRequestProof", "state" ], "type": "object" }, "ConnectorAuthorizationCodeClaimPending": { "additionalProperties": false, "properties": { "idempotencyBound": { "const": false }, "idempotencyKeyReserved": { "const": false }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "requestedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "retryAfterSeconds": { "maximum": 30, "minimum": 1, "type": "integer" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "stateVerified": { "const": true }, "status": { "const": "pending_human_approval" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "status", "stateVerified", "requestedScopes", "scopeDigest", "retryAfterSeconds", "idempotencyBound", "idempotencyKeyReserved", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorAuthorizationCodeClaimResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "authorizationCode": { "type": "string", "writeOnly": true }, "credentialDeliveredToAuthorizedRecipient": { "const": true }, "expiresInSeconds": { "const": 60 }, "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "rawCredentialPersisted": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "showCredentialOnce": { "const": true }, "stateVerified": { "const": true }, "status": { "const": "authorization_code_issued" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "status", "authorizationCode", "expiresInSeconds", "stateVerified", "approvedScopes", "scopeDigest", "receipt", "idempotentReplay", "credentialDeliveredToAuthorizedRecipient", "rawCredentialPersisted", "showCredentialOnce", "valuesRedacted", "rawPayloadExposed" ], "type": "object" }, "ConnectorCompanySelectionInput": { "additionalProperties": false, "properties": { "companyRef": { "pattern": "^companyref_[A-Za-z0-9_-]{43}$", "type": "string" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" } }, "required": [ "schemaVersion", "companyRef" ], "type": "object" }, "ConnectorCompanySelectionResult": { "additionalProperties": false, "properties": { "credentialDeliveredToAuthorizedRecipient": { "const": true }, "csrfToken": { "type": "string", "writeOnly": true }, "expiresAt": { "format": "date-time", "type": "string" }, "ok": { "const": true }, "rawCredentialPersisted": { "const": false }, "rawPayloadExposed": { "const": false }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "sessionRotated": { "const": true }, "showCredentialOnce": { "const": true }, "status": { "const": "company_selected" }, "tenantIdentifiersExposed": { "const": false }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "status", "sessionRotated", "csrfToken", "expiresAt", "tenantIdentifiersExposed", "credentialDeliveredToAuthorizedRecipient", "rawCredentialPersisted", "showCredentialOnce", "valuesRedacted", "rawPayloadExposed" ], "type": "object" }, "ConnectorCoordinatorStatusInput": { "additionalProperties": false, "properties": { "apiChanges": { "items": { "maxLength": 240, "minLength": 1, "type": "string" }, "maxItems": 8, "type": "array" }, "blockers": { "items": { "maxLength": 240, "minLength": 1, "type": "string" }, "maxItems": 8, "type": "array" }, "revision": { "maxLength": 200, "minLength": 1, "type": "string" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "system": { "maxLength": 200, "minLength": 1, "type": "string" }, "work": { "maxLength": 500, "minLength": 1, "type": "string" } }, "required": [ "schemaVersion", "system", "work", "revision", "blockers", "apiChanges" ], "type": "object" }, "ConnectorCoordinatorStatusResult": { "additionalProperties": false, "properties": { "accepted": { "const": true }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "coordinatorProfileBound": { "const": true }, "ok": { "const": true }, "persisted": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "recipientCount": { "minimum": 1, "type": "integer" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "accepted", "persisted", "coordinatorProfileBound", "recipientCount", "approvedScopes", "scopeDigest", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorCredentialDelivery": { "additionalProperties": false, "properties": { "exactRetryUntilActivation": { "const": true }, "rawCredentialPersisted": { "const": false }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "showCredentialOnce": { "const": true } }, "required": [ "showCredentialOnce", "exactRetryUntilActivation", "rawCredentialPersisted", "scopeDigest" ], "type": "object" }, "ConnectorCredentialListResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "count": { "maximum": 100, "minimum": 0, "type": "integer" }, "currentCredentialId": { "type": "string" }, "hasMore": { "type": "boolean" }, "items": { "items": { "additionalProperties": false, "properties": { "activatedAt": { "format": "date-time", "type": [ "string", "null" ] }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "createdAt": { "format": "date-time", "type": "string" }, "credentialId": { "type": "string" }, "isCurrent": { "type": "boolean" }, "lastUsedAt": { "format": "date-time", "type": [ "string", "null" ] }, "revokedAt": { "format": "date-time", "type": [ "string", "null" ] }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "status": { "type": "string" } }, "required": [ "credentialId", "status", "isCurrent", "approvedScopes", "scopeDigest", "createdAt", "activatedAt", "revokedAt", "lastUsedAt" ], "type": "object" }, "maxItems": 100, "type": "array" }, "limit": { "const": 100 }, "ok": { "const": true }, "pairingId": { "type": "string" }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "allOf": [ { "$ref": "#/components/schemas/ConnectorReceipt" } ], "description": "Deterministic receipt with action=list_credentials, status=verified, and idempotentReplay=false." }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "totalCount": { "minimum": 0, "type": "integer" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "pairingId", "approvedScopes", "scopeDigest", "currentCredentialId", "items", "count", "totalCount", "hasMore", "limit", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorCurrentMessageItem": { "additionalProperties": false, "properties": { "createdAt": { "format": "date-time", "type": [ "string", "null" ] }, "notificationId": { "type": "string" }, "rawPayloadExposed": { "const": false }, "responseRequired": { "type": "boolean" }, "safeSummary": { "type": [ "string", "null" ] }, "status": { "type": [ "string", "null" ] }, "valuesRedacted": { "const": true } }, "required": [ "notificationId", "safeSummary", "responseRequired", "status", "createdAt", "valuesRedacted", "rawPayloadExposed" ], "type": "object" }, "ConnectorCurrentMessageResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "hasMore": { "type": "boolean" }, "items": { "items": { "$ref": "#/components/schemas/ConnectorCurrentMessageItem" }, "maxItems": 100, "type": "array" }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "selfBound": { "const": true }, "unreadCount": { "maximum": 100, "minimum": 0, "type": "integer" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "items", "unreadCount", "hasMore", "selfBound", "approvedScopes", "scopeDigest", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorDiscovery": { "additionalProperties": false, "properties": { "agentNamePolicy": { "type": "object" }, "artifacts": { "type": "object" }, "authorization": { "type": "object" }, "clients": { "items": { "type": "object" }, "maxItems": 2, "minItems": 2, "type": "array" }, "endpoints": { "additionalProperties": false, "properties": { "activation": { "const": "/api/matm/connector-pairings/{pairingId}/activate" }, "activeNameLeasePreflight": { "const": "/api/matm/connector-agent-leases/{agentId}" }, "authorization": { "const": "/connect/authorize/{publicRequestRef}" }, "authorizationCodeClaim": { "const": "/api/matm/connector-pairings/authorization-code-claims" }, "cancellation": { "const": "/api/matm/connector-pairings/{pairingId}/cancel" }, "credentialList": { "const": "/api/matm/connector-pairings/{pairingId}/credentials" }, "disconnect": { "const": "/api/matm/connector-pairings/{pairingId}/disconnect" }, "masterApproval": { "const": "/api/matm/connector-pairings/{publicRequestRef}/master-approve" }, "pairingRequest": { "const": "/api/matm/connector-pairings/requests" }, "profileHandoff": { "const": "/api/matm/connector-bootstrap/profiles/{profileId}" }, "revocation": { "const": "/api/matm/connector-pairings/{pairingId}/revoke" }, "rotation": { "const": "/api/matm/connector-pairings/{pairingId}/rotations" }, "rotationActivation": { "const": "/api/matm/connector-pairings/{pairingId}/rotations/{rotationId}/activate" }, "runtimeLease": { "const": "/api/matm/connector-runtime-lease" }, "status": { "const": "/api/matm/connector-pairings/{pairingId}" }, "token": { "const": "/api/matm/connector-pairings/token" }, "windowsBootstrap": { "const": "/api/matm/connector-bootstrap/windows.py" } }, "required": [ "pairingRequest", "authorization", "authorizationCodeClaim", "masterApproval", "token", "activation", "status", "rotation", "rotationActivation", "credentialList", "revocation", "disconnect", "cancellation", "activeNameLeasePreflight", "runtimeLease", "windowsBootstrap", "profileHandoff" ], "type": "object" }, "issuer": { "const": "https://memoryendpoints.com" }, "profiles": { "items": { "type": "object" }, "maxItems": 2, "minItems": 2, "type": "array" }, "publicResponse": { "type": "object" }, "rateLimits": { "type": "object" }, "requestedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "security": { "type": "object" }, "serviceRoot": { "description": "Exact HTTPS root; userinfo, explicit ports, query, and fragment are forbidden.", "type": "object" }, "supportedSchemaVersions": { "maxItems": 1, "minItems": 1, "prefixItems": [ { "const": "memoryendpoints.connector_pairing.v1" } ], "type": "array" }, "transport": { "type": "object" } }, "required": [ "schemaVersion", "supportedSchemaVersions", "issuer", "serviceRoot", "profiles", "clients", "endpoints", "artifacts", "security", "transport", "agentNamePolicy", "requestedScopes", "authorization", "rateLimits", "publicResponse" ], "type": "object" }, "ConnectorError": { "additionalProperties": false, "properties": { "error": { "additionalProperties": false, "properties": { "code": { "enum": [ "invalid_token", "pkce_verification_failed", "authorization_code_invalid", "authorization_claim_invalid", "pending_credential_not_active", "company_master_required", "insufficient_scope", "connector_scope_forbidden", "runtime_identity_in_use", "runtime_lease_not_held", "pairing_not_found", "pairing_request_not_found", "workspace_not_found", "rotation_not_found", "idempotency_conflict", "authorization_code_already_exchanged", "agent_name_unavailable", "pairing_request_unavailable", "pairing_unavailable", "pairing_not_pending_activation", "rotation_unavailable", "rotation_pending", "grant_not_active", "pairing_verification_failed", "pairing_request_expired", "authorization_code_expired", "authorization_code_redeemed", "pending_grant_expired", "pairing_canceled", "pairing_revoked", "pairing_disconnected", "request_body_too_large", "json_content_type_required", "idempotency_key_required", "idempotency_key_invalid", "schema_version_unsupported", "connector_client_unsupported", "redirect_uri_not_allowed", "state_invalid", "pkce_method_unsupported", "pkce_challenge_invalid", "connector_agent_identity_invalid", "approved_agent_mismatch", "workspace_selection_invalid", "workspace_ref_invalid", "workspace_ref_expired", "company_ref_invalid", "company_ref_expired", "connector_scopes_invalid", "connector_public_safe_payload_required", "idempotency_key_not_allowed", "invalid_request", "rate_limited", "credential_system_not_configured", "connector_service_unavailable", "human_session_required", "human_owner_required", "recovery_session_restricted", "trusted_origin_required", "csrf_required", "csrf_invalid", "human_reauthentication_required", "recent_reauthentication_required", "selected_company_required", "human_company_not_found" ], "type": "string" }, "detail": { "description": "Fixed non-reflective problem detail.", "type": "string" }, "safeNoOp": { "const": true }, "title": { "description": "Fixed non-reflective problem title.", "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "code", "title", "detail", "safeNoOp", "valuesRedacted" ], "type": "object" }, "ok": { "const": false }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "safeNoOp": { "const": true }, "valuesRedacted": { "const": true } }, "required": [ "ok", "safeNoOp", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed", "error" ], "type": "object" }, "ConnectorExactScopes": { "maxItems": 9, "minItems": 9, "prefixItems": [ { "const": "connector:self:readback" }, { "const": "connector:self:runtime-lease" }, { "const": "agent:self:register" }, { "const": "coordination:self:current-message:read" }, { "const": "coordination:self:notification:ack" }, { "const": "coordination:project:rooms:read" }, { "const": "coordination:coordinator:status:write" }, { "const": "memory:public-safe:submit" }, { "const": "memory:search:read" } ], "type": "array", "uniqueItems": true }, "ConnectorLifecycleReasonInput": { "additionalProperties": false, "properties": { "reason": { "maxLength": 255, "minLength": 1, "pattern": "^[^\\x00-\\x1F\\x7F]+$", "type": "string" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" } }, "required": [ "schemaVersion", "reason" ], "type": "object" }, "ConnectorMasterApprovalInput": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "canonicalAgentApproved": { "const": true }, "profileId": { "enum": [ "localendpoints", "remoteendpoints" ], "type": "string" }, "projectSelector": { "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$", "type": "string" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "workspaceId": { "pattern": "^[A-Za-z][A-Za-z0-9_-]{7,95}$", "type": "string" } }, "required": [ "schemaVersion", "profileId", "canonicalAgentApproved", "approvedScopes", "workspaceId", "projectSelector" ], "type": "object" }, "ConnectorMasterApprovalResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "authorizationCodeClaimReady": { "const": true }, "claimExpiresAt": { "format": "date-time", "type": "string" }, "claimExpiresInSeconds": { "const": 60 }, "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "profileId": { "enum": [ "localendpoints", "remoteendpoints" ], "type": "string" }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "status": { "const": "approved_awaiting_connector_claim" }, "tenantIdentifiersExposed": { "const": false }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "profileId", "status", "authorizationCodeClaimReady", "claimExpiresAt", "claimExpiresInSeconds", "approvedScopes", "scopeDigest", "receipt", "idempotentReplay", "tenantIdentifiersExposed", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorNotificationAckInput": { "additionalProperties": false, "properties": { "handled": { "const": true }, "notificationId": { "pattern": "^[A-Za-z][A-Za-z0-9_-]{7,95}$", "type": "string" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "status": { "enum": [ "read", "archived" ], "type": "string" } }, "required": [ "schemaVersion", "notificationId", "status", "handled" ], "type": "object" }, "ConnectorNotificationAckResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "handled": { "const": true }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "selfBound": { "const": true }, "status": { "enum": [ "read", "archived" ], "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "handled", "status", "selfBound", "approvedScopes", "scopeDigest", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorPairingGrant": { "additionalProperties": false, "properties": { "active": { "type": "boolean" }, "agentId": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "canInvite": { "const": false }, "canRevoke": { "const": false }, "credentialType": { "const": "connector_agent" }, "revoked": { "type": "boolean" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "scopeId": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" }, "scopeType": { "const": "agent" }, "workspaceId": { "type": "string" } }, "required": [ "credentialType", "scopeType", "scopeId", "workspaceId", "agentId", "approvedScopes", "scopeDigest", "active", "revoked", "canInvite", "canRevoke" ], "type": "object" }, "ConnectorPairingMutationResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "pairing": { "$ref": "#/components/schemas/ConnectorPairingSummary" }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "safeNoOpOnRetry": { "const": true }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "pairing", "approvedScopes", "scopeDigest", "receipt", "safeNoOpOnRetry", "idempotentReplay", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorPairingReadbackResource": { "additionalProperties": false, "oneOf": [ { "not": { "required": [ "agentId" ] }, "required": [ "workspaceId" ] }, { "not": { "required": [ "workspaceId" ] }, "required": [ "agentId" ] } ], "properties": { "agentId": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" }, "readable": { "type": "boolean" }, "workspaceId": { "type": "string" } }, "required": [ "readable" ], "type": "object" }, "ConnectorPairingRequestInput": { "additionalProperties": false, "properties": { "clientId": { "enum": [ "localendpoints-connect", "remoteendpoints-connect" ], "type": "string" }, "codeChallenge": { "pattern": "^[A-Za-z0-9_-]{43}$", "type": "string" }, "codeChallengeMethod": { "const": "S256" }, "redirectUri": { "description": "Exact redirect URI registered for the selected connector profile; no query or fragment.", "enum": [ "localendpoints-connect://memoryendpoints/callback", "remoteendpoints-connect://memoryendpoints/callback" ], "type": "string" }, "requestedAgentId": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" }, "requestedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "state": { "description": "Desktop-generated state with at least 256 bits of entropy.", "maxLength": 128, "minLength": 43, "pattern": "^[A-Za-z0-9._~-]+$", "type": "string" } }, "required": [ "schemaVersion", "clientId", "redirectUri", "state", "codeChallenge", "codeChallengeMethod", "requestedAgentId", "requestedScopes" ], "type": "object" }, "ConnectorPairingRequestMutationResult": { "additionalProperties": false, "properties": { "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "pairingRequest": { "allOf": [ { "$ref": "#/components/schemas/ConnectorPairingRequestSummary" }, { "not": { "required": [ "expiresInSeconds" ] }, "properties": { "status": { "const": "canceled" } } } ] }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "requestedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "safeNoOpOnRetry": { "const": true }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "pairingRequest", "requestedScopes", "scopeDigest", "receipt", "safeNoOpOnRetry", "idempotentReplay", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorPairingRequestResult": { "additionalProperties": false, "properties": { "authorizationUrl": { "format": "uri", "pattern": "^https://memoryendpoints\\.com/connect/authorize/pairref_[A-Za-z0-9_-]{43}$", "type": "string" }, "credentialDeliveredToAuthorizedRecipient": { "const": true }, "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "pairingRequest": { "allOf": [ { "$ref": "#/components/schemas/ConnectorPairingRequestSummary" }, { "properties": { "approvedScopes": { "maxItems": 0, "type": "array" }, "status": { "const": "pending_human_approval" } }, "required": [ "expiresInSeconds" ] } ] }, "pairingRequestProof": { "description": "One-time body-only desktop proof; never place in a URL, log, prompt, or setting.", "type": "string", "writeOnly": true }, "proofDelivery": { "additionalProperties": false, "properties": { "bodyOnly": { "const": true }, "exactRetryRecoverable": { "const": true }, "rawProofPersisted": { "const": false }, "showOnce": { "const": true } }, "required": [ "bodyOnly", "showOnce", "rawProofPersisted", "exactRetryRecoverable" ], "type": "object" }, "rawCredentialPersisted": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "requestedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "showCredentialOnce": { "const": true }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "pairingRequest", "pairingRequestProof", "authorizationUrl", "proofDelivery", "requestedScopes", "scopeDigest", "receipt", "idempotentReplay", "credentialDeliveredToAuthorizedRecipient", "rawCredentialPersisted", "showCredentialOnce", "valuesRedacted", "rawPayloadExposed" ], "type": "object" }, "ConnectorPairingRequestSummary": { "additionalProperties": false, "properties": { "agentDisplayName": { "enum": [ "LocalEndpoint Agent", "RemoteEndpoints Agent" ], "type": "string" }, "approvedScopes": { "items": { "enum": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "type": "string" }, "maxItems": 9, "minItems": 9, "type": "array" }, "claimExpiresAt": { "format": "date-time", "type": [ "string", "null" ] }, "clientDisplayName": { "enum": [ "LocalEndpoints Connect", "RemoteEndpoints Connect" ], "type": "string" }, "expiresAt": { "format": "date-time", "type": "string" }, "expiresInSeconds": { "const": 600 }, "publicRequestRef": { "pattern": "^pairref_[A-Za-z0-9_-]{43}$", "type": "string" }, "requestedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "scopeImpacts": { "items": { "$ref": "#/components/schemas/ConnectorScopeImpact" }, "maxItems": 9, "type": "array" }, "status": { "enum": [ "pending_human_approval", "approved", "authorization_code_issued", "exchanged", "active", "canceled", "expired" ], "type": "string" } }, "required": [ "publicRequestRef", "status", "clientDisplayName", "agentDisplayName", "requestedScopes", "approvedScopes", "scopeDigest", "scopeImpacts", "expiresAt", "claimExpiresAt" ], "type": "object" }, "ConnectorPairingSummary": { "additionalProperties": false, "properties": { "activationExpiresInSeconds": { "maximum": 600, "minimum": 0, "type": "integer" }, "agent": { "$ref": "#/components/schemas/ConnectorPairingReadbackResource" }, "agentId": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "credentialId": { "type": "string" }, "grant": { "$ref": "#/components/schemas/ConnectorPairingGrant" }, "pairingId": { "type": "string" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "status": { "enum": [ "pending_activation", "active", "canceled", "expired", "revoked", "disconnected" ], "type": "string" }, "workspace": { "$ref": "#/components/schemas/ConnectorPairingReadbackResource" }, "workspaceId": { "type": "string" } }, "required": [ "pairingId", "status", "workspaceId", "agentId", "credentialId", "approvedScopes", "scopeDigest", "grant" ], "type": "object" }, "ConnectorPairingVerification": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "ok": { "const": true }, "pairing": { "allOf": [ { "$ref": "#/components/schemas/ConnectorPairingSummary" }, { "properties": { "status": { "const": "active" } }, "required": [ "workspace", "agent" ] } ] }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true }, "verification": { "additionalProperties": false, "properties": { "canonicalWorkspaceIdMatches": { "const": true }, "canonicalWorkspaceReadable": { "const": true }, "credentialScopedToConnectorAndAgent": { "const": true }, "exactAgentIdMatches": { "const": true }, "exactAgentReadable": { "const": true }, "grantActive": { "const": true }, "grantRevoked": { "const": false }, "privatePayloadExposed": { "const": false }, "rawCredentialExposed": { "const": false }, "valuesRedacted": { "const": true } }, "required": [ "canonicalWorkspaceReadable", "canonicalWorkspaceIdMatches", "exactAgentReadable", "exactAgentIdMatches", "credentialScopedToConnectorAndAgent", "grantActive", "grantRevoked", "rawCredentialExposed", "privatePayloadExposed", "valuesRedacted" ], "type": "object" } }, "required": [ "ok", "schemaVersion", "pairing", "approvedScopes", "scopeDigest", "verification", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorProjectRoomItem": { "additionalProperties": false, "properties": { "label": { "type": [ "string", "null" ] }, "lastMessageAt": { "format": "date-time", "type": [ "string", "null" ] }, "messageCount": { "minimum": 0, "type": "integer" }, "name": { "type": [ "string", "null" ] }, "purpose": { "type": [ "string", "null" ] }, "rawPayloadExposed": { "const": false }, "roomId": { "type": "string" }, "scope": { "const": "project" }, "unreadCount": { "minimum": 0, "type": "integer" }, "valuesRedacted": { "const": true } }, "required": [ "roomId", "label", "name", "purpose", "scope", "messageCount", "unreadCount", "lastMessageAt", "valuesRedacted", "rawPayloadExposed" ], "type": "object" }, "ConnectorProjectRoomsResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "boundProjectOnly": { "const": true }, "count": { "minimum": 0, "type": "integer" }, "items": { "items": { "$ref": "#/components/schemas/ConnectorProjectRoomItem" }, "type": "array" }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "items", "count", "boundProjectOnly", "approvedScopes", "scopeDigest", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorPublicMemoryItem": { "additionalProperties": false, "properties": { "actorAgentId": { "description": "Derived stored actor for a public-safe item; submit always binds connector self, while workspace-scoped search may return another governed public-safe actor.", "type": [ "string", "null" ] }, "classification": { "const": "public_safe" }, "confidence": { "type": [ "number", "null" ] }, "createdAt": { "type": [ "string", "null" ] }, "memoryId": { "type": [ "string", "null" ] }, "memoryType": { "type": [ "string", "null" ] }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "scope": { "type": [ "string", "null" ] }, "subject": { "type": [ "string", "null" ] }, "summary": { "type": [ "string", "null" ] }, "tags": { "items": { "type": "string" }, "maxItems": 16, "type": "array" }, "title": { "type": [ "string", "null" ] }, "valuesRedacted": { "const": true }, "workspaceId": { "type": [ "string", "null" ] } }, "required": [ "memoryId", "workspaceId", "actorAgentId", "scope", "title", "summary", "tags", "memoryType", "subject", "confidence", "createdAt", "classification", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorPublicSafeMemoryInput": { "additionalProperties": false, "properties": { "payloadClass": { "const": "public_safe" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "summary": { "maxLength": 4000, "minLength": 1, "pattern": "^\\S(?:[\\s\\S]*\\S)?$", "type": "string" }, "tags": { "items": { "maxLength": 64, "minLength": 1, "pattern": "^\\S(?:[\\s\\S]*\\S)?$", "type": "string" }, "maxItems": 16, "type": "array" }, "title": { "maxLength": 200, "minLength": 1, "pattern": "^\\S(?:[\\s\\S]*\\S)?$", "type": "string" } }, "required": [ "schemaVersion", "payloadClass", "title", "summary", "tags" ], "type": "object" }, "ConnectorPublicSafeMemoryResult": { "additionalProperties": false, "properties": { "actorBinding": { "const": "connector_self" }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "idempotentReplay": { "type": "boolean" }, "memory": { "$ref": "#/components/schemas/ConnectorPublicMemoryItem" }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "memory", "actorBinding", "idempotentReplay", "approvedScopes", "scopeDigest", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorReceipt": { "additionalProperties": false, "properties": { "action": { "enum": [ "authorize", "authorization_code_claim", "exchange", "activate", "verify", "list_credentials", "workspace_readback", "confirm_agent_registration", "runtime_lease", "current_message_read", "project_rooms_read", "notification_ack", "coordinator_status", "public_safe_memory_submit", "memory_search", "rotate", "revoke", "disconnect", "cancel" ], "type": "string" }, "actorMasterKeyId": { "description": "Present only for company-master machine actions.", "type": "string" }, "idempotentReplay": { "type": "boolean" }, "privatePayloadExposed": { "const": false }, "rawCredentialExposed": { "const": false }, "receiptId": { "type": "string" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "status": { "type": "string" } }, "required": [ "receiptId", "action", "status", "idempotentReplay", "rawCredentialExposed", "privatePayloadExposed", "scopeDigest" ], "type": "object" }, "ConnectorRotationActivationResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "rotation": { "allOf": [ { "$ref": "#/components/schemas/ConnectorRotationSummary" }, { "not": { "required": [ "activationExpiresInSeconds" ] }, "properties": { "status": { "const": "active" } } } ] }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "rotation", "approvedScopes", "scopeDigest", "receipt", "idempotentReplay", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorRotationPrepareResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "connectorCredentialSecret": { "format": "password", "readOnly": true, "type": "string" }, "credentialDeliveredToAuthorizedRecipient": { "const": true }, "credentialDelivery": { "$ref": "#/components/schemas/ConnectorCredentialDelivery" }, "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "rawCredentialPersisted": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "rotation": { "allOf": [ { "$ref": "#/components/schemas/ConnectorRotationSummary" }, { "properties": { "status": { "const": "pending_activation" } }, "required": [ "activationExpiresInSeconds" ] } ] }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "showCredentialOnce": { "const": true }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "rotation", "connectorCredentialSecret", "approvedScopes", "scopeDigest", "credentialDelivery", "receipt", "idempotentReplay", "credentialDeliveredToAuthorizedRecipient", "rawCredentialPersisted", "showCredentialOnce", "valuesRedacted", "rawPayloadExposed" ], "type": "object" }, "ConnectorRotationSummary": { "additionalProperties": false, "properties": { "activationExpiresInSeconds": { "maximum": 600, "minimum": 0, "type": "integer" }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "credentialId": { "type": "string" }, "rotationId": { "type": "string" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "status": { "enum": [ "pending_activation", "active", "expired", "canceled" ], "type": "string" } }, "required": [ "rotationId", "status", "credentialId", "approvedScopes", "scopeDigest" ], "type": "object" }, "ConnectorRuntimeLeaseInput": { "additionalProperties": false, "properties": { "action": { "enum": [ "acquire", "heartbeat", "release" ], "type": "string" }, "runtimeInstanceProof": { "pattern": "^[A-Za-z0-9_-]{43}$", "type": "string" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" } }, "required": [ "schemaVersion", "action", "runtimeInstanceProof" ], "type": "object" }, "ConnectorRuntimeLeaseResult": { "additionalProperties": false, "properties": { "active": { "type": "boolean" }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "idempotent": { "type": "boolean" }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "selfBound": { "const": true }, "status": { "enum": [ "active", "released" ], "type": "string" }, "ttlSeconds": { "maximum": 120, "minimum": 0, "type": "integer" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "status", "active", "ttlSeconds", "idempotent", "selfBound", "approvedScopes", "scopeDigest", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorScopeImpact": { "additionalProperties": false, "properties": { "impact": { "type": "string" }, "scope": { "enum": [ "connector:self:readback", "connector:self:runtime-lease", "agent:self:register", "coordination:self:current-message:read", "coordination:self:notification:ack", "coordination:project:rooms:read", "coordination:coordinator:status:write", "memory:public-safe:submit", "memory:search:read" ], "type": "string" } }, "required": [ "scope", "impact" ], "type": "object" }, "ConnectorSearchInput": { "additionalProperties": false, "properties": { "limit": { "maximum": 50, "minimum": 1, "type": "integer" }, "query": { "maxLength": 1000, "minLength": 1, "pattern": "^\\S(?:[\\s\\S]*\\S)?