Fitinty API reference

Schools, programmes and courses - the framework every tenant's school is built from.

• DELETE /education/announcements/{announcement_id} · scope education:writeDelete Announcement
• POST /education/announcements/{announcement_id}/publish · scope education:writePublish AnnouncementTHE OVERRIDE DOOR. Whatever drafted it - a hand or the digest - a person publishes. RLS admits only school staff to the UPDATE.
• POST /education/assignments/{assignment_id}/submissions · scope education:writeSubmit Assignment
• GET /education/assignments/{assignment_id}/submissions · scope education:readList Assignment Submissions
• POST /education/assignments/{assignment_id}/writing-feedback · scope education:writeWriting Feedback
• POST /education/blocks · scope education:writeCreate Block
• PATCH /education/blocks/{block_id} · scope education:writeUpdate Block
• DELETE /education/blocks/{block_id} · scope education:writeDelete Block
• GET /education/bundles/for-course/{course_id} · scope education:readBundles For CourseThe student's door: published bundles that carry this course as an item.
• GET /education/bundles/mine · scope education:readMy BundlesThe buyer's shelf: every bundle they bought, with each item's delivery status IN WORDS - a pending or failed delivery is shown, never hidden.
• POST /education/bundles/purchases/{purchase_id}/retry-delivery · scope education:writeRetry DeliveryThe retry door: the buyer or the selling school's staff re-run whatever is not yet delivered. Delivered rows are never re-attempted.
• POST /education/bundles/schools/{school_id} · scope education:writeCreate BundleThe seller's hand. Items are validated against REAL rows at creation - a key with no reader is a silent zero, so an unknown reference is refused (422), never stored. Born a draft; publishing is the go-live moment.
• GET /education/bundles/schools/{school_id} · scope education:readList School BundlesRLS splits honestly: staff see drafts, everyone else the published shop window.
• POST /education/bundles/{bundle_id}/checkout · scope education:writeStart Bundle CheckoutOne Checkout Session on the SELLER's account for the whole box. When any item is physical, Stripe collects the shipping address and the webhook carries it into the Medusa order - the buyer types their address exactly once.
• POST /education/bundles/{bundle_id}/publish · scope education:writePublish Bundle
• GET /education/certificates/mine · scope education:readList My Certificates
• POST /education/certificates/{certificate_id}/revoke · scope education:writeRevoke Certificate
• GET /education/certificates/{certificate_id}/verify · scope education:readVerify Certificate
• DELETE /education/channel-messages/{message_id} · scope education:writeRemove Channel MessageModeration (addition 18's seed): RLS admits the DELETE only for the author, school staff, or the owner - zero rows deleted is an honest 404.
• GET /education/commerce/applications/mine · scope education:readMy Applications
• POST /education/commerce/applications/{application_id}/decide · scope education:writeDecide ApplicationA decline carries its reason - the reason is the applicant's teacher.
• POST /education/commerce/courses/{course_id}/book · scope education:writeSet Course BookThe course's book dial. The book must be a PUBLISHED product somewhere on the platform - any org's: a partner bookstore counts.
• POST /education/commerce/courses/{course_id}/checkout · scope education:writeStart Course CheckoutA Checkout Session ON THE SCHOOL'S ACCOUNT. No card detail touches this platform - Stripe hosts the page; the student pays the school; Fitinty's fee is taken by Stripe's own split.
• POST /education/commerce/courses/{course_id}/license-seats · scope education:writeLicense SeatsTHE BUYER'S DOOR. Another organization's OWNER buys seats on the seller's own Stripe account - a Checkout Session, the course-purchase construction exactly. No row is granted here: the verified webhook births the seats, so an abandoned checkout leaves no free students behind.
• POST /education/commerce/courses/{course_id}/seat-offer · scope education:writeSet Seat OfferThe seller's shelf tag. Only on a PUBLISHED course - the pay-to-open gate was passed when the course went public, and seats on a draft would sell an empty room.
• POST /education/commerce/courses/{course_id}/sponsor-checkout · scope education:writeStart Sponsor CheckoutTHE GIVER'S DOOR. Any signed-in person pays the course's own price on the school's own rail. The claim code is minted NOW and shown on the sponsor's shelf the moment payment lands - handing it over is the gift.
• POST /education/commerce/courses/{course_id}/template-license · scope education:writeBuy Template LicenseTHE BUYER'S DOOR. A priced template is the seat-purchase construction exactly: pending row, Checkout Session on the seller's account, the webhook births the license. A FREE template births its license paid on the spot - there is no provider payment to wait for.
• POST /education/commerce/courses/{course_id}/template-offer · scope education:writeSet Template OfferThe seller's dial. Published courses only - a template nobody can inspect as a live course would sell a promise with no shop window. Going ON SALE is a go-live moment, so it rides the ONE pay-to-open gate like every other.
• GET /education/commerce/courses/{course_id}/template-offer · scope education:readGet Template OfferThe seller's own dial, read back - staff only, drafts and inactive included.
• POST /education/commerce/enrollments/{enrollment_id}/certificate-checkout · scope education:writeStart Certificate CheckoutThe STUDENT's door - their own enrollment, their own money, the school's own rail.
• POST /education/commerce/programs/{program_id}/checkout · scope education:writeStart Program CheckoutBuy the whole series at the tenant's one price. Published programs only - a bundle of drafts would sell an empty shelf.
• POST /education/commerce/schools/{school_id}/application-fee · scope education:writeSet Application FeeThe school's dial. None = free applications (the default, and the honest zero).
• GET /education/commerce/schools/{school_id}/applications · scope education:readSchool Applications
• POST /education/commerce/schools/{school_id}/apply · scope education:writeApply To SchoolThe applicant's door. Free -> SUBMITTED now; priced -> PENDING_PAYMENT with the school's own checkout - the verified webhook turns it submitted.
• POST /education/commerce/schools/{school_id}/growth-advice · scope education:writeGrowth AdviceProposals, never actions (Override Charter): grounded strictly in the school's own real numbers, benchmarked in spirit against the plan's competitive rider - and everything it suggests is applied by the TENANT's own hand through the existing screens or not at all.
• GET /education/commerce/schools/{school_id}/money-in · scope education:readSchool Money InThe school's money-in: PAID purchases only (the money-in rule: captured, never intended). Absence of payments is said in words by the screen, never rendered as zero-pretending-to-know.
• GET /education/commerce/schools/{school_id}/seat-grants · scope education:readList Seat Grants
• POST /education/commerce/schools/{school_id}/seat-grants · scope education:writeCreate Seat Grant
• GET /education/commerce/seat-purchases · scope education:readList Seat PurchasesBoth sides of the counter: what this org has sold and what it has bought.
• POST /education/commerce/sponsored/claim · scope education:writeClaim SponsorshipThe student's hand on the gift. One claim, forever; a code on an unpaid or already-claimed gift refuses in words. The claim opens the PRICE gate only - the student still walks enrollment's other gates on the course page.
• GET /education/commerce/sponsored/mine · scope education:readMy SponsorshipsThe sponsor's shelf: every gift they bought, its state, and the claim code to hand over once paid.
• GET /education/commerce/template-licenses/mine · scope education:readMy Template LicensesThe buyer's shelf: licenses their organization holds, adopted or waiting.
• POST /education/commerce/template-licenses/{license_id}/adopt · scope education:writeAdopt TemplateDELIVERY. The paid license turns into a DRAFT course in the buyer's school - the whole spine cloned, owned outright, free to reshape (building is free by ruling; the buyer's own publish walks the standing publish gates later). What is NOT copied is stated in words, never silently absent.
• GET /education/commerce/template-market · scope education:readTemplate MarketEvery active offer on a published course, platform-wide. Read through the PUBLIC cursor: these are shop-window facts, and a member cursor answers a silent zero on another org's rows - the standing RLS lesson. Free is stated as free, never 0.
• POST /education/commerce/webhook · scope education:writeEducation Stripe Webhook
• PATCH /education/competencies/{competency_id} · scope education:writeUpdate CompetencyCorrect a competency's wording. A competency statement is the hardest sentence in a course to get right - it is the promise the whole module is measured against - so it is exactly the sentence a teacher rewrites three times. Shipping create-only was the same capability-without-a-door fault found five times on the night this pillar was walked (Tenant Zero, 2026-08-26). THE LINKS SURVIVE THE REWOR…
• DELETE /education/competencies/{competency_id} · scope education:writeDelete CompetencyRemove a competency - unless a student has already been credited with it. A demonstration is a statement about a person's ability, granted by a named member of staff with evidence attached. Deleting the competency underneath it would erase that record sideways, which is the thing this platform refuses everywhere: a teacher's tidy-up never rewrites a student's history.
• POST /education/competencies/{competency_id}/assessed · scope education:writeMark AssessedClaim that an assessment TESTS a competency. This is the claim the coverage report checks.
• POST /education/competencies/{competency_id}/demonstrated · scope education:writeRecord DemonstrationTHE ALTERNATIVE PATH: this student can already do this, and here is how we know. In job training this is the ordinary case rather than the exception - a technician who has wired houses for ten years has mastered "identify an electrical hazard", and a school that cannot record that wastes their time and loses them. Recognition of prior learning, kept as a record with a name and evidence on it, nev…
• POST /education/competencies/{competency_id}/taught · scope education:writeMark TaughtDeclare WHERE a competency is taught. Exactly one anchor - the table's own CHECK says the same thing, so a caller that bypasses this endpoint cannot write a nonsense row either.
