statecraft.
Catalog/aicortex

020-http-api-and-scopes

The HTTP API: bearer-authorized, scope-gated, streaming where it earns it

Lifecycle approvedImplementation pendingVerification unknownQualification unknown

The product's own HTTP surface, mounted by the cell into rahi's edge. Every route is authorized by a rauthy-issued bearer token or a browser session, both resolved to the same principal, and gated by an OAuth scope that names what it permits. Scopes are coarse enough to be understandable and fine enough to be useful: read, write, delete, admin, a separate scope for promotion, which no agent client is ever granted, and a read and a write scope for coordination, which no memory scope implies. Long operations report progress over server-sent events through the chassis's declared streaming routes. Every response carrying content obeys the untrusted content boundary.

Read the full pinned specification ↗

Relationships

depended on by

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/Cargo.toml"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/lib.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/router.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/scopes.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/capture.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/search.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/memories.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/entities.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/events.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/dto.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/src/error.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/tests/api.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-api/tests/authz.rs"
}
  • extends
    {
  "nature": "additive",
  "spec": "010-chassis-adoption-and-workspace",
  "unit": {
    "kind": "file",
    "path": "apps/aicortex/src/cell.rs"
  }
}

Source headings

  1. 020: The HTTP API
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 4. Functional requirements
  6. 5. Acceptance criteria
  7. 6. Out of scope
  8. 7. Resolved decisions
  9. Verification

Frozen anchors

No frozen anchors declared.