$", "type": "string" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" } }, "required": [ "schemaVersion", "query", "limit" ], "type": "object" }, "ConnectorSearchResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "count": { "maximum": 50, "minimum": 0, "type": "integer" }, "items": { "items": { "$ref": "#/components/schemas/ConnectorPublicMemoryItem" }, "maxItems": 50, "type": "array" }, "limit": { "maximum": 50, "minimum": 1, "type": "integer" }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "readOnly": { "const": true }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "items", "count", "limit", "readOnly", "approvedScopes", "scopeDigest", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorSelfReadbackResult": { "additionalProperties": false, "properties": { "access": { "additionalProperties": false, "properties": { "grantMutable": { "const": false }, "namePolicy": { "$ref": "#/components/schemas/ConnectorAgentNamePolicy" }, "scopeLevels": { "maxItems": 0, "type": "array" }, "scopeRule": { "const": "exact_connector_and_agent" } }, "required": [ "namePolicy", "scopeLevels", "scopeRule", "grantMutable" ], "type": "object" }, "ok": { "const": true }, "principal": { "additionalProperties": false, "properties": { "active": { "const": true }, "agentClass": { "type": [ "string", "null" ] }, "agentId": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" }, "agentIdentityId": { "type": "string" }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "canInvite": { "const": false }, "canRevoke": { "const": false }, "capabilities": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "clientId": { "enum": [ "localendpoints-connect", "remoteendpoints-connect" ], "type": "string" }, "companyId": { "type": "string" }, "connectorProfileId": { "enum": [ "localendpoints", "remoteendpoints" ], "type": "string" }, "credentialId": { "type": "string" }, "credentialStatus": { "const": "active" }, "credentialType": { "const": "connector_agent" }, "displayName": { "type": "string" }, "grant": { "additionalProperties": false, "properties": { "accessRule": { "const": "exact_connector_and_agent" }, "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "grantId": { "type": [ "string", "null" ] }, "immutable": { "const": true }, "memoryTransferFromCredentialId": { "type": [ "string", "null" ] }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "scopeId": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" }, "scopeType": { "const": "agent" }, "supersedesCredentialId": { "type": [ "string", "null" ] } }, "required": [ "grantId", "scopeType", "scopeId", "accessRule", "immutable", "approvedScopes", "scopeDigest", "supersedesCredentialId", "memoryTransferFromCredentialId" ], "type": "object" }, "grantId": { "type": [ "string", "null" ] }, "identityClass": { "type": [ "string", "null" ] }, "masterCompanyAgentCredential": { "const": false }, "ordinaryAgentCredential": { "const": false }, "permissions": { "additionalProperties": false, "properties": { "canAccessWorkspaceOperations": { "const": false }, "canAcknowledgeConnectorNotifications": { "const": true }, "canApproveAgentAccess": { "const": false }, "canConfirmConnectorAgentRegistration": { "const": true }, "canDelegateCompanyMasterCredentials": { "const": false }, "canIssueAgentInvites": { "const": false }, "canListAgentTokens": { "const": false }, "canManageCompany": { "const": false }, "canManageConnectorRuntimeLease": { "const": true }, "canRead": { "const": true }, "canReadConnectorCurrentMessages": { "const": true }, "canReadConnectorProjectRooms": { "const": true }, "canReadConnectorSelf": { "const": true }, "canRevokeAgentTokens": { "const": false }, "canSearchMemory": { "const": true }, "canSubmitPublicSafeMemory": { "const": true }, "canWrite": { "const": true }, "canWriteConnectorCoordinatorStatus": { "const": true } }, "required": [ "canRead", "canWrite", "canApproveAgentAccess", "canIssueAgentInvites", "canListAgentTokens", "canRevokeAgentTokens", "canDelegateCompanyMasterCredentials", "canManageCompany", "canAccessWorkspaceOperations", "canReadConnectorSelf", "canConfirmConnectorAgentRegistration", "canManageConnectorRuntimeLease", "canReadConnectorCurrentMessages", "canAcknowledgeConnectorNotifications", "canReadConnectorProjectRooms", "canWriteConnectorCoordinatorStatus", "canSubmitPublicSafeMemory", "canSearchMemory" ], "type": "object" }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "resourceContext": { "additionalProperties": false, "properties": { "projectId": { "type": [ "string", "null" ] }, "workspaceId": { "type": "string" } }, "required": [ "workspaceId", "projectId" ], "type": "object" }, "revoked": { "const": false }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "scopeId": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" }, "scopeType": { "const": "agent" }, "valuesRedacted": { "const": true } }, "required": [ "credentialId", "credentialType", "credentialStatus", "active", "revoked", "canInvite", "canRevoke", "ordinaryAgentCredential", "masterCompanyAgentCredential", "clientId", "connectorProfileId", "companyId", "agentIdentityId", "agentId", "displayName", "agentClass", "identityClass", "grantId", "scopeType", "scopeId", "resourceContext", "grant", "capabilities", "permissions", "approvedScopes", "scopeDigest", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "valuesRedacted": { "const": true } }, "required": [ "ok", "principal", "access", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "ConnectorSelfRegistrationInput": { "additionalProperties": false, "properties": { "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" } }, "required": [ "schemaVersion" ], "type": "object" }, "ConnectorTokenExchangeInput": { "additionalProperties": false, "properties": { "clientId": { "enum": [ "localendpoints-connect", "remoteendpoints-connect" ], "type": "string" }, "code": { "type": "string", "writeOnly": true }, "codeVerifier": { "maxLength": 128, "minLength": 43, "pattern": "^[A-Za-z0-9._~-]+$", "type": "string", "writeOnly": true }, "grantType": { "const": "authorization_code" }, "redirectUri": { "type": "string" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" } }, "required": [ "schemaVersion", "grantType", "clientId", "redirectUri", "code", "codeVerifier" ], "type": "object" }, "ConnectorTokenExchangeResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "connectorCredentialSecret": { "description": "One-time pending connector credential. Persist only in an operating-system credential vault; never log, serialize, or place in a URL.", "format": "password", "readOnly": true, "type": "string" }, "credentialDeliveredToAuthorizedRecipient": { "const": true }, "credentialDelivery": { "$ref": "#/components/schemas/ConnectorCredentialDelivery" }, "idempotentReplay": { "type": "boolean" }, "ok": { "const": true }, "pairing": { "$ref": "#/components/schemas/ConnectorPairingSummary" }, "rawCredentialPersisted": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "showCredentialOnce": { "const": true }, "valuesRedacted": { "const": true } }, "required": [ "ok", "schemaVersion", "pairing", "connectorCredentialSecret", "approvedScopes", "scopeDigest", "credentialDelivery", "receipt", "idempotentReplay", "credentialDeliveredToAuthorizedRecipient", "rawCredentialPersisted", "showCredentialOnce", "valuesRedacted", "rawPayloadExposed" ], "type": "object" }, "ConnectorWorkspaceReadbackResult": { "additionalProperties": false, "properties": { "approvedScopes": { "$ref": "#/components/schemas/ConnectorExactScopes" }, "connectorBoundedReadback": { "const": true }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "receipt": { "$ref": "#/components/schemas/ConnectorReceipt" }, "schemaVersion": { "const": "memoryendpoints.connector_pairing.v1" }, "scopeDigest": { "enum": [ "sha256-v1:ef8f2908fa064907461e56896bf5219956686ea97d2145c37f62a7ce07c87d67", "sha256-v1:5c74faddd1ca27c7e78131fc2bf3bff3e9cd27623abdd5fd0ed797ba785879af" ], "type": "string" }, "valuesRedacted": { "const": true }, "workspace": { "additionalProperties": false, "properties": { "status": { "const": "active" }, "workspaceId": { "type": "string" } }, "required": [ "workspaceId", "status" ], "type": "object" } }, "required": [ "ok", "schemaVersion", "workspace", "connectorBoundedReadback", "approvedScopes", "scopeDigest", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "GovernedMemorySubmitInput": { "description": "Broader governed MATM memory submission. schemaVersion is reserved to select the exact connector variant.", "not": { "required": [ "schemaVersion" ] }, "type": "object" }, "GovernedMemorySubmitResult": { "additionalProperties": false, "properties": { "canonicalMemoryEventId": { "type": "string" }, "confirmation": { "type": "object" }, "event": { "type": "object" }, "memoryQueryUrl": { "type": "string" }, "ok": { "const": true }, "operatorSummary": { "type": "object" }, "persisted": { "type": "boolean" }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "reviewId": { "type": [ "string", "null" ] }, "reviewQueueUrl": { "type": "string" }, "submission": { "type": "object" }, "valuesRedacted": { "const": true }, "visibleInReviewQueue": { "type": "boolean" }, "visibleInSearch": { "type": "boolean" } }, "required": [ "ok", "event", "submission", "operatorSummary", "persisted", "visibleInSearch", "visibleInReviewQueue", "canonicalMemoryEventId", "reviewId", "memoryQueryUrl", "reviewQueueUrl", "confirmation", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "GovernedSelfReadbackResult": { "additionalProperties": false, "properties": { "access": { "type": "object" }, "ok": { "const": true }, "principal": { "properties": { "credentialType": { "enum": [ "company_master", "agent_token" ], "type": "string" } }, "required": [ "credentialType" ], "type": "object" }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "valuesRedacted": { "const": true } }, "required": [ "ok", "principal", "access", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "GovernedWorkspaceReadbackResult": { "additionalProperties": false, "properties": { "ok": { "const": true }, "operatorSummary": { "type": "object" }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "valuesRedacted": { "const": true }, "workspace": { "type": "object" } }, "required": [ "ok", "workspace", "operatorSummary", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "NpcMemoryCapabilities": { "additionalProperties": false, "properties": { "activeSecurityControls": { "const": [ "authentication", "request_size_limits", "rate_limits", "abuse_controls", "secret_scanning", "prompt_injection_protection", "tenant_isolation", "schema_validation", "public_safe_validation", "idempotency" ] }, "auditHistoryAccess": { "const": false }, "billingAccess": { "const": false }, "capabilities": { "oneOf": [ { "const": [ "npc:profile:register", "npc:runtime_credential:issue", "npc:persona_package:write", "npc:persona_package:read", "npc:uaix:manage", "entitlement:self:read" ] }, { "const": [ "npc:memory:submit", "npc:memory:search", "npc:memory:readback", "npc:persona_package:read", "npc:uaix:read", "npc:retention:read" ] } ] }, "clientGeneratedRuntimeCredentials": { "const": true }, "companyDataAccessible": { "const": false }, "credentialType": { "enum": [ "npc_gateway_token", "npc_runtime_token" ] }, "documentsAccess": { "const": false }, "durableMemoryScopes": { "const": [ "npc_global", "npc_player_relationship", "npc_game_context", "npc_session_context", "npc_puzzle_state" ] }, "identityClass": { "minLength": 1, "type": "string" }, "operatorCoordinationAccess": { "const": false }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "runtimeCredentialScopeTypes": { "const": [ "game", "session" ] }, "safetyControlsRemainActive": { "const": true }, "schemaVersion": { "const": "memoryendpoints.npc_memory_capabilities.v1" }, "serverSideExactScopeMatching": { "const": true }, "settingsAccess": { "const": false }, "valuesRedacted": { "const": true }, "virtualUaixSupported": { "const": true }, "workspaceOperatorAccess": { "const": false } }, "required": [ "schemaVersion", "credentialType", "identityClass", "capabilities", "durableMemoryScopes", "runtimeCredentialScopeTypes", "serverSideExactScopeMatching", "clientGeneratedRuntimeCredentials", "virtualUaixSupported", "companyDataAccessible", "workspaceOperatorAccess", "billingAccess", "auditHistoryAccess", "documentsAccess", "settingsAccess", "operatorCoordinationAccess", "safetyControlsRemainActive", "activeSecurityControls", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "NpcMemoryCapabilitiesResponse": { "additionalProperties": false, "properties": { "data": { "$ref": "#/components/schemas/NpcMemoryCapabilities" }, "ok": { "const": true }, "rawCredentialExposed": { "const": false }, "rawPayloadExposed": { "const": false }, "valuesRedacted": { "const": true } }, "required": [ "ok", "data", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "NpcMemoryContract": { "properties": { "gatewayCapabilities": { "const": [ "npc:profile:register", "npc:runtime_credential:issue", "npc:persona_package:write", "npc:persona_package:read", "npc:uaix:manage", "entitlement:self:read" ], "type": "array" }, "runtimeCapabilities": { "const": [ "npc:memory:submit", "npc:memory:search", "npc:memory:readback", "npc:persona_package:read", "npc:uaix:read", "npc:retention:read" ], "type": "array" } }, "required": [ "gatewayCapabilities", "runtimeCapabilities" ], "type": "object" }, "NpcMemoryEventRequest": { "additionalProperties": false, "properties": { "actorAgentId": {}, "confidence": {}, "memoryType": {}, "projectId": {}, "schemaVersion": {}, "scope": {}, "scopeId": {}, "source": {}, "subject": {}, "summary": {}, "tags": {}, "title": {}, "workspaceId": {} }, "required": [ "schemaVersion", "workspaceId", "projectId", "actorAgentId", "scope", "scopeId", "title", "summary", "memoryType", "subject", "tags", "source", "confidence" ], "type": "object" }, "NpcMemoryEventResponse": { "additionalProperties": false, "properties": { "event": {}, "exactReadbackVerified": {}, "idempotentReplay": {}, "ok": {}, "persisted": {}, "rawCredentialExposed": {}, "rawPayloadExposed": {}, "receipt": {}, "valuesRedacted": {} }, "required": [ "ok", "persisted", "exactReadbackVerified", "idempotentReplay", "event", "receipt", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "NpcPersonaPackageMutationResponse": { "additionalProperties": false, "properties": { "atomicWrite": {}, "exactReadbackRequired": {}, "ok": {}, "package": {}, "persisted": {}, "rawCredentialExposed": {}, "rawPayloadExposed": {}, "valuesRedacted": {} }, "required": [ "ok", "persisted", "atomicWrite", "exactReadbackRequired", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed", "package" ], "type": "object" }, "NpcPersonaPackageReadResponse": { "additionalProperties": false, "properties": { "data": {}, "exactBindingVerified": {}, "ok": {}, "rawCredentialExposed": {}, "rawPayloadExposed": {}, "valuesRedacted": {} }, "required": [ "ok", "exactBindingVerified", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed", "data" ], "type": "object" }, "NpcPersonaPackageRequest": { "additionalProperties": false, "properties": { "agentId": {}, "files": {}, "packageHash": {}, "packageId": {}, "packageStatus": {}, "personaHash": {}, "personaId": {}, "projectId": {}, "schemaVersion": {}, "sourceAuthority": {}, "workspaceId": {} }, "required": [ "schemaVersion", "workspaceId", "projectId", "agentId", "packageId", "personaId", "personaHash", "packageStatus", "sourceAuthority", "packageHash", "files" ], "type": "object" }, "NpcProfileRequest": { "additionalProperties": false, "properties": { "agentClass": {}, "agentId": {}, "displayName": {}, "npcId": {}, "personaHash": {}, "personaId": {}, "projectId": {}, "schemaVersion": {}, "workspaceId": {} }, "required": [ "schemaVersion", "workspaceId", "projectId", "npcId", "agentId", "displayName", "personaId", "personaHash", "agentClass" ], "type": "object" }, "NpcProfileResponse": { "additionalProperties": false, "properties": { "created": {}, "ok": {}, "persisted": {}, "profile": {}, "rawCredentialExposed": {}, "rawPayloadExposed": {}, "valuesRedacted": {}, "visibleToGateway": {} }, "required": [ "ok", "profile", "created", "persisted", "visibleToGateway", "valuesRedacted", "rawCredentialExposed", "rawPayloadExposed" ], "type": "object" }, "NpcRuntimeCredentialRequest": { "additionalProperties": false, "properties": { "candidateTokenSecret": {}, "expiresInSeconds": {}, "gameScopeId": {}, "npcAgentId": {}, "playerScopeId": {}, "projectId": {}, "puzzleScopeId": {}, "schemaVersion": {}, "sessionScopeId": {}, "workspaceId": {} }, "required": [ "schemaVersion", "workspaceId", "projectId", "npcAgentId", "gameScopeId", "candidateTokenSecret", "expiresInSeconds" ], "type": "object" }, "NpcRuntimeCredentialResponse": { "additionalProperties": false, "properties": { "candidateCredentialAccepted": {}, "created": {}, "credentialReturnedByServer": {}, "idempotentReplay": {}, "ok": {}, "persisted": {}, "runtimeCredential": {} }, "required": [ "ok", "runtimeCredential", "created", "idempotentReplay", "persisted", "candidateCredentialAccepted", "credentialReturnedByServer" ], "type": "object" }, "SafeEnvelope": { "properties": { "ok": { "type": "boolean" }, "rawCredentialExposed": { "type": "boolean" }, "rawPayloadExposed": { "type": "boolean" }, "valuesRedacted": { "type": "boolean" } }, "type": "object" } }, "securitySchemes": { "adminDiagnosticsBearer": { "description": "Dedicated diagnostics credential; never an NPC or company credential.", "scheme": "bearer", "type": "http" }, "companyMasterBearer": { "bearerFormat": "company_master", "description": "Individually identified company-master machine credential used for authorized access administration, including audited registration of a client-generated sibling master. Never share it with ordinary or disposable agents.", "scheme": "bearer", "type": "http" }, "connectorBearer": { "bearerFormat": "connector_agent", "description": "Connector-and-exact-agent-scoped pending or active credential. Raw values are returned once, stored only in an OS credential vault, and never placed in URLs or logs.", "scheme": "bearer", "type": "http" }, "humanSession": { "description": "Opaque authenticated human account session with selected company membership. Mutations also require same-origin checks, Fetch Metadata, recent password reauthentication when specified, and X-CSRF-Token.", "in": "cookie", "name": "__Host-memoryendpoints-human", "type": "apiKey" }, "npcGatewayBearer": { "description": "Project-bound game-service gateway credential.", "scheme": "bearer", "type": "http" }, "npcRuntimeBearer": { "description": "NPC plus opaque game/session/player/puzzle context credential.", "scheme": "bearer", "type": "http" }, "workspaceBearer": { "description": "Workspace key supplied by the user; never echo or log.", "scheme": "bearer", "type": "http" }, "workspaceHeader": { "description": "Alternate workspace key header for browser connectors.", "in": "header", "name": "X-MemoryEndpoints-Key", "type": "apiKey" } } }, "info": { "summary": "Bounded public-safe OpenAPI-style schema for setup, hosted memory, coordination, receipts, audit, and discovery.", "title": "MemoryEndpoints MATM Golden Path API", "version": "0.1.0" }, "openapi": "3.1.0", "paths": { "/.well-known/memoryendpoints-connector": { "get": { "description": "Public, tenant-free, same-origin discovery for memoryendpoints.connector_pairing.v1. Redirects are forbidden.", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorDiscovery" } } }, "description": "Bounded connector discovery document." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." } }, "security": [], "summary": "Discover authoritative connector pairing v1", "x-maximumJsonResponseBytes": 16384, "x-noRedirects": true } }, "/api/admin/commercial-schema": { "get": { "description": "Returns only migration version/checksum, missing schema identifiers, and a store fingerprint.", "responses": { "200": { "description": "Public-safe redacted result." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "adminDiagnosticsBearer": [] } ], "summary": "Read commercial schema readiness" }, "post": { "description": "Runs duplicate preflight and applies only the build's exact version/checksum migration.", "parameters": [ { "description": "Exact retries replay; changed reuse conflicts. Never put credentials in this key.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "description": "Public-safe redacted result." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "adminDiagnosticsBearer": [] } ], "summary": "Apply exact commercial schema migration" } }, "/api/matm/access/agent-name-requests": { "get": { "description": "List redacted request metadata, optionally filtered by status.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Redacted governed-access metadata." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "List agent-name requests", "x-noRedirects": true, "x-rawCredentialExposed": false }, "post": { "description": "Creates no credential. Idempotency-Key is required because the public-safe response can be replayed without persisting secret material.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe governed-access result; exact retries replay this response." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "Request a governed agent name", "x-idempotency": "required_public_safe_replay", "x-noRedirects": true, "x-rawCredentialPersisted": false } }, "/api/matm/access/agent-name-requests/{requestId}/decision": { "post": { "description": "Approve or deny one pending request. Exact retries replay the public-safe decision metadata.", "parameters": [ { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe governed-access result; exact retries replay this response." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "Decide an agent-name request", "x-idempotency": "required_public_safe_replay", "x-noRedirects": true, "x-rawCredentialPersisted": false } }, "/api/matm/access/agent-tokens": { "get": { "description": "Company-master-only redacted credential inventory; raw credential values and verifiers are never returned.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Redacted governed-access metadata." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "List agent credential metadata", "x-noRedirects": true, "x-rawCredentialExposed": false } }, "/api/matm/access/agent-tokens/{credentialId}/revoke": { "post": { "description": "Immediately revokes one governed agent credential. The exact key and target retry replays the public-safe revoked result.", "parameters": [ { "in": "path", "name": "credentialId", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": false }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe governed-access result; exact retries replay this response." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "Revoke an agent credential", "x-idempotency": "required_public_safe_replay", "x-noRedirects": true, "x-rawCredentialPersisted": false } }, "/api/matm/access/company-master-credentials": { "get": { "description": "Company-master-only inventory. Raw credentials and verifiers are never returned.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Redacted company-master credential metadata." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "List company-master credential metadata" }, "post": { "description": "An authenticated company master may register a delegated sibling for bounded recovery or a trusted high-level company-agent handoff. An enabled company-scoped top-level agent may register a human-operator recovery master. The candidate is generated and durably staged by the client first; the server stores only an HMAC verifier and cannot reveal plaintext later. This is not the one-time ordinary-agent invitation route. Lower-scoped agents, connectors, invite credentials, and human sessions are denied.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "candidateTokenSecret": { "pattern": "^me_master_v1\\.masterkey-[0-9a-f]{20}\\.[A-Za-z0-9_-]{43}$", "type": "string", "writeOnly": true }, "label": { "maxLength": 80, "minLength": 1, "type": "string" }, "principalName": { "maxLength": 80, "minLength": 1, "type": "string" }, "schemaVersion": { "enum": [ "memoryendpoints.company_master_delegation.v1", "memoryendpoints.top_level_agent_company_master.v1" ] }, "workspaceId": { "type": "string" } }, "required": [ "schemaVersion", "workspaceId", "candidateTokenSecret", "label", "principalName" ], "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Exact idempotent replay; metadata only." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Candidate accepted and verifier stored atomically; metadata only." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] }, { "workspaceBearer": [] } ], "summary": "Register a client-generated durable sibling company master", "x-idempotency": "Exact key/body retry replays the metadata result; changed reuse is a conflict-safe no-op.", "x-noRedirects": true, "x-rawCredentialPersisted": false } }, "/api/matm/access/invites": { "get": { "description": "List current invitation IDs, request IDs, status, scope, and expiry without any raw invitation secret.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Redacted governed-access metadata." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "List invitation metadata", "x-noRedirects": true, "x-rawCredentialExposed": false }, "post": { "description": "Returns one fragment-only invitation URL once. Idempotency-Key is forbidden because raw invitation material is never persisted or replayed. After an unknown outcome, list metadata, revoke the issued invite idempotently, then issue a replacement from the same approved request.", "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "One-time secret response. Store it immediately; it cannot be replayed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "410": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "Issue a one-time agent invitation", "x-idempotency": "forbidden_one_time_secret_response", "x-idempotencyHeaderAllowed": false, "x-noRedirects": true, "x-rawCredentialPersisted": false } }, "/api/matm/access/invites/redeem": { "post": { "description": "Consumes the body-only invitation secret and returns one agent credential once. Idempotency-Key is forbidden; a successful response cannot be replayed.", "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "One-time secret response. Store it immediately; it cannot be replayed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "410": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [], "summary": "Redeem a one-time agent invitation", "x-idempotency": "forbidden_one_time_secret_response", "x-idempotencyHeaderAllowed": false, "x-noRedirects": true, "x-rawCredentialPersisted": false } }, "/api/matm/access/invites/{inviteId}/revoke": { "post": { "description": "Revokes an issued invitation. The exact key and target retry replays public-safe revoked metadata.", "parameters": [ { "in": "path", "name": "inviteId", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": false }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe governed-access result; exact retries replay this response." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "Revoke an invitation", "x-idempotency": "required_public_safe_replay", "x-noRedirects": true, "x-rawCredentialPersisted": false } }, "/api/matm/access/scope-catalog": { "get": { "description": "Company-master-only catalog used to choose an immutable company, workspace, project, game, session, goal, or task grant.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Redacted governed-access metadata." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "503": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "companyMasterBearer": [] } ], "summary": "List governed grant scopes", "x-noRedirects": true, "x-rawCredentialExposed": false } }, "/api/matm/agent-compatibility": { "get": { "description": "L0-L7 agent ability levels, route-record guidance, fallback policy, and UAIX dogfood feedback.