• GET /education/courses/published · scope education:readList Published Courses
• GET /education/courses/{course_id} · scope education:readGet Course
• PATCH /education/courses/{course_id} · scope education:writeUpdate Course
• GET /education/courses/{course_id}/assignments · scope education:readList Assignments
• POST /education/courses/{course_id}/assignments · scope education:writeCreate Assignment
• GET /education/courses/{course_id}/attendance · scope education:readList Attendance
• POST /education/courses/{course_id}/attendance · scope education:writeRecord Attendance
• GET /education/courses/{course_id}/certificates · scope education:readList Course Certificates
• GET /education/courses/{course_id}/channel · scope education:readGet Channel
• POST /education/courses/{course_id}/channel · scope education:writePost To Channel
• GET /education/courses/{course_id}/competencies · scope education:readList CompetenciesWhat a learner will be able to DO. Visible to students too, deliberately: telling somebody the target is the point of stating it.
• POST /education/courses/{course_id}/competencies · scope education:writeCreate Competency
• GET /education/courses/{course_id}/coverage · scope education:readCourse CoverageDoes the course's final lab, project and exam test everything it teaches?
• POST /education/courses/{course_id}/enroll · scope education:writeEnroll
• GET /education/courses/{course_id}/enrollments · scope education:readList Course Roster
• GET /education/courses/{course_id}/grades · scope education:readAll Grades
• GET /education/courses/{course_id}/grades/mine · scope education:readMy Grade
• GET /education/courses/{course_id}/grading-weights · scope education:readGet Grading Weights
• PUT /education/courses/{course_id}/grading-weights · scope education:writeSet Grading Weights
• GET /education/courses/{course_id}/labs · scope education:readCourse LabsOne call for the whole course player: which lessons carry a lab, and which of them THIS caller has genuinely completed. Rows exist only where a premise does - a lesson with no lab is absent, not false-flagged.
• GET /education/courses/{course_id}/live-classes · scope education:readList Live Classes
• POST /education/courses/{course_id}/live-classes · scope education:writeStart Live ClassStaff only. A REAL P01 hosted meeting through create_meeting() itself - its capacity checks, its room tokens, its /meet room - linked to the course.
• GET /education/courses/{course_id}/modality-coverage · scope education:readCourse Modality Coverage
• GET /education/courses/{course_id}/module-progress · scope education:readGet Module Progress
• GET /education/courses/{course_id}/modules · scope education:readList Modules
• POST /education/courses/{course_id}/modules · scope education:writeCreate Module
• GET /education/courses/{course_id}/prerequisites · scope education:readList Prerequisites
• POST /education/courses/{course_id}/prerequisites · scope education:writeAdd Prerequisite
• DELETE /education/courses/{course_id}/prerequisites/{requires_course_id} · scope education:writeRemove Prerequisite
• POST /education/courses/{course_id}/publish-to-federation · scope education:writePublish To Federation
• GET /education/courses/{course_id}/quizzes · scope education:readList Quizzes
• POST /education/courses/{course_id}/quizzes · scope education:writeCreate Quiz
• GET /education/courses/{course_id}/review · scope education:readReview CourseThe whole course. Kept as its own route because it is what every screen already calls.
• GET /education/courses/{course_id}/spine · scope education:readCourse SpineThe student's own gated view of a course. THE EMPEROR'S SEQUENCE, read from records rather than asserted: "student work on each section at a time until complete the lesson; each lesson at a time until they complete the Module; and each module at a time until complete the course." THIS ENDPOINT DOES NOT INVENT A POLICY. Sequencing follows the course's own `require_sequential_modules` flag — the s…
• GET /education/courses/{course_id}/students/{student_user_id}/report · scope education:readStudent Report
• POST /education/courses/{course_id}/study-groups · scope education:writeCreate Study GroupAnyone inside the walls starts a room; staff-started rooms are the school's official ones. The creator is its first member.
• GET /education/courses/{course_id}/study-groups · scope education:readList Study Groups
• GET /education/courses/{course_id}/translation-siblings · scope education:readList Translation SiblingsEvery real course in this one's translation family - lets a student/teacher navigate to any language version from any other one. Returns an empty list for a course with no translations at all - never a 404, since 'no family' is a real, valid state, not an error.
• POST /education/courses/{course_id}/translations · scope education:writeCreate Translation
• GET /education/courses/{course_id}/translations · scope education:readList Translations
• GET /education/enrollments/mine · scope education:readList My Enrollments
• PATCH /education/enrollments/{enrollment_id} · scope education:writeUpdate Enrollment Status
• POST /education/enrollments/{enrollment_id}/certificate · scope education:writeIssue Certificate
• PATCH /education/enrollments/{enrollment_id}/term · scope education:writeSet Enrollment TermAttach an enrolment to the term it belongs to - the write migration 397 never got. FOUND BY THE FIRST FULL DRY-RUN (2026-08-25): the term attaches to the ENROLMENT by design, every reader filters on `enrollment.term_id` - and nothing in the product ever wrote it. Every fixture that had a term got it from wave-time SQL, so on a fresh school the whole Registrar was unreachable: every student "unter…
• PUT /education/factory/categories/{school_type} · scope education:writeSave CategoryAdd a category, or rewrite one. Owner only, and the table says so too. The slug is taken from the URL, not the body: renaming a category's slug would cascade to every school built on it, and that is a different and much larger decision than editing its wording.
• POST /education/factory/categories/{school_type}/restore · scope education:writeRestore Category
• POST /education/factory/categories/{school_type}/retire · scope education:writeRetire CategoryWithdraw a category without deleting it. RETIRED, NEVER DELETED, and the database enforces the difference: `school.school_type` is a foreign key with ON DELETE RESTRICT, so a category any school was built on cannot be removed at all. Retiring stops anyone starting a new school of that kind while every existing one keeps a real parent and keeps working.
• POST /education/factory/lessons/{lesson_id}/multimedia · scope education:writeBridge Lesson To Factory
• POST /education/factory/proposals · scope education:writeCreate Proposal
• GET /education/factory/proposals · scope education:readList My Proposals
• PATCH /education/factory/proposals/{proposal_id} · scope education:writeEdit ProposalThe human-edit door - the Override Charter's first working implementation. The tenant sends the draft as THEY want it; it is validated for shape only, never second- guessed, and the edit marks the proposal human_touched forever.
• POST /education/factory/proposals/{proposal_id}/apply · scope education:writeApply Proposal
• POST /education/factory/proposals/{proposal_id}/discard · scope education:writeDiscard Proposal
• POST /education/factory/proposals/{proposal_id}/revise · scope education:writeRevise ProposalThe in-the-loop step: re-draft WITH the current draft and the tenant's instruction.
• GET /education/factory/starter-packs · scope education:readList Starter PacksRLS does the gating: tenants receive published packs only; the owner also sees drafts awaiting review and retired incumbents.
• POST /education/factory/starter-packs/{pack_id}/adopt · scope education:writeAdopt Starter PackThe pack becomes the TENANT'S proposal. RLS on the SELECT is the gate: a tenant can only ever read - and therefore adopt - a published pack.
• POST /education/factory/starter-packs/{pack_id}/publish · scope education:writePublish Starter Pack
• POST /education/factory/starter-packs/{school_type}/generate · scope education:writeGenerate Starter Pack
• GET /education/factory/templates · scope education:readList Category TemplatesEvery category the Factory can build, with the template each drafts from. Auth-gated but not role-gated: the cockpit shows these to any signed-in tenant choosing what kind of school to start, and nothing in a template is secret - it is the platform's own pedagogy, stated.
• GET /education/federation/catalog · scope education:readFederation CatalogPublished masters discoverable across tenants (the White-Label catalog).
• POST /education/federation/{federation_id}/adopt · scope education:writeAdopt Federation
• GET /education/federation/{federation_id}/events · scope education:readFederation Events
• POST /education/federation/{federation_id}/global-push · scope education:writeGlobal Push
• GET /education/federation/{federation_id}/subscribers · scope education:readFederation Subscribers
• POST /education/guardians/consents · scope education:writeGrant Consent
• POST /education/guardians/consents/{consent_id}/revoke · scope education:writeRevoke Consent
• POST /education/guardians/links · scope education:writeLink Guardian
• POST /education/guardians/minor-flags · scope education:writeMark Minor
• GET /education/guardians/my-students · scope education:readMy StudentsThe guardian portal seed: progress, not just consent. Every query below runs under the guardian's own RLS context - the *_guardian_read policies (387) are what admit each row.
• GET /education/identity/assets/{asset_id}/file · scope education:readAsset FileServe one identity file to an eye RLS already trusts - the SELECT below runs under the same policies as everything else, so 'not yours to see' and 'does not exist' are the same 404. Used by the cast card (N6): a face is shown only to sessions the ledger's own policy would show the row to.
• POST /education/identity/avatar/build · scope education:writeBuild AvatarQueue the Foundry (Wave N, N3): the consented photos become a rigged, walking, game-fidelity character. Runs in the background - a body takes a minute or two to build, and the ledger IS the status: the avatar_rig row appears when it is done.
• GET /education/identity/avatar/status · scope education:readAvatar Status
• POST /education/identity/consents · scope education:writeGrant ConsentAn ADULT's own-hand consent. A minor is refused here IN WORDS - and would be refused by the INSERT policy even if this check were deleted, because a child self-consenting to biometric capture must be impossible, not merely discouraged.
• POST /education/identity/consents/{scope}/revoke · scope education:writeRevoke ConsentRevocation with a receipt: the consent closes AND every asset in the scope dies with its file, in the same transaction the revocation commits in. The response says how many - a receipt, not a shrug. (A minor's revocation travels through the guardians module, which calls the same `_withdraw_assets` - one implementation, both doors.)
• GET /education/identity/mine · scope education:readMy Identity
• POST /education/identity/photos · scope education:writeUpload PhotoOne whole-body photo (the agent asks for several, from all angles - each arrives here). Requires the 'likeness' consent to already stand, whichever door granted it.
• POST /education/identity/voice-sample · scope education:writeUpload Voice SampleThe voice sample - the single most personal thing this platform stores (voice_promise's own words), so it lands in the same ledger the withdrawal walk destroys from.
• GET /education/integrations · scope education:readList IntegrationsHonest status for the LMS adapters this pillar could integrate with - all genuinely "not configured" right now. The spec (§8) explicitly warns against rushing an LMS integration ("Fitinty shall not attempt to replace all LMS engines immediately") and lays out a real pre-install checklist (license review, security review, SSO design, tenant isolation review, backup/restore, accessibility review) be…
• POST /education/integrations/import · scope education:writeImport Outline
• POST /education/labs/transcribe · scope education:writeTranscribe SpeechSpeech into the scene (Wave N, N5): the student SPEAKS their answer and the practice dock gets text. Auth-gated pass-through to the Forge STT service - the model is GPU-sized and lives where the GPU lives, exactly like the tutor's brain. A dead bridge answers in words, not a hang: the student can always fall back to typing.
• DELETE /education/lessons/{lesson_id} · scope education:writeDelete LessonSame rule one level down: a lesson nobody has practised in deletes; one with lab completions or quiz results behind it does not.
• PATCH /education/lessons/{lesson_id} · scope education:writeUpdate Lesson
• GET /education/lessons/{lesson_id}/blocks · scope education:readList Lesson Blocks
• POST /education/lessons/{lesson_id}/compute-sage · scope education:writeCompute Sage In Lesson
• POST /education/lessons/{lesson_id}/draft-code · scope education:writeDraft Code LessonReal AI-drafted Python/Sage code from a plain-English description (task #159/160), meant for insertion into a real Jupyter cell - the teacher still reviews it and must explicitly click Run before anything executes in the sandbox. Never executed here - text only.
• POST /education/lessons/{lesson_id}/draft-diagram · scope education:writeDraft Diagram LessonAI-drawn schematic for a lesson (Tenant Zero, 2026-08-26 - the Emperor: a lesson on circuits NEEDS a circuit). The model drafts an SVG figure, it is sanitized to inert shapes-and-text, and it lands in the lesson's EXISTING image slot - the student page already renders that slot, so no new surface. The teacher sees it immediately and can replace or delete it like any uploaded image.
• POST /education/lessons/{lesson_id}/draft-latex · scope education:writeDraft Latex LessonReal AI-drafted LaTeX from a plain-English description (task #159/160) - Education's real analog of Publishers' draft_latex. The teacher still edits it live in MathLive and must explicitly save the lesson - this endpoint only ever returns text.
• POST /education/lessons/{lesson_id}/image · scope education:writeUpload Lesson Image
• GET /education/lessons/{lesson_id}/image · scope education:readGet Lesson Image
• DELETE /education/lessons/{lesson_id}/image · scope education:writeDelete Lesson Image
• POST /education/lessons/{lesson_id}/jupyter/execute · scope education:writeExecute Jupyter Cell Lesson
• POST /education/lessons/{lesson_id}/jupyter/start · scope education:writeStart Jupyter Session Lesson
• POST /education/lessons/{lesson_id}/jupyter/stop · scope education:writeStop Jupyter Session Lesson
• GET /education/lessons/{lesson_id}/lab-completion · scope education:readGet Lab CompletionThe caller's own real completion record for this lesson's VR Lab Console (id 76's mandatory interactive-practice requirement) - None if they haven't finished it (or haven't started), never fabricated.
• POST /education/lessons/{lesson_id}/lab-completion · scope education:writeRecord Lab CompletionCalled once the client has confirmed every interactive object in the lesson's scene has genuinely been inspected - a real per-student record, not a client-only toy. RLS (lesson_lab_completion_write) independently re-enforces active enrollment; this endpoint doesn't duplicate that check, it relies on the database to reject an ineligible write.
• GET /education/lessons/{lesson_id}/lab-environment · scope education:readGet Lab EnvironmentServes the lab's panorama. RLS on the lesson_scenario SELECT already scopes visibility (published, or staff of the lesson's school) - a row coming back proves the caller may see this lab, and therefore its environment. Same reasoning as the lesson-image route. LOW-BANDWIDTH MODE (P02 Wave K), for the markets the payment rails actually serve. An 8K panorama is ~3.8 MB, which is a real cost on a me…
• POST /education/lessons/{lesson_id}/move · scope education:writeMove Lesson
• POST /education/lessons/{lesson_id}/reparent · scope education:writeReparent LessonMove a lesson into a different module of the SAME course.
• GET /education/lessons/{lesson_id}/scenario · scope education:readGet Scenario
• PUT /education/lessons/{lesson_id}/scenario · scope education:writeSet Scenario
• POST /education/lessons/{lesson_id}/scenario/preview · scope education:writePrepare Lab ScenePrepares BOTH halves of a real-life lab (plan v9, addition 23): the interactive scene and its photoreal 360° environment. Either half that already exists is kept; the environment failing NEVER fails the lab - a missing picture must not block mastery.
• GET /education/lessons/{lesson_id}/sections · scope education:readList SectionsA lesson's sections, in order. An empty list is the honest answer for every lesson that predates this wave - and the reason the level could be added to live data at all.
• POST /education/lessons/{lesson_id}/sections · scope education:writeCreate Section
• DELETE /education/modules/{module_id} · scope education:writeDelete ModuleRemove a module - and everything under it, which is why it refuses once a student has done anything inside it (Tenant Zero, 2026-08-26: the Emperor typed a module title into the wrong box and had no way to take it back).
• PATCH /education/modules/{module_id} · scope education:writeRename Module
• GET /education/modules/{module_id}/coverage · scope education:readModule CoverageDoes this module's lab, project and exam test everything its sections and lessons teach? The Emperor's rule, made checkable. `gaps` is the list a builder shows in words: "two competencies this module teaches are never tested."
• GET /education/modules/{module_id}/lessons · scope education:readList Lessons
• POST /education/modules/{module_id}/lessons · scope education:writeCreate Lesson
• POST /education/modules/{module_id}/move · scope education:writeMove Module
• GET /education/modules/{module_id}/shape · scope education:readModule ShapeWhat shape is this module, right now? Shown before saving, so nobody names a template after a module without first seeing what they are about to hold everything else to.
• POST /education/modules/{module_id}/students/{student_user_id}/certificate · scope education:writeIssue Module CertificateA module is a mini course, so mastering one is worth showing. REFUSED UNLESS THE MODULE IS ACTUALLY MASTERED, by the platform's own existing rule - the same `_is_module_complete` that gates everything else, so a credential can never mean less than the progress bar beside it.
• GET /education/my/community · scope education:readMy CommunityThe learner's whole community in one reading: streak and badges (awarded from real completions on this very read), the published word from every school they study at, upcoming published events, and their own rooms. A student with nothing yet gets honest zeros and a standing invitation, never a blank.
• GET /education/my/progress/{scope}/{scope_id} · scope education:readMy ProgressWhat THIS learner can now do, at whichever level they are standing.
• GET /education/ops/schools/{school_id}/analytics · scope education:readSchool AnalyticsSchool analytics, optionally scoped to one academic term (P02 Wave M). WHAT `term_id` SCOPES, AND WHAT IT DELIBERATELY DOES NOT. Enrolments and attendance become term-scoped: an enrolment stores its term (migration 397) and attendance is filtered by the term's date window - the same two grains the Registrar uses, so a school's summary can never disagree with the report cards it is a summary of. S…
• GET /education/ops/schools/{school_id}/export/roster.csv · scope education:readExport Roster CsvEvery enrollment in the school, with the grade and attendance facts beside it. EMPTY CELLS, NOT ZEROS. A student with nothing scored gets a blank score column, because a spreadsheet full of zeros is a spreadsheet that will be averaged - and an average that counts "not yet marked" as nought is a lie a school might act on.
• GET /education/ops/schools/{school_id}/today · scope education:readClasses Today
• POST /education/overrides · scope education:writeGrant OverrideA teacher lets a student past one gate, with a reason. THE HAND IS A PERSON'S. Wave F ruled that the tutor coaches and never grades; opening a gate is a grading decision in everything but name, so no model makes it. The reason is required by the column, by this endpoint and by the screen - an override with no reason is indistinguishable from a mistake, and a student's file should say who decided …
• GET /education/program-certificates/mine · scope education:readList My Program Certificates
• POST /education/program-certificates/{certificate_id}/revoke · scope education:writeRevoke Program Certificate
• GET /education/program-certificates/{certificate_id}/verify · scope education:readVerify Program Certificate
• POST /education/programme-templates · scope education:writeCreate Programme TemplateBless one programme and make its shape the standard for the others. The same three refusals the module level makes, for the same reasons. A programme with no courses describes nothing and every comparison against it would report "matches" - success it never checked.
• GET /education/programme-templates/{template_id}/compare/{program_id} · scope education:readCompare ProgrammeHow does this programme differ from the shape? Facts only; nothing is changed.