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "summary": "Read agent compatibility contract" } }, "/api/matm/agent-messages": { "post": { "description": "Workspace credentials may use the governed current-message operation. A connector credential may submit only the exact public-safe coordinator-status schema, to the server-selected coordinator, with its status-write scope and active runtime lease.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ConnectorCoordinatorStatusInput" }, { "type": "object" } ] } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Governed current-message result." }, "202": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorCoordinatorStatusResult" } } }, "description": "Connector coordinator status accepted and persisted." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "connectorBearer": [] }, { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Send an authorized current message or connector coordinator status", "x-connectorRuntimeLeaseRequired": true, "x-noRedirects": true, "x-requiredConnectorScope": "coordination:coordinator:status:write" } }, "/api/matm/agent-setup/dogfood-partner-account": { "post": { "description": "Consumes one configured setup binding and accepts a client-generated gateway candidate; the server never returns the credential.", "parameters": [ { "description": "Exact retries replay; changed reuse conflicts. Never put credentials in this key.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "description": "Public-safe redacted result." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [], "summary": "Activate bounded dogfood partner" } }, "/api/matm/agent-setup/free-account": { "get": { "description": "Read quota, hierarchy, and one-time key handling rules.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "summary": "Inspect free workspace setup" }, "post": { "description": "Returns a one-time workspace key. Clients must mask it immediately and store it only in a user-approved secret store.", "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": false }, "responses": { "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Workspace created; one-time workspace key returned once." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "summary": "Create free workspace" } }, "/api/matm/agents/register": { "post": { "description": "An activated connector credential may only idempotently confirm its already-bound localendpoint-agent identity with the exact one-field body. Company-master registration is rejected; ordinary agents use the governed invitation flow.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorSelfRegistrationInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorAgentRegistrationResult" } } }, "description": "Connector self-registration confirmed without minting a credential." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] } ], "summary": "Confirm connector self-registration", "x-idempotency": "Exact retry is stable; changed key/body reuse is rejected without mutation.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true, "x-rateLimit": { "limit": 5, "partition": "connector_credential", "windowSeconds": 600 } } }, "/api/matm/audit-log": { "get": { "description": "Routine operational logs are never returned to agent or company-master credentials; use the human-only retained-history control plane.", "responses": { "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Agent audit access denied" } }, "/api/matm/connector-agent-leases/{agentId}": { "get": { "description": "Returns only available/conflict state for a registered connector identity and never exposes the holder.", "parameters": [ { "in": "path", "name": "agentId", "required": true, "schema": { "enum": [ "localendpoint-agent", "remoteendpoints-agent" ], "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Redacted lease availability." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [], "summary": "Preflight an active connector identity lease", "x-noRedirects": true } }, "/api/matm/connector-bootstrap/profiles/{profileId}": { "get": { "description": "Exact secret-free LocalEndpoints or RemoteEndpoints declarative profile bytes.", "parameters": [ { "in": "path", "name": "profileId", "required": true, "schema": { "enum": [ "localendpoints", "remoteendpoints" ], "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Hashable connector profile handoff." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [], "summary": "Download one registered connector profile handoff", "x-noRedirects": true } }, "/api/matm/connector-bootstrap/windows.py": { "get": { "description": "Dependency-free public-safe source. Each profile handoff pins the exact bytes and size; the helper accepts no credential argument or environment variable.", "responses": { "200": { "content": { "text/x-python": { "schema": { "type": "string" } } }, "description": "Python source with SHA-256 and ETag headers." } }, "security": [], "summary": "Download the hash-pinned Windows connector bootstrap", "x-noRedirects": true } }, "/api/matm/connector-contract": { "get": { "description": "Public memoryendpoints.connector_pairing.v1 flow, routes, schemas, security, retry, lifecycle, rate-limit, and synthetic-example contract.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "summary": "Read connector pairing contract" } }, "/api/matm/connector-pairings/authorization-code-claims": { "post": { "description": "After human approval, prove the desktop-held request proof and state binding. Pending approval returns 202 with Retry-After and does not reserve the idempotency key. First success binds the exact key/body; exact retry rederives one code before exchange; any changed body or key conflicts.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorAuthorizationCodeClaimInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorAuthorizationCodeClaimResult" } } }, "description": "One-use body-only authorization code and stateVerified=true." }, "202": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorAuthorizationCodeClaimPending" } } }, "description": "Human approval is pending; the idempotency key is not reserved.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [], "summary": "Claim body-only connector authorization code", "x-idempotency": "First approved success atomically binds exact key/body; exact retry rederives before exchange; any changed body or different key returns 409 idempotency_conflict.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-pairings/requests": { "post": { "description": "Bind desktop-generated state and PKCE S256 challenge to one exact registered profile and canonical agent request. Creates no workspace, agent, or credential.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorPairingRequestInput" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorPairingRequestResult" } } }, "description": "Redacted, no-store connector pairing result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [], "summary": "Create connector pairing request", "x-idempotency": "Exact retry replays; changed key reuse is a conflict-safe no-op.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-pairings/token": { "post": { "description": "Exchange a short-lived one-use code directly with its PKCE verifier. Exact retry can recover the same pending secret until activation; changed replay is rejected.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorTokenExchangeInput" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorTokenExchangeResult" } } }, "description": "Redacted, no-store connector pairing result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [], "summary": "Exchange connector authorization code", "x-idempotency": "Exact retry replays; changed key reuse is a conflict-safe no-op.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-pairings/{pairingId}": { "get": { "description": "Exact readback proving canonical workspace and agent readability, connector-and-agent scope, and active/non-revoked grant state without raw credential or private payload exposure.", "parameters": [ { "in": "path", "name": "pairingId", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorPairingVerification" } } }, "description": "Exact redacted verification result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] } ], "summary": "Verify connector pairing", "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true, "x-rateLimit": { "limit": 60, "partition": "connector_credential", "windowSeconds": 60 } } }, "/api/matm/connector-pairings/{pairingId}/activate": { "post": { "description": "Activate only after the desktop has stored the pending credential securely. Commits a provisional workspace and exact agent registration atomically.", "parameters": [ { "in": "path", "name": "pairingId", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorActivationInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorPairingMutationResult" } } }, "description": "Redacted, no-store connector pairing result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] } ], "summary": "Activate pending connector grant", "x-idempotency": "Exact retry replays; changed key reuse is a conflict-safe no-op.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-pairings/{pairingId}/cancel": { "post": { "description": "Cancel after secure-store failure or user abandonment. The pending credential can never activate and provisional resources remain non-durable.", "parameters": [ { "in": "path", "name": "pairingId", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorLifecycleReasonInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorPairingMutationResult" } } }, "description": "Redacted, no-store connector pairing result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] } ], "summary": "Cancel pending connector pairing", "x-idempotency": "Exact retry replays; changed key reuse is a conflict-safe no-op.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-pairings/{pairingId}/credentials": { "get": { "description": "Redacted credential inventory for the active exact connector or a company master for the pairing company. Foreign pairings and companies are concealed as 404. No raw credential, hash, or verifier is returned.", "parameters": [ { "in": "path", "name": "pairingId", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorCredentialListResult" } } }, "description": "Redacted credential metadata and deterministic list_credentials receipt." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] }, { "companyMasterBearer": [] } ], "summary": "List connector credential lifecycle metadata", "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true, "x-rateLimit": { "limit": 60, "partition": "connector_credential", "windowSeconds": 60 } } }, "/api/matm/connector-pairings/{pairingId}/disconnect": { "post": { "description": "Immediately revoke the calling active connector credential. Exact retries are safe no-ops.", "parameters": [ { "in": "path", "name": "pairingId", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorLifecycleReasonInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorPairingMutationResult" } } }, "description": "Redacted, no-store connector pairing result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] } ], "summary": "Disconnect connector", "x-idempotency": "Exact retry replays; changed key reuse is a conflict-safe no-op.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-pairings/{pairingId}/revoke": { "post": { "description": "Company-master machine action. Immediately revokes the pairing and attributes the redacted receipt to masterKeyId.", "parameters": [ { "in": "path", "name": "pairingId", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorLifecycleReasonInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorPairingMutationResult" } } }, "description": "Redacted, no-store connector pairing result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "companyMasterBearer": [] } ], "summary": "Revoke connector pairing", "x-idempotency": "Exact retry replays; changed key reuse is a conflict-safe no-op.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-pairings/{pairingId}/rotations": { "post": { "description": "Reveal a pending successor once while the current credential remains active. Exact retry recovers the same pending successor until activation.", "parameters": [ { "in": "path", "name": "pairingId", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorLifecycleReasonInput" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorRotationPrepareResult" } } }, "description": "Redacted, no-store connector pairing result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] } ], "summary": "Prepare connector credential rotation", "x-idempotency": "Exact retry replays; changed key reuse is a conflict-safe no-op.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-pairings/{pairingId}/rotations/{rotationId}/activate": { "post": { "description": "Use the stored pending successor to atomically activate it and revoke the predecessor.", "parameters": [ { "in": "path", "name": "pairingId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "rotationId", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorActivationInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorRotationActivationResult" } } }, "description": "Redacted, no-store connector pairing result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] } ], "summary": "Activate connector credential rotation", "x-idempotency": "Exact retry replays; changed key reuse is a conflict-safe no-op.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-pairings/{publicRequestRef}/master-approve": { "post": { "description": "Automated bootstrap-only approval. The company-master bearer authorizes the exact registered profile, exact nine scopes, exact workspace from its protected credential file, and a canonical project selector that must resolve to exactly one active project. The response exposes no tenant identifier or credential.", "parameters": [ { "in": "path", "name": "publicRequestRef", "required": true, "schema": { "pattern": "^pairref_[A-Za-z0-9_-]{43}$", "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorMasterApprovalInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorMasterApprovalResult" } } }, "description": "Exact profile approved and immediately ready for the desktop-held authorization-code claim." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "companyMasterBearer": [] } ], "summary": "Approve one connector profile with protected company-master authority", "x-bootstrapAuthorityRetainedAsRuntimeCredential": false, "x-idempotency": "Exact key and body retry returns the same redacted approval. A changed key/body is rejected and cannot mint a second authorization code.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/connector-runtime-lease": { "post": { "description": "Acquire, heartbeat, or release the calling connector identity's 120-second process lease using a body-only random instance proof. A different live proof fails closed.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorRuntimeLeaseInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorRuntimeLeaseResult" } } }, "description": "Redacted lease status and TTL." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] } ], "summary": "Manage the exact connector runtime lease", "x-noRedirects": true, "x-requiredConnectorScope": "connector:self:runtime-lease" } }, "/api/matm/current-message": { "get": { "description": "Workspace credentials use explicit query binding. A connector credential supplies no query and receives only the server-bound canonical connector agent inbox with its read scope and active runtime lease.", "parameters": [ { "description": "Workspace-credential binding; forbidden for connector credentials.", "in": "query", "name": "workspace_id", "required": false, "schema": { "type": "string" } }, { "description": "Workspace-credential filter; forbidden for connector credentials.", "in": "query", "name": "agent_id", "required": false, "schema": { "type": "string" } }, { "description": "Workspace-credential filter; forbidden for connector credentials.", "in": "query", "name": "message_id", "required": false, "schema": { "type": "string" } }, { "description": "Workspace-credential filter; forbidden for connector credentials.", "in": "query", "name": "notification_id", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ConnectorCurrentMessageResult" }, { "type": "object" } ] } } }, "description": "Credential-specific bounded inbox readback." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "connectorBearer": [] }, { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read authorized current messages", "x-connectorRuntimeLeaseRequired": true, "x-noRedirects": true, "x-requiredConnectorScope": "coordination:self:current-message:read" } }, "/api/matm/external-links": { "get": { "description": "Search first-class reviewed external links and their knowledge-document citations.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } }, { "description": "Contextual query over URL, host, site, page title, description, keywords, and citation context.", "in": "query", "name": "q", "required": false, "schema": { "type": "string" } }, { "description": "Exact canonical external link id.", "in": "query", "name": "external_link_id", "required": false, "schema": { "type": "string" } }, { "description": "Only links cited by this knowledge document.", "in": "query", "name": "document_id", "required": false, "schema": { "type": "string" } }, { "description": "Exact normalized public host.", "in": "query", "name": "host", "required": false, "schema": { "type": "string" } }, { "description": "Human-readable site name filter.", "in": "query", "name": "site_name", "required": false, "schema": { "type": "string" } }, { "description": "External-link review status.", "in": "query", "name": "review_status", "required": false, "schema": { "type": "string" } }, { "description": "External-link crawl status.", "in": "query", "name": "crawl_status", "required": false, "schema": { "type": "string" } }, { "description": "Citation relationship type.", "in": "query", "name": "relationship_type", "required": false, "schema": { "type": "string" } }, { "description": "Scope of citing knowledge pages.", "in": "query", "name": "scope", "required": false, "schema": { "enum": [ "company", "workspace", "project" ], "type": "string" } }, { "description": "Exact scope id of citing knowledge pages.", "in": "query", "name": "scope_id", "required": false, "schema": { "type": "string" } }, { "description": "Taxonomy prefix of citing knowledge pages.", "in": "query", "name": "taxonomy_path", "required": false, "schema": { "type": "string" } }, { "description": "Result limit, capped by the server.", "in": "query", "name": "limit", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Search external links" }, "post": { "description": "Store one canonical external link and optionally attach one contextual knowledge-document citation.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Upsert external link" } }, "/api/matm/external-links/upsert": { "post": { "description": "Idempotent protected alias for external-link and citation upsert.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Upsert external link" } }, "/api/matm/human/companies/{companyId}/history": { "get": { "description": "Requires an authenticated same-origin human session with the company selected. Routine rows are physically deleted after seven days and are never returned to agents.", "parameters": [ { "in": "path", "name": "companyId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "limit", "required": false, "schema": { "maximum": 5000, "minimum": 1, "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Currently retained redacted human-only history." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "humanSession": [] } ], "summary": "Read human-only retained history", "x-agentAccess": "denied", "x-physicallyDeletedAfterRetention": true, "x-retentionDays": 7 } }, "/api/matm/human/companies/{companyId}/top-level-agent-master-credential-setting": { "get": { "description": "Requires an authenticated human owner or credential administrator with the company selected. Returns the standard database-backed boolean without credential material.", "parameters": [ { "in": "path", "name": "companyId", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Current redacted setting and database column name." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "humanSession": [] } ], "summary": "Read top-level agent company-master setting", "x-agentAccess": "denied" }, "patch": { "description": "Same-origin owner or credential-admin mutation. Disable to reject company-scoped top-level-agent creation while leaving existing company masters active.", "parameters": [ { "in": "path", "name": "companyId", "required": true, "schema": { "type": "string" } }, { "description": "In-memory CSRF token bound to the authenticated human account session.", "in": "header", "name": "X-CSRF-Token", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ], "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Updated redacted setting." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "415": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "humanSession": [] } ], "summary": "Set top-level agent company-master permission", "x-agentAccess": "denied", "x-databaseColumn": "top_level_agent_master_credential_enabled" } }, "/api/matm/human/connector-pairings/{publicRequestRef}/approve": { "post": { "description": "Requires authenticated selected human company membership, recent password reauthentication, same-origin/Fetch-Metadata validation, and CSRF. Existing workspace is selected explicitly; new workspace remains provisional until activation.", "parameters": [ { "in": "path", "name": "publicRequestRef", "required": true, "schema": { "pattern": "^pairref_[A-Za-z0-9_-]{43}$", "type": "string" } }, { "description": "In-memory CSRF token bound to the authenticated human account session.", "in": "header", "name": "X-CSRF-Token", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorApprovalInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorApprovalResult" } } }, "description": "Approved awaiting desktop claim; wakeUpUrl is parameter-free and non-authorizing." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "humanSession": [] } ], "summary": "Approve connector pairing", "x-idempotency": "Idempotency-Key is required. Exact retry returns the same approval and parameter-free wakeUpUrl; approval never creates or returns a code.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536 } }, "/api/matm/human/connector-pairings/{publicRequestRef}/cancel": { "post": { "description": "Cancel a still-pending human approval request before any authorization code, credential, agent, or workspace grant exists.", "parameters": [ { "in": "path", "name": "publicRequestRef", "required": true, "schema": { "pattern": "^pairref_[A-Za-z0-9_-]{43}$", "type": "string" } }, { "description": "In-memory CSRF token bound to the authenticated human account session.", "in": "header", "name": "X-CSRF-Token", "required": true, "schema": { "type": "string" } }, { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorLifecycleReasonInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorPairingRequestMutationResult" } } }, "description": "Redacted, no-store connector pairing result." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "humanSession": [] } ], "summary": "Cancel connector approval request", "x-idempotency": "Exact retry replays; changed key reuse is a conflict-safe no-op.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/human/connector-pairings/{publicRequestRef}/company-selection": { "post": { "description": "Resolve a short-lived session/request-bound companyRef, rotate the human account session and CSRF token, and expose no authorityId/companyId to the authorize client.", "parameters": [ { "in": "path", "name": "publicRequestRef", "required": true, "schema": { "pattern": "^pairref_[A-Za-z0-9_-]{43}$", "type": "string" } }, { "description": "In-memory CSRF token bound to the authenticated human account session.", "in": "header", "name": "X-CSRF-Token", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorCompanySelectionInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorCompanySelectionResult" } } }, "description": "Complete rotated human-session envelope with one-time CSRF value." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "humanSession": [] } ], "summary": "Select an opaque connector approval company", "x-idempotency": "No Idempotency-Key. A lost response is recovered by reloading the authorize page under the already-rotated host-only session cookie.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536 } }, "/api/matm/internet-search": { "get": { "description": "Search reviewed URL, site, page title, description, keywords, and citation context as an authenticated internet-search index.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } }, { "description": "Contextual query over URL, host, site, page title, description, keywords, and citation context.", "in": "query", "name": "q", "required": false, "schema": { "type": "string" } }, { "description": "Exact canonical external link id.", "in": "query", "name": "external_link_id", "required": false, "schema": { "type": "string" } }, { "description": "Only links cited by this knowledge document.", "in": "query", "name": "document_id", "required": false, "schema": { "type": "string" } }, { "description": "Exact normalized public host.", "in": "query", "name": "host", "required": false, "schema": { "type": "string" } }, { "description": "Human-readable site name filter.", "in": "query", "name": "site_name", "required": false, "schema": { "type": "string" } }, { "description": "External-link review status.", "in": "query", "name": "review_status", "required": false, "schema": { "type": "string" } }, { "description": "External-link crawl status.", "in": "query", "name": "crawl_status", "required": false, "schema": { "type": "string" } }, { "description": "Citation relationship type.", "in": "query", "name": "relationship_type", "required": false, "schema": { "type": "string" } }, { "description": "Scope of citing knowledge pages.", "in": "query", "name": "scope", "required": false, "schema": { "enum": [ "company", "workspace", "project" ], "type": "string" } }, { "description": "Exact scope id of citing knowledge pages.", "in": "query", "name": "scope_id", "required": false, "schema": { "type": "string" } }, { "description": "Taxonomy prefix of citing knowledge pages.", "in": "query", "name": "taxonomy_path", "required": false, "schema": { "type": "string" } }, { "description": "Result limit, capped by the server.", "in": "query", "name": "limit", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Search curated web" } }, "/api/matm/knowledge-documents": { "get": { "description": "Search or retrieve lifecycle-aware protected database wiki documents by text, scope, category, type, status, authority, source prefix, or exact document id.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } }, { "description": "Protected text query over database wiki rows.", "in": "query", "name": "q", "required": false, "schema": { "type": "string" } }, { "description": "Durable wiki scope filter. Task scope is intentionally unsupported.", "in": "query", "name": "scope", "required": false, "schema": { "enum": [ "company", "workspace", "project" ], "type": "string" } }, { "description": "Exact company, workspace, or project scope id.", "in": "query", "name": "scope_id", "required": false, "schema": { "type": "string" } }, { "description": "Knowledge category filter.", "in": "query", "name": "category", "required": false, "schema": { "type": "string" } }, { "description": "Hierarchy path prefix filter, such as AI infrastructure > tokenization.", "in": "query", "name": "taxonomy_path", "required": false, "schema": { "type": "string" } }, { "description": "Knowledge document type filter.", "in": "query", "name": "document_type", "required": false, "schema": { "type": "string" } }, { "description": "Source URI prefix filter.", "in": "query", "name": "source_prefix", "required": false, "schema": { "type": "string" } }, { "description": "Exact search document id for deterministic page retrieval.", "in": "query", "name": "document_id", "required": false, "schema": { "type": "string" } }, { "description": "Exact private wiki route for deterministic internal-link traversal.", "in": "query", "name": "route_or_path", "required": false, "schema": { "type": "string" } }, { "description": "When true, include protected stored document text.", "in": "query", "name": "include_text", "required": false, "schema": { "type": "boolean" } }, { "description": "Result limit, capped by the server.", "in": "query", "name": "limit", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Search knowledge documents" }, "post": { "description": "Store a protected database wiki document with first-class lifecycle, authority, and supersession fields.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Upsert knowledge document" } }, "/api/matm/knowledge-documents/upsert": { "post": { "description": "Idempotent protected alias for lifecycle-aware database wiki document upsert.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Upsert knowledge document" } }, "/api/matm/knowledge-tree": { "get": { "description": "Read the lifecycle-aware database-backed company/workspace/project wiki tree. Task-level durable trees are not supported.