• GET /education/programmes/{program_id}/shape · scope education:readProgramme ShapeWhat shape is this programme, right now? Shown before saving, for the same reason the module one is: nobody should name a standard after a programme without seeing the numbers first.
• GET /education/programs/{program_id} · scope education:readGet Program
• PATCH /education/programs/{program_id} · scope education:writeUpdate Program
• GET /education/programs/{program_id}/certificates · scope education:readList Program Certificates
• POST /education/programs/{program_id}/certificates/{student_user_id} · scope education:writeIssue Program CertificateReal, computed program-completion eligibility - never fabricated: a program-wide certificate can only be issued once every linked course already has a real, non-revoked certificate.course row for this exact student. A program with zero linked courses can never be "complete" - rejected the same as a program still missing a real course certificate, not treated as a vacuous pass.
• POST /education/programs/{program_id}/courses · scope education:writeAttach Program Course
• DELETE /education/programs/{program_id}/courses/{course_id} · scope education:writeDetach Program Course
• POST /education/programs/{program_id}/enroll · scope education:writeEnroll In Program
• GET /education/progress/mine · scope education:readMy Progress
• GET /education/prose/{scope}/{scope_id} · scope education:readProse At ScopeThe written content under one scope, for checks that must read the prose itself. The review reads TITLES - it can say a section is empty, duplicated or untested, and nothing at all about whether what is written in it is true. A worked example on production concluded that a 32 V reading against a 36 V expectation with a +/-2 V tolerance was "within expected parameters" (2026-08-27). Every structur…
• PUT /education/questions/{question_id} · scope education:writeEdit Question
• GET /education/quizzes/{quiz_id}/my-result · scope education:readMy Quiz Result
• POST /education/quizzes/{quiz_id}/proctoring-events · scope education:writeLog Proctoring Event
• GET /education/quizzes/{quiz_id}/proctoring-events/mine · scope education:readMy Proctoring Events
• GET /education/quizzes/{quiz_id}/proctoring-events/{student_user_id} · scope education:readStudent Proctoring Events
• GET /education/quizzes/{quiz_id}/proctoring-report · scope education:readProctoring Report
• GET /education/quizzes/{quiz_id}/questions · scope education:readList Questions
• POST /education/quizzes/{quiz_id}/questions · scope education:writeAdd Question
• GET /education/quizzes/{quiz_id}/results · scope education:readQuiz Results
• GET /education/quizzes/{quiz_id}/scenarios · scope education:readList ScenariosEvery scenario in this assessment, each with its own questions already attached. Nested rather than flat because a stem without its questions is unusable and a question without its stem is unreadable - a caller that had to join them itself would eventually render one without the other.
• POST /education/quizzes/{quiz_id}/scenarios · scope education:writeCreate Scenario
• POST /education/quizzes/{quiz_id}/submit · scope education:writeSubmit Quiz
• POST /education/results/{result_id}/amend · scope education:writeAmend ResultCorrect a sealed result by issuing a NEW one that supersedes it. THE OLD ROW IS NEVER TOUCHED. It stays exactly as issued, signature intact, because the point of an academic record is that you can still see what was said before the correction. That is also the only design compatible with M2's grant, which is SELECT and INSERT only - the application cannot modify a sealed row even if it wanted to.…
• GET /education/review/{scope}/{scope_id} · scope education:readReview At ScopeTHE SAME QUESTION AT FOUR LEVELS — the Emperor's architecture (2026-08-27). "When we use them in the course page is to discover and auto fix/cover gaps from the Modules' headings... in the module page... from the Lessons' headings... in the Lessons' page... from the sections' headings... in the section page... from the section's contents to make sure all competencies will be cover…
• DELETE /education/scenarios/{scenario_id} · scope education:writeDelete ScenarioRefused once anybody has answered its questions. The same rule as a module, a lesson and a section: a teacher's tidy-up never erases a student's record. Deleting the stem would cascade to its questions, and their answers are part of somebody's result.
• GET /education/schools · scope education:readList Schools
• POST /education/schools · scope education:writeCreate School
• GET /education/schools/mine · scope education:readGet My School Endpoint
• POST /education/schools/{school_id}/announcements · scope education:writeCreate Announcement
• GET /education/schools/{school_id}/announcements · scope education:readList AnnouncementsRLS does the honest split: staff see drafts, an enrolled student sees only the published ones, a stranger sees none.
• POST /education/schools/{school_id}/announcements/draft-digest · scope education:writeDraft Weekly DigestAUTOMATION WITH ITS HANDS TIED: a deterministic reading of the school's own week - new students, discussion activity, upcoming events, live classes - assembled into a DRAFT announcement. NO MODEL writes it (the growth-advisor doctrine), and it goes nowhere until a person publishes. Every number below is a count of real rows.
• GET /education/schools/{school_id}/courses · scope education:readList Courses
• POST /education/schools/{school_id}/courses · scope education:writeCreate Course
• GET /education/schools/{school_id}/members · scope education:readList School Members
• POST /education/schools/{school_id}/members · scope education:writeAdd School Member
• PATCH /education/schools/{school_id}/members/{member_id}/grade-level · scope education:writeSet Grade Level
• GET /education/schools/{school_id}/programs · scope education:readList School Programs
• POST /education/schools/{school_id}/programs · scope education:writeCreate Program
• GET /education/schools/{school_id}/subscriptions · scope education:readSchool SubscriptionsA sub-portal school's own adopted curricula (with a behind flag).
• GET /education/schools/{school_id}/terms · scope education:readList Terms
• POST /education/schools/{school_id}/terms · scope education:writeCreate Term
• PATCH /education/schools/{school_id}/terms/{term_id} · scope education:writeUpdate Term
• DELETE /education/schools/{school_id}/terms/{term_id} · scope education:writeDelete TermDelete a term - unless it is holding academic history (Wave M, migration 398). THE REFUSAL IS CHECKED HERE AND ENFORCED BY THE DATABASE, which is deliberate belt and braces for two different failures. The count below produces a sentence a person can act on; the `ON DELETE RESTRICT` constraint behind it is what actually holds if a future caller forgets to ask, or if an enrolment is created between…
• GET /education/schools/{slug} · scope education:readGet School By Slug
• PATCH /education/sections/{section_id} · scope education:writeUpdate Section
• DELETE /education/sections/{section_id} · scope education:writeDelete SectionRefused once a student has completed it - the same rule as a module or a lesson (Tenant Zero, 2026-08-26): a teacher's tidy-up never erases a student's record.
• GET /education/sections/{section_id}/blocks · scope education:readList Section Blocks
• POST /education/sections/{section_id}/complete · scope education:writeComplete SectionA student marks their own section done. BY THEIR OWN HAND ONLY - the RLS INSERT policy refuses a row written for anybody else, the same rule Wave D drew for guardian consent.
• POST /education/sections/{section_id}/move · scope education:writeMove SectionMove a section one place, and renumber the whole lesson while we are here. WHY RENUMBER EVERY TIME. Accepting the AI's suggested headings left positions 0, 2, 4, 6, 8 in the Emperor's real course: each suggestion button carried the position the list had when it was drawn, and the list grew under it (2026-08-26). Nothing was broken - order is by position - but gaps invite a future collision, and a…
• POST /education/sections/{section_id}/reparent · scope education:writeReparent SectionMove a section under a different lesson of the SAME course. A student's completion of this section travels with it - `lesson_section_completion` points at the section, not at where it used to live - so moving a section never erases work.
• GET /education/students/{student_user_id}/overrides · scope education:readList OverridesEvery gate opened for this student, and why. Readable BY THE STUDENT as well as by staff - a person is entitled to know what was decided about them.
• GET /education/students/{student_user_id}/report-card · scope education:readReport CardA report card for one student in one term - available at ANY time, which is the point. Nothing here waits for a term to end. A parent asking in week three gets week three's answer, labelled as provisional, rather than "come back in December".
• GET /education/students/{student_user_id}/transcript · scope education:readTranscriptA student's full academic record across every school, for the people entitled to read it. NO CONSENT IS INVOLVED HERE and that is deliberate. This is the student reading their own record (or their school's staff, or a minor's guardian) through `term_result`'s own policies. Consent governs SHARING - a different act, a different audience, and the next endpoint.
• DELETE /education/study-group-messages/{message_id} · scope education:writeRemove Group Message
• POST /education/study-groups/{group_id}/join · scope education:writeJoin Study Group
• POST /education/study-groups/{group_id}/leave · scope education:writeLeave Study Group
• GET /education/study-groups/{group_id}/messages · scope education:readList Group Messages
• POST /education/study-groups/{group_id}/messages · scope education:writePost Group Message
• GET /education/submissions/mine · scope education:readList My Submissions
• PATCH /education/submissions/{submission_id} · scope education:writeGive Feedback
• POST /education/subscriptions/{subscription_id}/sync · scope education:writeSync Subscription
• POST /education/templates · scope education:writeCreate TemplateBless one module and make its shape the standard.
• GET /education/templates · scope education:readList TemplatesEvery template this reader can see: their own school's, and the PLATFORM standard for the kind of school they run. RLS decides which, and deliberately so - a tenant is held to the platform template for their category, so they must be able to read it, and they must not see another school's. Platform templates sort first because they are the standard the rest are variations on.
• DELETE /education/templates/{template_id} · scope education:writeDelete Template
• GET /education/templates/{template_id}/compare/{module_id} · scope education:readCompareHow does this module differ from the shape? Facts only; nothing is changed. Worded as comparison throughout - "has four lessons where the template has five", never "is missing a lesson". The teacher decides whether the difference is a fault, and on a genuinely smaller topic it is not.
• POST /education/templates/{template_id}/promote · scope education:writePromote TemplateMake one school's template the standard for a KIND of school. Owner only. WHY PROMOTION RATHER THAN AUTHORING. A template is DERIVED from a real module, never typed - that is what stops it becoming an aspiration nobody has met. The owner runs no school and so has no module to read a shape from, which leaves exactly one honest way to create a platform standard: take one a tenant has already met, a…
• GET /education/terms/{term_id}/report-cards · scope education:readTerm Report CardsEvery student's standing in one term, for that school's staff - the registrar's own view. SEALED AND UNSEALED TERMS BOTH ANSWER, and the difference is reported rather than hidden. An unsealed term computes live (so it moves, and `sealed` says so); a sealed term reads the frozen rows. A screen that only worked after sealing would be useless during the term it is about.
• POST /education/terms/{term_id}/seal · scope education:writeSeal TermFreeze this term's results, so a transcript stops moving when a teacher regrades. STAFF ONLY, and enforced by the INSERT policy on `term_result` rather than only by the check below - the check produces a sentence, the policy is what holds. SEALING IS ONE-WAY AND ONE-TIME. A second seal is refused rather than overwriting, because overwriting is precisely the thing this table exists to make imposs…
• POST /education/transcript/shares · scope education:writeCreate Transcript ShareMint a shareable transcript - the student's own act, and nobody else's. THE SCHOOL CANNOT DO THIS FOR THEM. The INSERT policy admits only rows whose `student_user_id` is the caller, so a school publishing a student's record is not merely discouraged, it is impossible through the application. That is the mirror of Wave D, where only a guardian could consent for a minor; here only the student can c…
• GET /education/transcript/shares/mine · scope education:readMy Transcript SharesEvery transcript link this student has ever minted, withdrawn ones included. "Who have I sent my grades to?" is a question a person is entitled to answer later, which is why 402 has no DELETE policy: revoking a share withdraws the ACCESS and keeps the RECORD. A list that quietly dropped withdrawn shares would answer a different, more comfortable question. Scoped by the caller's own RLS rather th…
• POST /education/transcript/shares/{share_id}/revoke · scope education:writeRevoke Transcript ShareWithdraw a shared transcript. Immediate, and the record that it existed stays. There is no DELETE policy on the table on purpose: "who have I sent my grades to?" is a question a student is entitled to answer later, and deleting the row would erase the answer along with the access.
• GET /education/translations/pending-review · scope education:readList Pending ReviewEvery draft_ready translation this user may act on, across ALL their schools. WHY THIS EXISTS. `mark-reviewed` has always been here, and so has the `human_reviewed` state - but the only way to FIND a pending draft was GET /courses/{course_id}/translations, one course at a time. A school with forty courses had no way to see what was waiting, so in practice nothing ever got reviewed and `human_revi…
• DELETE /education/translations/{translation_id} · scope education:writeDelete Translation
• POST /education/translations/{translation_id}/create-course · scope education:writeCreate Course From TranslationMaterializes a real, human-reviewed translation into a genuine, independent `course` row (with real modules and lessons) - a real sibling of the original, students can actually enroll in and study, not just translated text sitting in a draft table. Only reachable from status='human_reviewed' - the explicit mark_reviewed step above is mandatory first. Each translation can only be materialized once …
• PATCH /education/translations/{translation_id}/mark-reviewed · scope education:writeMark ReviewedA human explicitly confirming the MT draft has been reviewed - never automatic, matching this project's standing 'AI drafts, never authoritative' pattern. Education has no structured review_cycle system the way Publishers does (a genuine, real scoping difference, not an oversight - Education's own editorial model is simpler: draft/published/archived with no reviewer roles), so this is a plain, dir…
• GET /education/translations/{translation_id}/modules · scope education:readGet Translated ContentThe real, structured translated preview - every module with its own real translated lessons nested inside, in order - what a reviewer actually reads before deciding to materialize it into a real course.
• GET /education/tutor/courses/{course_id}/messages · scope education:readGet Tutor History
• POST /education/tutor/courses/{course_id}/messages · scope education:writeSend Tutor Message
• GET /education/tutor/courses/{course_id}/sessions · scope education:readList Course Tutor SessionsThe educator view's index: every tutor session in this course. Staff-gated at the endpoint for a clean sentence; RLS (390) is the real control on every row.
• GET /education/tutor/sessions/{session_id}/messages · scope education:readGet Session MessagesOne transcript. RLS decides who this answers for: the student themself, staff of the course's school, a minor student's guardian, or the owner - anyone else gets an honest 404 because for them the session does not exist.
• GET /education/tutor/students/{student_user_id}/sessions · scope education:readList Student Tutor SessionsThe guardian view's index: a linked MINOR student's tutor sessions, with course titles in student_name's place left to the client. RLS (390) admits rows only for the student, their school staff, a minor's guardian, or the owner - an empty list is the honest answer for everyone else.
• POST /education/tutor/{course_id}/messages/{message_id}/speak · scope education:writeSpeak Tutor MessageThe character speaks their line aloud (Wave N, N4) - the same counsel guard as the Concierge's /speak, same shape exactly: only a SERVER-OWNED line is ever voiced, here a stored assistant reply from the caller's OWN tutor session (RLS scopes the SELECT, and the role filter means a student cannot make the voice read their own words back as if the platform said them). Voice ladder identical to the C…
• GET /staff-growth/benefit-plans · scope education:readList Benefit Plans
• POST /staff-growth/benefit-plans · scope education:writeCreate Benefit PlanThe owner defines the catalog - 'all types' by construction, because a type is a row. Fitinty records elections and exports them; the CARRIER administers the benefit.
• GET /staff-growth/cadence-alerts · scope education:readCadence AlertsEVERY ALERT CARRIES A PROPOSED ACTION (the standing rule). Three kinds, computed on read from real rows: a review past its cadence, a role's required training missing or unfinished, a certification aged past recert_days. A quiet list means the checks RAN and found nothing - the response says so rather than returning a bare empty list.
• GET /staff-growth/cadence-settings · scope education:readGet Cadence
• POST /staff-growth/cadence-settings · scope education:writeSet CadenceThe owner's dial. NULL/absent = no cadence - an org that reviews ad-hoc is a choice, not a defect, so no alert fires for it.
• GET /staff-growth/documents/{document_id}/file · scope education:readRead Document
• GET /staff-growth/employees/{employee_id}/compensation · scope education:readList CompensationOwner-only BY RLS: anyone else gets an empty list, and an empty list here means 'not yours to see' as much as 'none recorded' - the endpoint cannot tell you which.
• POST /staff-growth/employees/{employee_id}/compensation · scope education:writeRecord Compensation
• GET /staff-growth/employees/{employee_id}/documents · scope education:readList Documents
• POST /staff-growth/employees/{employee_id}/documents · scope education:writeUpload DocumentCUSTODY, not generation: the paystub or W-2 the tenant's real payroll provider issued gets a home the employee and the owner can both reach - Fitinty computed none of it and never will from here.
• POST /staff-growth/employees/{employee_id}/elections · scope education:writeElect BenefitThe employee's own act (their login, or the owner recording a paper election). Electing a closed plan is refused - the window is the owner's dial.
• GET /staff-growth/employees/{employee_id}/elections · scope education:readList Elections
• POST /staff-growth/employees/{employee_id}/enroll · scope education:writeEnroll EmployeeOne click from the roster into the org's OWN school - Education's machinery does the rest (spine, competencies, coverage, credentials). Never a parallel training system.
• GET /staff-growth/employees/{employee_id}/offboarding · scope education:readOffboardingThe checklist materializes from the org's template (seeded with honest defaults on first use) the first time a terminated employee's is read.
• POST /staff-growth/employees/{employee_id}/offboarding/done · scope education:writeOffboarding Done
• GET /staff-growth/employees/{employee_id}/orientation · scope education:readOrientationEH1 - THE DAY-ONE PACKET. The checklist (offboarding's mirror, materialized on first read) plus the real facts a new person needs: who their manager is and what training their role requires - read from rows, never invented.
• POST /staff-growth/employees/{employee_id}/orientation/done · scope education:writeOrientation Done
• GET /staff-growth/employees/{employee_id}/reviews · scope education:readList Reviews
• POST /staff-growth/employees/{employee_id}/reviews · scope education:writeCreate Review
• GET /staff-growth/employees/{employee_id}/screening · scope education:readList Screening
• POST /staff-growth/employees/{employee_id}/screening · scope education:writeRecord ScreeningHis question, his own hard line: eligibility-to-work and background checks are recorded as FACTS - kind, status, date, category note. Never a number.
• GET /staff-growth/employees/{employee_id}/training · scope education:readEmployee TrainingThe roster's honest training view: the employee's enrollments in THIS org's courses, each with its status. No login yet = no training possible, said in words.
• GET /staff-growth/employees/{employee_id}/transitions · scope education:readList Transitions
• POST /staff-growth/employees/{employee_id}/transitions · scope education:writeRecord TransitionA promotion is a RECORDED transition that itself applies the change - one writer, so the history and the record can never disagree.
• POST /staff-growth/employees/{employee_id}/verification · scope education:writeCreate Verification"Worked here, X to Y" on the same signature discipline as certificates. Works for current AND former employees - the reference an ex-employee actually needs. Revoke by deleting the row; the public link then answers not-found, never a fabricated 'valid'.