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } }, { "description": "Protected text query over database wiki rows.", "in": "query", "name": "q", "required": false, "schema": { "type": "string" } }, { "description": "Durable wiki scope filter. Task scope is intentionally unsupported.", "in": "query", "name": "scope", "required": false, "schema": { "enum": [ "company", "workspace", "project" ], "type": "string" } }, { "description": "Exact company, workspace, or project scope id.", "in": "query", "name": "scope_id", "required": false, "schema": { "type": "string" } }, { "description": "Knowledge category filter.", "in": "query", "name": "category", "required": false, "schema": { "type": "string" } }, { "description": "Hierarchy path prefix filter, such as AI infrastructure > tokenization.", "in": "query", "name": "taxonomy_path", "required": false, "schema": { "type": "string" } }, { "description": "Knowledge document type filter.", "in": "query", "name": "document_type", "required": false, "schema": { "type": "string" } }, { "description": "Source URI prefix filter.", "in": "query", "name": "source_prefix", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read knowledge tree" } }, "/api/matm/live-capability-matrix": { "get": { "description": "Current public capability state and truth boundaries.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "summary": "Read capability matrix" } }, "/api/matm/me": { "get": { "description": "Returns the authenticated principal, immutable grant, exact capabilities, permissions, and resource context. Connector credentials receive the ordered nine approved scopes and profile-bound scope digest; no caller-supplied actor or tenant id is accepted.", "responses": { "200": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ConnectorSelfReadbackResult" }, { "$ref": "#/components/schemas/GovernedSelfReadbackResult" } ] } } }, "description": "Credential-derived, redacted principal readback selected by the credentialType discriminator." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] }, { "companyMasterBearer": [] }, { "workspaceBearer": [] }, { "workspaceHeader": [] }, { "npcGatewayBearer": [] } ], "summary": "Read credential-derived principal", "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/api/matm/meeting-messages": { "get": { "description": "Read durable room transcript and read-state summary.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read meeting transcript" }, "post": { "description": "Post a public-safe coordination note to a room.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Post meeting message" } }, "/api/matm/meeting-messages/promote": { "post": { "description": "Promote a public-safe meeting note into hosted memory while preserving source linkage.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Promote meeting message" } }, "/api/matm/meeting-rooms": { "get": { "description": "Workspace credentials use explicit workspace query binding. A connector credential supplies no query and receives only rooms for its server-bound exact project; an active connector runtime lease is required.", "parameters": [ { "description": "Required for workspace credentials and forbidden for connector credentials.", "in": "query", "name": "workspace_id", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ConnectorProjectRoomsResult" }, { "type": "object" } ] } } }, "description": "Credential-specific bounded room readback." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "connectorBearer": [] }, { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "List authorized meeting rooms", "x-connectorRuntimeLeaseRequired": true, "x-noRedirects": true, "x-requiredConnectorScope": "coordination:project:rooms:read" }, "post": { "description": "Create first-class goal/task/game/session coordination room.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Create custom meeting room" } }, "/api/matm/meeting-rooms/read": { "post": { "description": "Advance an agent read cursor for a room.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Mark meeting room read" } }, "/api/matm/memory-events/submit": { "post": { "description": "Connector credentials must use the exact ConnectorPublicSafeMemoryInput body. The server derives workspace and actor=self from the credential, rejects private/raw payloads, and never accepts caller-supplied tenant or actor ids.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ConnectorPublicSafeMemoryInput" }, { "$ref": "#/components/schemas/GovernedMemorySubmitInput" } ] } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ConnectorPublicSafeMemoryResult" }, { "$ref": "#/components/schemas/GovernedMemorySubmitResult" } ] } } }, "description": "Memory accepted under the disjoint connector or broader-governed response contract." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] }, { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Submit public-safe memory", "x-idempotency": "Exact retry replays one stored public-safe result; changed key/body reuse is rejected without another write.", "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true, "x-rateLimit": { "limit": 60, "partition": "connector_credential", "windowSeconds": 60 } } }, "/api/matm/notifications/ack": { "post": { "description": "Workspace credentials use the governed acknowledgement body. A connector credential may acknowledge only a notification addressed to its canonical agent using the exact connector schema, its acknowledgement scope, and an active runtime lease.", "parameters": [ { "description": "High-entropy request key. Exact key/body retry replays the original result; changed reuse returns 409. Never include credentials.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ConnectorNotificationAckInput" }, { "type": "object" } ] } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ConnectorNotificationAckResult" }, { "type": "object" } ] } } }, "description": "Credential-specific acknowledgement result." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "403": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "connectorBearer": [] }, { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Acknowledge an authorized notification", "x-connectorRuntimeLeaseRequired": true, "x-noRedirects": true, "x-requiredConnectorScope": "coordination:self:notification:ack" } }, "/api/matm/npc-memory/capabilities": { "get": { "description": "Reports credential-class capabilities and security controls that remain active.", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcMemoryCapabilitiesResponse" } } }, "description": "Closed public-safe NPC capability readback." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "npcGatewayBearer": [] }, { "npcRuntimeBearer": [] } ], "summary": "Read NPC capabilities" } }, "/api/matm/npc-memory/contract": { "get": { "description": "Start here. This document defines exact durable scopes, identity classes, route ownership, security controls, and authority boundaries.", "responses": { "200": { "content": { "application/json": { "schema": { "properties": { "data": { "$ref": "#/components/schemas/NpcMemoryContract" }, "ok": { "const": true } }, "required": [ "ok", "data" ], "type": "object" } } }, "description": "Public-safe NPC-memory contract with exact ordered credential capabilities." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [], "summary": "Read hosted NPC-memory contract" } }, "/api/matm/npc-memory/events/submit": { "post": { "description": "Requires one of the five durable memory types, exact protected tags, canonical source suffix, and public-safe content.", "parameters": [ { "description": "Exact retries replay; changed reuse conflicts. Never put credentials in this key.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcMemoryEventRequest" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcMemoryEventResponse" } } }, "description": "Closed public-safe response." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "npcRuntimeBearer": [] } ], "summary": "Submit exact scoped NPC memory" } }, "/api/matm/npc-memory/persona-packages": { "get": { "description": "Requires exact agent, package, and package hash filters. Supplying logical path and content hash together returns one immutable historical file revision. Runtime credentials may read only their own NPC.", "parameters": [ { "in": "query", "name": "agent_id", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "package_id", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "package_hash", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "logical_path", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "content_hash", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcPersonaPackageReadResponse" } } }, "description": "Closed exact-binding persona-package readback." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "npcGatewayBearer": [] }, { "npcRuntimeBearer": [] } ], "summary": "Read exact NPC persona package" }, "post": { "description": "Gateway-only atomic publication of the complete UAIX base record set plus advanced personality-pack records into the canonical database model. Lossless UAIX file import/export, package/file SHA-256 verification, and immutable per-path revisions preserve the source persona; persona records are excluded from learned-memory search.", "parameters": [ { "description": "Exact retries replay; changed reuse conflicts. Never put credentials in this key.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcPersonaPackageRequest" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcPersonaPackageMutationResponse" } } }, "description": "Closed public-safe response." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "npcGatewayBearer": [] } ], "summary": "Publish closed NPC persona package" } }, "/api/matm/npc-memory/profiles": { "post": { "description": "Binds one stable NPC and SpiralistAI persona digest inside the gateway project.", "parameters": [ { "description": "Exact retries replay; changed reuse conflicts. Never put credentials in this key.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcProfileRequest" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcProfileResponse" } } }, "description": "Closed public-safe response." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "npcGatewayBearer": [] } ], "summary": "Register stable NPC profile" } }, "/api/matm/npc-memory/retention": { "get": { "description": "Reports supported retention/deletion scopes and truthfully identifies operator-only or unavailable mutations.", "responses": { "200": { "description": "Public-safe redacted result." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "npcRuntimeBearer": [] } ], "summary": "Read retention capabilities" } }, "/api/matm/npc-memory/runtime-credentials": { "post": { "description": "Accepts a client-generated candidate bound to exact opaque runtime context for at most 24 hours.", "parameters": [ { "description": "Exact retries replay; changed reuse conflicts. Never put credentials in this key.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcRuntimeCredentialRequest" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NpcRuntimeCredentialResponse" } } }, "description": "Closed public-safe response." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "npcGatewayBearer": [] } ], "summary": "Register NPC runtime credential" } }, "/api/matm/npc-memory/search": { "get": { "description": "Requires actor, project, source prefix, scope type/key, and every protected context tag to match the runtime credential.", "parameters": [ { "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "project_id", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "scope", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "scope_id", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "actor_agent_id", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "source_prefix", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "tag", "required": true, "schema": { "items": { "type": "string" }, "type": "array" } }, { "in": "query", "name": "limit", "required": true, "schema": { "type": "integer" } }, { "in": "query", "name": "q", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "event_id", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Public-safe redacted result." }, "400": { "description": "Malformed request; no unsafe effect." }, "401": { "description": "Credential invalid, expired, or inactive." }, "403": { "description": "Immutable actor, project, or context scope mismatch." }, "409": { "description": "Immutable binding or idempotency conflict." }, "503": { "description": "Entitlement, rate limiter, or commercial schema is not safely ready." } }, "security": [ { "npcRuntimeBearer": [] } ], "summary": "Search exact scoped NPC memory" } }, "/api/matm/projects": { "get": { "description": "List project records in the authenticated workspace hierarchy.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "List projects" }, "post": { "description": "Create or update a real project record before project-scoped wiki indexing.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Upsert project" } }, "/api/matm/readiness-result": { "get": { "description": "Current readiness evidence without certification overclaim.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "summary": "Read readiness result" } }, "/api/matm/receipts": { "get": { "description": "Read redacted acknowledgement receipts for an agent.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read receipts" } }, "/api/matm/review-queue": { "get": { "description": "Read memory review and long-term-memory promotion health without parsing raw debug JSON.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read review queue" } }, "/api/matm/review-queue/decide": { "post": { "description": "Promote, reject, or quarantine a review-pending memory item with idempotent reviewer action.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Decide review" } }, "/api/matm/route-inventory": { "get": { "description": "Public and protected route inventory with access boundaries.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "summary": "Read route inventory" } }, "/api/matm/routing-decisions": { "get": { "description": "Read machine-readable coordinator routing decisions by room, lane, agent, destination, or status.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read routing decisions" }, "post": { "description": "Persist lane, destination room, specific goal, expected evidence, next action, and support plan.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Create routing decision" } }, "/api/matm/search": { "get": { "description": "Search scoped hosted workspace memory using query, exact event id, scope, source prefix, tag, memory type, review status, and promotion filters.