• GET /staff-growth/employees/{employee_id}/warnings · scope education:readList Warnings
• POST /staff-growth/employees/{employee_id}/warnings · scope education:writeCreate Warning
• GET /staff-growth/my-work · scope education:readMy WorkONE honest view of the signed-in person's working life: their employee records, what waits for their hand (reviews to sign, warnings to acknowledge), their documents and their courses. Sections whose waves have not landed (shifts, the ID card) are simply absent - never a fake placeholder.
• GET /staff-growth/org-courses · scope education:readOrg CoursesWhat this org can train ON: its own schools' courses (any type - a store's training school is just a school whose type says so).
• GET /staff-growth/payroll-export · scope education:readPayroll ExportTHE PAYROLL-READY EXPORT - the boundary made useful. Hours from the ONE time arithmetic, the latest compensation row, and elected benefits, per employee, as CSV a real payroll provider consumes. NO tax math, NO withholdings, NO net pay - the header says so, so the file can never be mistaken for a payroll run. Owner-only.
• POST /staff-growth/reviews/{review_id}/acknowledge-offline · scope education:writeAcknowledge OfflineFor the record-only worker with no login: the owner records that the review was read together, with a note that must exist - a silent checkbox would be a secret file with extra steps.
• POST /staff-growth/reviews/{review_id}/share · scope education:writeShare ReviewDraft -> shared: from this moment the employee's own login can read it (RLS's owner-or-self policy) and only THEY can sign it.
• POST /staff-growth/reviews/{review_id}/sign · scope education:writeSign ReviewTHE EMPLOYEE signs - nobody else. The check is identity, not role: the signer's login must be the one linked to the reviewed employee.
• GET /staff-growth/role-requirements · scope education:readList Requirements
• POST /staff-growth/role-requirements · scope education:writeAdd Requirement
• DELETE /staff-growth/role-requirements/{requirement_id} · scope education:writeRemove Requirement
• POST /staff-growth/warnings/{warning_id}/acknowledge · scope education:writeAcknowledge WarningThe employee acknowledges - identity, not role, exactly like signing a review.

The commerce spine: listings, carts, orders and vendors, shared by every pillar that sells.

• GET /counter/products · scope marketplace:readCounter ProductsWhat the counter can ring up: the org's PUBLISHED products from the same mirror the storefront serves - one catalog, two doors.
• POST /counter/sales · scope marketplace:writeRecord Sale
• GET /counter/sales · scope marketplace:readList Sales
• POST /customer-issues · scope marketplace:writeRaise IssueThe customer's door. Recorded, told to the book, counted on the advisor - executed by nobody.
• GET /customer-issues/business/{organization_id} · scope marketplace:readBusiness IssuesThe business's side: open first. Membership asked IN THE BODY, in words - the wall would answer with an empty list, which reads exactly like a business nobody has asked anything of.
• GET /customer-issues/mine · scope marketplace:readMy IssuesThe person's own requests, on their own cursor (the self arm); business names on the system cursor.
• POST /customer-issues/{issue_id}/answer · scope marketplace:writeAnswer IssueThe business answers in words; closing needs a reason (the row's own CHECK). The customer's words are never touched. Told to the book so the answer sits beside the request.
• GET /disputes · scope marketplace:readDispute InboxONE inbox. Opening it IS the sweep - no daemon to trust, and the note says when and what was read. Every dispute carries its proposed action.
• POST /disputes/{dispute_id}/assemble · scope marketplace:writeAssemble
• POST /disputes/{dispute_id}/draft · scope marketplace:writeDraft ResponseAI DRAFTS, GROUNDED IN THE ASSEMBLED PACK ONLY - it runs after the readers, refers to nothing outside them, and what it writes stays a draft until the owner submits.
• PATCH /disputes/{dispute_id}/note · scope marketplace:writeEdit Note
• POST /disputes/{dispute_id}/submit · scope marketplace:writeSubmit ResponseTHE OWNER'S HAND. Pushes the pack + draft + note to Stripe as the dispute's evidence, on the TENANT'S OWN account. Final: the card network reads what is sent.
• GET /marketplace/affiliate/clickbank-config · scope marketplace:readGet Clickbank Config
• POST /marketplace/affiliate/clickbank-config · scope marketplace:writeSave Clickbank ConfigReal upsert - saving a config a second time keeps the SAME real webhook_token (it's the org's own permanent webhook address, already pasted into their live ClickBank account) but rotates the secret key, same "replace the stored secret" convention as the other six networks' own credential save endpoint.
• GET /marketplace/affiliate/clickbank-transactions · scope marketplace:readList Clickbank Transactions
• GET /marketplace/affiliate/network-credentials · scope marketplace:readList Network CredentialsReal, per-org configured network connections. Never returns a secret - only the connection/sync bookkeeping a caller needs to decide whether a network is already set up and whether its last real sync succeeded.
• POST /marketplace/affiliate/network-credentials · scope marketplace:writeSave Network CredentialReal upsert - saving a credential for a network the org has already configured replaces the stored secret rather than creating a duplicate row (the real UNIQUE(organization_id, network) constraint is what enforces this, not just application logic).
• DELETE /marketplace/affiliate/network-credentials/{network} · scope marketplace:writeDelete Network Credential
• GET /marketplace/affiliate/network-credentials/{network}/catalog · scope marketplace:readSearch Network CatalogReal, on-demand product/ad catalog search using the org's own stored credential - genuinely distinct from .../sync above (which reads a vendor's own PAST commission history). Never writes to last_synced_at/last_sync_status/last_sync_detail - a catalog search is a read-only lookup, not a sync event. For jvzoo/warriorplus/ rakuten_advertising this honestly reports that no real catalog endpoint could…
• POST /marketplace/affiliate/network-credentials/{network}/sync · scope marketplace:writeSync Network CredentialRuns the real, network-specific API call using the org's own stored credential - never a mocked or fabricated result. A real network/auth failure is persisted honestly as last_sync_status='error' with the actual error text, not silently swallowed or reported as success. Combined Roadmap row 6: a real successful sync's own total_amount/count (already computed by sync_network(), previously thrown a…
• GET /marketplace/affiliate/offers · scope marketplace:readList Published Offers
• POST /marketplace/affiliate/offers · scope marketplace:writeCreate Offer
• GET /marketplace/affiliate/offers/mine · scope marketplace:readList My Offers
• PATCH /marketplace/affiliate/offers/{offer_id} · scope marketplace:writeUpdate Offer
• POST /marketplace/affiliate/offers/{offer_id}/click · scope marketplace:writeRecord Click
• GET /marketplace/affiliate/offers/{offer_id}/clicks · scope marketplace:readCount Clicks
• POST /marketplace/affiliate/offers/{offer_id}/promo-drafts · scope marketplace:writeDraft Promo ContentRow 5 - AI-drafted affiliate promo content, reusing Content Factory's real Creative Agent (draft_creative_json) and Visual Agent (generate_visual_asset) directly, imported from marketing_content_factory rather than duplicated here. The "research" grounding is the offer's own real merchant/product/disclosure fields - genuinely real connected data, not a knowledge-base search (there's no marketing_p…
• GET /marketplace/affiliate/offers/{offer_id}/promo-drafts · scope marketplace:readList Promo Drafts
• GET /marketplace/affiliate/promo-drafts/{asset_id}/image · scope marketplace:readDownload Promo Image
• PATCH /marketplace/affiliate/promo-drafts/{asset_id}/status · scope marketplace:writeSet Promo Status
• POST /marketplace/affiliate/webhooks/clickbank/{webhook_token} · scope marketplace:writeReceive Clickbank NotificationThe real, unauthenticated (no Fitinty session - ClickBank itself calls this) receiver ClickBank's own INS posts to. Runs under `db.system_cursor`'s owner-bypass RLS context, same as OnlyOffice's own server-callback endpoints - real access control here is the webhook token itself (an unguessable per-org secret path segment) PLUS the AES decryption succeeding at all, which is only possible with the …
• POST /marketplace/digital-assets · scope marketplace:writeUpload Digital Asset
• GET /marketplace/digital-assets/by-product/{medusa_product_id} · scope marketplace:readGet Asset By ProductIs this product a digital download - asked by the BUYER'S OWN ORDER SCREEN, once per line item, to decide whether to offer a Download button. READ ON THE SYSTEM CURSOR SINCE 585, and the reason is the whole design: the row is walled to the SELLING organization, because a buyer's right to a file is a Medusa receipt and no Postgres predicate can see it. Left on the caller's cursor this would answer…
• GET /marketplace/digital-assets/mine · scope marketplace:readList My Assets
• DELETE /marketplace/digital-assets/{asset_id} · scope marketplace:writeDelete Digital Asset
• GET /marketplace/digital-assets/{asset_id}/download · scope marketplace:readDownload Digital Asset
• GET /marketplace/integrations · scope marketplace:readList IntegrationsReal status for the integrations this pillar actually has - not a catalog of connectors that could theoretically exist. Extend this list only when a new integration is genuinely wired in, the same discipline already applied to Workspace's System Health page.
• POST /marketplace/landing · scope marketplace:writeUpsert LandingCreate or rewrite the page as a DRAFT - publishing is its own deliberate door.
• GET /marketplace/landing/mine · scope marketplace:readMy Landings
• POST /marketplace/landing/{landing_id}/publish · scope marketplace:writePublish Landing
• GET /marketplace/luxury/provider-status · scope marketplace:readProvider Status
• POST /marketplace/luxury/requests · scope marketplace:writeCreate Request
• GET /marketplace/luxury/requests · scope marketplace:readList Requests
• POST /marketplace/luxury/requests/{request_id}/cancel · scope marketplace:writeCancel Request
• POST /marketplace/luxury/requests/{request_id}/record-result · scope marketplace:writeRecord ResultOwner-only. Records a REAL provider verdict (a genuine Entrupy certificate). This is the ONLY way a request reaches an authenticated/not_authentic/inconclusive status — never fabricated by code. Requires a real certificate id so a verdict can always be traced to a real authentication.
• GET /marketplace/orders/mine · scope marketplace:readList My OrdersA buyer's own orders, read from Medusa. WHAT WAS WRONG. This queried `marketplace_order`, a table dropped when the Marketplace moved to Medusa - `marketplace_return` carries a plain `medusa_order_id TEXT` rather than a foreign key for exactly that reason. Every call raised `relation "marketplace_order" does not exist`, so the endpoint answered 500 for every signed-in person. Nothing reported it b…
• GET /marketplace/promotions/mine · scope marketplace:readMy PromotionsThe seller's shelf, each row's state in words - a lapsed one says so.
• GET /marketplace/promotions/prices · scope marketplace:readPromo PricesThe picker - platform data, with the billing truth stated per row.
• POST /marketplace/promotions/request · scope marketplace:writeRequest PromotionThe seller's ask. Their own PUBLISHED product only; one live or pending promotion per product at a time. Born pending_payment - nothing surfaces until activation, and the response says exactly what happens next.
• POST /marketplace/promotions/{promotion_id}/activate · scope marketplace:writeActivate PromotionTHE EMPEROR'S HAND - the standing comp ruling until Dodo carries slot products. Stamped 'comp': a comped spotlight is never dressed as revenue, and NO ledger row is written (the ledger records captured payments, never favors).
• POST /marketplace/rd · scope marketplace:writeCreate Rd
• GET /marketplace/rd · scope marketplace:readList Rd
• POST /marketplace/rd/{project_id}/advance · scope marketplace:writeAdvance RdOne stage forward, never skipping - and NEVER without a real note, because the stages that matter (sample, test, package) are HUMAN handshakes with suppliers and manufacturers; the record tracks them, it does not fake them.
• POST /marketplace/returns · scope marketplace:writeRequest Return
• GET /marketplace/returns/mine · scope marketplace:readList My Returns
• GET /marketplace/returns/to-review · scope marketplace:readList Returns To ReviewFetches every pending return, then asks Medusa (via this vendor's own session) which underlying orders they can actually see - Medusa's own store-scoping does the real per-vendor narrowing here, since orders aren't tagged with a Fitinty-visible tenant_id the way our own tables are. See migration 011's comment for the reasoning.
• PATCH /marketplace/returns/{return_id} · scope marketplace:writeUpdate Return Status
• GET /marketplace/suppliers · scope marketplace:readList Suppliers
• POST /marketplace/suppliers · scope marketplace:writeCreate Supplier
• POST /marketplace/suppliers/sweep · scope marketplace:writeSweep FeedsM3 - THE STANDING SWEEP, made real. Every ACTIVE url_feed and fitinty-partner supplier across the platform syncs through the ONE pipeline; each supplier's failure lands on its own row in words and never blocks the others. Owner-only: this is the Emperor's timer's door (24/7 decree - the doctor timer hits it; the launch checklist carries the systemd entry). A tenant syncs their own supplier from th…
• PUT /marketplace/suppliers/{supplier_id} · scope marketplace:writeUpdate Supplier
• POST /marketplace/suppliers/{supplier_id}/forward · scope marketplace:writeForward OrderSANDBOX. Records the dropship forward the real rail will someday send - practiced end to end, honest about being practice. Nothing leaves the platform; the row says simulated_sent and every screen that shows it must say so too.
• POST /marketplace/suppliers/{supplier_id}/sync · scope marketplace:writeSync NowSync one supplier now. A csv_feed takes the uploaded sheet; a url_feed fetches its URL (public hosts only, size-capped). The standing sweep (POST /marketplace/suppliers/sweep, the Emperor's timer) runs the same `sync_supplier` for every active url_feed and fitinty partner feed - one pipeline, nothing to drift. (M3 note: an earlier docstring CLAIMED a nightly job that never existed - a promise in p…
• POST /marketplace/vendor · scope marketplace:writeCreate Vendor
• GET /marketplace/vendor/all · scope marketplace:readList All Vendors
• POST /marketplace/vendor/discounts · scope marketplace:writeCreate Discount
• GET /marketplace/vendor/discounts · scope marketplace:readList DiscountsThe shelf, with REAL redemption counts read from Medusa per code.
• POST /marketplace/vendor/discounts/{discount_id}/deactivate · scope marketplace:writeDeactivate DiscountThe off switch - flipped in Medusa AND on the mirror, in that order, so a code that Medusa still honors is never shown as off.
• GET /marketplace/vendor/listing-options · scope marketplace:readListing OptionsWhat the listing form can honestly offer: the currencies real regions price in, and the categories this vendor's own catalog already uses (a picker seeded from their own data, free text allowed - a marketplace this young must not invent a taxonomy nobody asked for).
• GET /marketplace/vendor/mine · scope marketplace:readGet My Vendor Endpoint
• GET /marketplace/vendor/orders · scope marketplace:readList Vendor Orders
• POST /marketplace/vendor/orders/{order_id}/fulfill · scope marketplace:writeFulfill OrderM2 - the seller's hand: every unfulfilled item into one fulfillment. When the order is backed by a PAID rail checkout, the Medusa-side payment is captured too, so the store's own records match the money that really moved - a practice-rail order is never dressed as captured.
• POST /marketplace/vendor/orders/{order_id}/ship · scope marketplace:writeShip OrderM2 - the tracking number goes on the fulfillment; the buyer's order page shows the shipped state the moment this lands.
• GET /marketplace/vendor/products · scope marketplace:readList Vendor Products
• POST /marketplace/vendor/products · scope marketplace:writeCreate Vendor ProductOne listing, full width (LST1): many images (first leads), a real currency, a category, and a draft state. `file` stays accepted so older callers keep working.
• POST /marketplace/vendor/products/bulk-csv · scope marketplace:writeBulk Csv ImportBulk listings from a CSV (LST3) - the first way a whole catalog enters this platform without typing it in one product at a time. Columns: title (required), description, price, currency, category, status (draft|published, default draft). ALL-OR-NOTHING: every row is validated FIRST and a bad file is refused with each problem named by row number - a partial import that silently skipped rows would r…
• GET /marketplace/vendor/products/costs · scope marketplace:readList Listing Costs
• PUT /marketplace/vendor/products/{product_id} · scope marketplace:writeUpdate Vendor ProductThe end of write-once (LST1): title, words, price, currency, category and draft state are all the vendor's to change. Ownership is the vendor's own scoped Medusa session - a product their store cannot see cannot be edited, and the mirror updates in the same transaction so the storefront never serves the old words.
• DELETE /marketplace/vendor/products/{product_id} · scope marketplace:writeDelete Vendor ProductDeletes the Medusa product; the mirror row is DEACTIVATED, never deleted - history survives and a re-list reactivates it (the mirror's own standing rule).
• PUT /marketplace/vendor/products/{product_id}/cost · scope marketplace:writeSet Listing CostThe tenant's PRIVATE cost (441) - margin advice needs it, only they know it, and it never touches the public mirror. Ownership refereed by their scoped session as every product write is.
• POST /marketplace/vendor/products/{product_id}/images · scope marketplace:writeAdd Vendor Product ImagesAdd photos to an existing listing - enhanced through the same pipeline as every image upload on the platform, appended after the ones already there.
• GET /marketplace/vendor/questions · scope marketplace:readList My Product QuestionsThe seller's queue - unanswered first, because each is a buyer mid-decision. Which is exactly why the cap mattered: the ordering puts the unanswered at the top, so the hundred-and-first question a seller never sees is one somebody is still waiting on.
• POST /marketplace/vendor/questions/{question_id}/answer · scope marketplace:writeAnswer Product Question
• POST /marketplace/vendor/questions/{question_id}/hide · scope marketplace:writeHide Product QuestionThe Commons' hand: hidden WITH a reason on the row, never erased - abuse happens, erasure of what was asked is how it compounds.
• POST /marketplace/vendor/referral-program · scope marketplace:writeSet ProgramThe seller's dial. Existing codes keep working when the program pauses - a code already in a friend's hands is a promise; pausing stops NEW codes only.
• GET /marketplace/vendor/referral-program · scope marketplace:readMy ProgramThe desk view: the dials, every code, every reward minted.
• POST /marketplace/vendor/vendor/mirror-sync · scope marketplace:writeSync Public Product MirrorBackfill + resync of the public-storefront product mirror (migration 233). Loops every vendor and lists their products through their OWN scoped Medusa session -- the same mechanism the vendor UI uses, and the only reliable store->products mapping (the admin store_id query param is silently ignored by the marketplace plugin; verified with a bogus-id probe before this was written). Credentials neve…
• PATCH /marketplace/vendor/{vendor_id}/verify · scope marketplace:writeSet Vendor Verified
• POST /reviews/course/{course_id} · scope marketplace:writeReview Course
• POST /reviews/platform · scope marketplace:writeReview PlatformA tenant's word about Fitinty, published where visitors read it - the hard ones too. Proof: a real org membership. One review per membership; a new org earns another voice.