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } }, { "description": "Public-safe text query. Leave blank when using an exact event_id readback.", "in": "query", "name": "q", "required": false, "schema": { "type": "string" } }, { "description": "Exact memory event id for deterministic post-submit readback.", "in": "query", "name": "event_id", "required": false, "schema": { "type": "string" } }, { "description": "Exact memory scope filter.", "in": "query", "name": "scope", "required": false, "schema": { "enum": [ "company", "workspace", "project", "game", "session", "goal", "task" ], "type": "string" } }, { "description": "Exact scope id filter.", "in": "query", "name": "scope_id", "required": false, "schema": { "type": "string" } }, { "description": "Source URI prefix filter.", "in": "query", "name": "source_prefix", "required": false, "schema": { "type": "string" } }, { "description": "Exact tag filter.", "in": "query", "name": "tag", "required": false, "schema": { "type": "string" } }, { "description": "Exact actor agent id filter.", "in": "query", "name": "actor_agent_id", "required": false, "schema": { "type": "string" } }, { "description": "Exact memory type filter.", "in": "query", "name": "memory_type", "required": false, "schema": { "enum": [ "fact", "decision", "status", "procedure", "risk", "evidence", "handoff", "note" ], "type": "string" } }, { "description": "Review status filter.", "in": "query", "name": "review_status", "required": false, "schema": { "type": "string" } }, { "description": "Promotion state filter.", "in": "query", "name": "promotion_state", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Search hosted memory" }, "post": { "description": "Body-only, read-only connector search. The exact body contains only schemaVersion, query, and limit; query strings and Idempotency-Key are forbidden. Results stay within the credential-derived workspace/agent boundary.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorSearchInput" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorSearchResult" } } }, "description": "Bounded redacted connector memory search results." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] } ], "summary": "Search connector-scoped public-safe memory", "x-idempotencyHeaderAllowed": false, "x-maximumJsonRequestBytes": 32768, "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true, "x-rateLimit": { "limit": 120, "partition": "connector_credential", "windowSeconds": 60 } } }, "/api/matm/sync/capabilities": { "get": { "description": "Public-safe distributed-sync v1 routes, revision/conflict semantics, checkpoint fields, and retention policy.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "summary": "Read distributed sync capabilities" } }, "/api/matm/sync/changes": { "get": { "description": "Read monotonic server-sequence revisions after a checkpoint.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read sync changes" } }, "/api/matm/sync/devices": { "post": { "description": "Register a public-safe device authority for distributed sync.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Register sync device" } }, "/api/matm/sync/devices/revoke": { "post": { "description": "Revoke a device authority so future mutations are rejected with durable receipts.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Revoke sync device" } }, "/api/matm/sync/devices/rotate": { "post": { "description": "Increment device authority epoch for distributed sync.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Rotate sync device" } }, "/api/matm/sync/heads": { "get": { "description": "Read authoritative logical memory heads.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read sync heads" } }, "/api/matm/sync/mutations": { "post": { "description": "Submit a public-safe conflict-aware memory sync mutation with durable idempotent receipt.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Submit sync mutation" } }, "/api/matm/sync/receipts": { "get": { "description": "Read mutation receipt by Idempotency-Key header, idempotency_key query, or receipt_id query.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read sync receipt" } }, "/api/matm/sync/retention": { "get": { "description": "Read tombstone retention and hard-forget support policy.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read sync retention" } }, "/api/matm/uai-memory/contract": { "get": { "description": "Read the narrow accountless-browser virtual-package exception and hash-only local .uai collaboration-overlay contract.", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Public-safe response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "summary": "Read UAIX active-memory contract" } }, "/api/matm/uai-memory/edit-claims": { "get": { "description": "Inspect project-scoped active, completed, released, and expired hash-only edit claims.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read local .uai edit claims" }, "post": { "description": "Acquire a bounded project/path lease only when the caller's local base hash matches the latest observed head.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Acquire local .uai edit claim" } }, "/api/matm/uai-memory/edit-claims/complete": { "post": { "description": "Advance the hash-only file head using compare-and-swap and retain public-safe completion evidence.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Complete local .uai edit claim" } }, "/api/matm/uai-memory/edit-claims/heartbeat": { "post": { "description": "Extend an owned active claim within the bounded lease window.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Heartbeat local .uai edit claim" } }, "/api/matm/uai-memory/edit-claims/release": { "post": { "description": "Release an owned active claim without advancing the observed file hash.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Release local .uai edit claim" } }, "/api/matm/uai-memory/file-heads": { "get": { "description": "Read project/path SHA-256 heads and active claim metadata; local file contents are never stored.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read local .uai file heads" } }, "/api/matm/uai-memory/packages": { "get": { "description": "Inspect registered-agent virtual UAIX package readiness without exposing a workspace key.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read virtual UAIX packages" }, "post": { "description": "Create the full database-backed active-memory exception only for an accountless browser AI without durable local filesystem access.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Create virtual UAIX package" } }, "/api/matm/uai-memory/records": { "get": { "description": "Read protected date-free public-safe records or immutable revision history for one registered agent package.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read virtual UAIX records" }, "post": { "description": "Create or compare-and-swap one supported logical UAIX record with exact protected readback.", "parameters": [ { "description": "Stable idempotency key for exact retries. Never include secrets.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 200, "minLength": 16, "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Write one virtual UAIX record" } }, "/api/matm/uai-memory/startup": { "get": { "description": "Return the protected virtual package in deterministic startup order with missing-record and readiness evidence.", "parameters": [ { "description": "Authorized workspace id.", "in": "query", "name": "workspace_id", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted response." }, "201": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted creation response." }, "202": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Protected redacted accepted response." }, "400": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "401": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "404": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "409": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." }, "422": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Safe no-op error. Raw credentials and raw private payloads are not echoed." } }, "security": [ { "workspaceBearer": [] }, { "workspaceHeader": [] } ], "summary": "Read virtual UAIX startup" } }, "/api/matm/workspace": { "get": { "description": "Connector credentials omit all query parameters and receive credential-derived exact-workspace readback. Broader governed credentials use an explicitly authorized workspace_id; the server never silently selects a workspace.", "parameters": [ { "description": "Required for broader governed credentials and forbidden for connector credentials, whose workspace is derived from the immutable grant.", "in": "query", "name": "workspace_id", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ConnectorWorkspaceReadbackResult" }, { "$ref": "#/components/schemas/GovernedWorkspaceReadbackResult" } ] } } }, "description": "Protected workspace boundary with disjoint connector and broader-governed response variants." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Malformed request; no mutation performed." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Invalid, inactive, expired, disconnected, or revoked credential/code." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Authenticated principal lacks the required immutable scope or authority." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Idempotency conflict, one-use replay, or company-scoped agent-name collision." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "413": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Connector JSON request exceeds the published 32 KiB limit; parsing and storage dispatch do not occur." }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Explicit application/json content type required." }, "422": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Semantically invalid pairing request; no mutation performed." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Credential service unavailable. Exact retry is safe; honor Retry-After when present.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [ { "connectorBearer": [] }, { "companyMasterBearer": [] }, { "workspaceBearer": [] }, { "workspaceHeader": [] }, { "npcGatewayBearer": [] } ], "summary": "Load workspace boundary", "x-maximumJsonResponseBytes": 65536, "x-noRedirects": true } }, "/connect/authorize/{publicRequestRef}": { "get": { "description": "Human authentication, explicit existing/new workspace selection, exact scope review, and canonical agent approval. publicRequestRef is public, tenant-neutral, and non-authorizing; query strings and redirects are forbidden.", "parameters": [ { "description": "Short-lived public non-authorizing request reference.", "in": "path", "name": "publicRequestRef", "required": true, "schema": { "pattern": "^pairref_[A-Za-z0-9_-]{43}$", "type": "string" } } ], "responses": { "200": { "content": { "text/html": { "schema": { "type": "string" } } }, "description": "Neutral login or authenticated approval HTML.", "headers": { "Cache-Control": { "schema": { "const": "no-store, no-cache, must-revalidate, private" } }, "Content-Security-Policy": { "description": "Nonce-bound strict policy with default-src none and frame-ancestors none.", "schema": { "type": "string" } }, "Cross-Origin-Opener-Policy": { "schema": { "const": "same-origin" } }, "Cross-Origin-Resource-Policy": { "schema": { "const": "same-origin" } }, "Permissions-Policy": { "description": "Disables unrelated browser capabilities.", "schema": { "type": "string" } }, "Pragma": { "schema": { "const": "no-cache" } }, "Referrer-Policy": { "schema": { "const": "no-referrer" } }, "Vary": { "schema": { "const": "Cookie" } }, "X-Content-Type-Options": { "schema": { "const": "nosniff" } }, "X-Frame-Options": { "schema": { "const": "DENY" } } } }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." }, "410": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing request, code, or pending grant expired, was redeemed, or was canceled." }, "429": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Rate limited. Honor Retry-After and retry only the exact request.", "headers": { "Retry-After": { "schema": { "minimum": 1, "type": "integer" } } } } }, "security": [], "summary": "Open human connector approval", "x-authorizationCodeInUrl": false, "x-privateNoStore": true, "x-securityHeaders": [ "Cache-Control", "Pragma", "Vary", "Content-Security-Policy", "Cross-Origin-Opener-Policy", "Cross-Origin-Resource-Policy", "Permissions-Policy", "Referrer-Policy", "X-Frame-Options", "X-Content-Type-Options" ] } }, "/tour/connect/authorize/{demoState}": { "get": { "description": "Uses the production approval renderer with a labeled, resettable, browser-session mock authority and no protected network.", "parameters": [ { "in": "path", "name": "demoState", "required": true, "schema": { "enum": [ "signed_out", "company_selection", "reauth_required", "pending", "success", "error", "expired", "cancelled", "permission_denied" ], "type": "string" } } ], "responses": { "200": { "content": { "text/html": { "schema": { "type": "string" } } }, "description": "Secret-free mock approval HTML." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorError" } } }, "description": "Pairing resource absent or concealed across an authorization boundary." } }, "security": [], "summary": "Exercise connector approval Demo state", "x-protectedNetworkAllowed": false } } }, "servers": [ { "url": "https://memoryendpoints.com" } ], "tags": [ { "description": "Public-safe discovery and readiness routes.", "name": "discovery" }, { "description": "Workspace setup and agent registration.", "name": "setup" }, { "description": "PKCE-bound registered-profile connector pairing, bootstrap approval, and narrow credential lifecycle.", "name": "connector-pairing" }, { "description": "Hosted public-safe memory and review promotion.", "name": "memory" }, { "description": "Database-backed authenticated wiki tree and protected searchable documents.", "name": "knowledge" }, { "description": "First-class reviewed external links, citations, and curated internet search.", "name": "web" }, { "description": "Meeting rooms, routing, and current messages.", "name": "coordination" }, { "description": "Receipts and audit evidence.", "name": "evidence" } ], "x-agentCompatibility": { "contract": "/api/matm/agent-compatibility", "routeInventoryIncludesCompatibilityGuidance": true, "supportedAbilityLevels": [ "L0", "L1", "L2", "L3", "L4", "L5", "L6", "L7" ], "unknownClientDefault": "downgrade_to_L0_or_L1" }, "x-connectorPairingGoldenPath": [ "discover_connector_pairing", "create_pkce_pairing_request", "human_selects_workspace_and_approves_agent", "claim_body_only_one_use_authorization_code", "exchange_body_only_code_with_pkce", "securely_store_pending_connector_credential", "activate_pending_connector_grant", "read_connector_self_principal", "read_exact_workspace_and_agent_pairing_status", "list_redacted_connector_credentials", "show_connected_only_after_all_exact_readbacks_match" ], "x-memoryendpoints-commercial-extension": true, "x-memoryendpoints-goldenPath": [ "create_or_enter_workspace", "register_agent", "load_workspace", "create_or_discover_project", "index_knowledge_document", "crawl_knowledge_tree", "index_external_link_citation", "search_curated_web", "save_memory", "search_memory", "create_or_read_meeting_room", "send_current_message", "acknowledge_notification", "read_receipts_and_audit" ], "x-truthBoundary": { "connectorCredentialsAreExactAgentScoped": true, "connectorCredentialsInUrls": false, "connectorPairingUsesWorkspaceKey": false, "examplesUsePlaceholdersOnly": true, "notFullGeneratedSpec": true, "protectedWritesRequireRouteAppropriateGovernedAuthority": true, "protectedWritesRequireWorkspaceKey": false, "rawPrivatePayloadsStored": false, "rawWorkspaceKeysInPublicResponses": false, "valuesRedacted": true } }