• POST /reviews/practice/{office_id} · scope marketplace:writeReview PracticeA practice is reviewed by a client who PAID it at least once on the rail (any kind - consultation, deposit, invoice). The proof ref is the client's ROOM: one relationship, one voice (the unique triple). Satisfaction ratings stay private to the practice; this is the public word, verified the same way every other review on the platform is.
• GET /reviews/reported · scope marketplace:readReported ReviewsThe Emperor's queue: everything reported, nothing yet hidden.
• POST /reviews/service/{listing_id} · scope marketplace:writeReview Service
• POST /reviews/{review_id}/hide · scope marketplace:writeHide ReviewTHE EMPEROR'S HAND ALONE, with a reason on the row - including reviews of Fitinty.
• POST /reviews/{review_id}/report · scope marketplace:writeReport ReviewThe subject's org REPORTS - it cannot hide. A seller who could hide critical reviews would be fake social proof by omission.
• GET /store-analytics/insights · scope marketplace:readStore InsightsEvery store the caller's organizations run, each with its trend, top products and AOV.
• POST /storefront-intents/{token}/claim · scope marketplace:writeClaim IntentExecutes a stored intent for the now-authenticated user - the real enrollment / booking / interest write, exactly as the signed-in flows do it. Single-use; expired or unknown tokens 404 (no oracle for guessing tokens).
• GET /supply/carry · scope marketplace:readWhat I CarryTHE STORE'S OWN READING: every consignment offered to or carried by this business, each line naming its supplier (on the system cursor - 591) and the organ it rides; what is owed per supplier and currency (lines minus the payouts recorded by hand); the payouts recorded; the business's own currency for the screen to print in. A member of another store reads 403 in words.
• POST /supply/consignments · scope marketplace:writeOfferThe supplier's offer, with the consent words RECORDED; born 'offered'.
• GET /supply/consignments · scope marketplace:readConsignmentsBoth sides on one door for one of the caller's organizations: what it consigned (and is owed), what it was offered and carries (and owes).
• POST /supply/consignments/{consignment_id}/accept · scope marketplace:writeAcceptTHE SELLER's word: its retail price, and the thing on ITS store. Only the seller's people accept.
• POST /supply/consignments/{consignment_id}/decline · scope marketplace:writeDecline
• POST /supply/consignments/{consignment_id}/stop · scope marketplace:writeStop CarryingTHE STORE'S hand: it stops carrying an accepted consignment WITH A REASON the supplier reads. The product comes down on the store's OWN cursor (it owns the vendor row); what sold stays owed; 'closed' is the CHECK's own word for it, and the supplier's withdraw stays the supplier's.
• POST /supply/consignments/{consignment_id}/withdraw · scope marketplace:writeWithdrawTHE SUPPLIER's hand, at will: what is unsold comes back and the seller's product comes down.
• GET /supply/sellers · scope marketplace:readSellersEvery tenant with a real store, so a supplier can offer to one. Names and slugs only.
• POST /supply/{seller_organization_id}/payouts · scope marketplace:writeRecord PayoutRule 3: the seller RECORDS what it paid a supplier by its own hand; no transfer is made here.

Manuscripts to finished books, and the hand-off that turns a book into a course.

• PATCH /publishers/audiobook-chapters/{ab_chapter_id} · scope publishers:writeUpdate Ab Chapter
• POST /publishers/audiobook-chapters/{ab_chapter_id}/generate-narration · scope publishers:writeGenerate NarrationReal AI narration for one audiobook chapter, cloned from a real consented voice sample - the actual mechanical gate that has been missing since this pillar's voice-consent capture was built: an ACTIVE consent record belonging to the SAME house, and a real captured sample of that same consented voice, checked here before any generation is ever triggered.
• POST /publishers/audiobook-chapters/{ab_chapter_id}/recording · scope publishers:writeUpload Recording
• GET /publishers/audiobook-chapters/{ab_chapter_id}/recording · scope publishers:readDownload Recording
• PATCH /publishers/audiobook-projects/{project_id} · scope publishers:writeUpdate Audiobook Project
• POST /publishers/audiobook-projects/{project_id}/assemble-m4b · scope publishers:writeAssemble M4BReal, complete-book M4B assembly - every chapter's own real recording (human-uploaded or AI-generated, mixed formats/codecs are fine, ffmpeg decodes and re-encodes each one) concatenated in real position order into one genuine M4B with real embedded, correctly-titled chapter markers (ffmpeg's own FFMETADATA1 mechanism, timestamps computed from each real chapter's own measured duration, never estim…
• GET /publishers/audiobook-projects/{project_id}/assembled-m4b · scope publishers:readDownload Assembled M4B
• GET /publishers/audiobook-projects/{project_id}/chapters · scope publishers:readList Ab Chapters
• POST /publishers/audiobook-projects/{project_id}/chapters · scope publishers:writeAdd Ab Chapter
• PATCH /publishers/authors/{author_id} · scope publishers:writeUpdate Author
• DELETE /publishers/authors/{author_id} · scope publishers:writeDelete Author
• PATCH /publishers/authors/{author_id}/archive · scope publishers:writeArchive Author
• GET /publishers/authors/{author_id}/can-delete · scope publishers:readCan Delete Author
• POST /publishers/authors/{author_id}/photo · scope publishers:writeUpload Author PhotoAccepts an uploaded photo OR a direct camera capture (the frontend's file input uses the `capture` attribute so phones/tablets open their camera app directly, matching the Emperor's "upload, link to phone, tablet, or camera" request - both paths arrive here as a normal multipart file). Every photo is run through enhance_image() before storage - the Emperor's explicit instruction that all images in…
• GET /publishers/authors/{author_id}/photo · scope publishers:readGet Author Photo
• POST /publishers/authors/{author_id}/polish-bio · scope publishers:writePolish Author BioAI copy-edit assistance for the author bio (the Emperor's explicit ask - everything else in the pipeline gets AI drafting/polish by default, but the bio and back-cover blurb, both human-typed text fields, had none). Same "AI drafts, never authoritative" shape as writing_voice_profile's own draft endpoint: takes whatever the caller currently has in the field (saved or not), never touches the stored…
• PATCH /publishers/authors/{author_id}/restore · scope publishers:writeRestore Author
• GET /publishers/books/{book_id} · scope publishers:readGet Book
• PATCH /publishers/books/{book_id} · scope publishers:writeUpdate Book
• DELETE /publishers/books/{book_id} · scope publishers:writeDelete Book
• PATCH /publishers/books/{book_id}/archive · scope publishers:writeArchive Book
• GET /publishers/books/{book_id}/audiobook-project · scope publishers:readGet Audiobook Project
• POST /publishers/books/{book_id}/audiobook-project · scope publishers:writeCreate Audiobook Project
• GET /publishers/books/{book_id}/can-delete · scope publishers:readCan Delete Book
• GET /publishers/books/{book_id}/cross-links · scope publishers:readGet Book Cross LinksRow 11 Phase 4's real "concrete cross-promotion hooks" - the exact same real, live-computed resolution already proven and used inside the composed back-cover image (publishers_barcode.py's own three resolve_*_cta_url functions), now also exposed as a plain JSON endpoint so the book detail page can render real, visible, clickable links - not just a QR code baked into a downloadable PNG. Deliberatel…
• GET /publishers/books/{book_id}/editions · scope publishers:readList Editions
• POST /publishers/books/{book_id}/editions · scope publishers:writeCreate EditionUNIQUE(book_id, format, language, interior_color_mode) is a real DB constraint enforcing "one format + one language + one interior color = one edition identity" - extended from the spec's original (format, language)-only rule so a house can create BOTH a black-and-white and a color paperback/hardcover/large_print of the same book as two real, separate editions, each able to carry its own real ISBN…
• POST /publishers/books/{book_id}/lccn-request · scope publishers:writeCreate Lccn Request
• GET /publishers/books/{book_id}/lccn-worksheet · scope publishers:readGet Lccn Worksheet
• GET /publishers/books/{book_id}/plan · scope publishers:readBook Plan
• POST /publishers/books/{book_id}/plan/declare · scope publishers:writeDeclare Book PlanThe author's declaration, at will. Re-declaring ADDS missing cells and never doubles or deletes what stands - removal is its own deliberate door.
• PATCH /publishers/books/{book_id}/restore · scope publishers:writeRestore Book
• POST /publishers/books/{book_id}/royalty-splits · scope publishers:writeAdd Split
• GET /publishers/books/{book_id}/royalty-splits · scope publishers:readList Splits
• DELETE /publishers/chapter-images/{image_id} · scope publishers:writeDelete Chapter Image
• GET /publishers/chapter-images/{image_id}/file · scope publishers:readGet Chapter Image File
• POST /publishers/chapter-versions/{version_id}/restore · scope publishers:writeRestore Chapter VersionReal restore-to-a-prior-chapter-version - mirrors restore_manuscript_ version's own "always auto-snapshot the CURRENT state first" discipline (so the restore is itself reversible), then applies the target version's own stored title/content back onto the real chapter row.
• PATCH /publishers/chapters/{chapter_id} · scope publishers:writeUpdate Chapter
• DELETE /publishers/chapters/{chapter_id} · scope publishers:writeDelete Chapter
• POST /publishers/chapters/{chapter_id}/compute-sage · scope publishers:writeCompute Sage In ChapterReal Sage compute-and-freeze (task #156). Scans `body.content` - the CHAPTER EDITOR'S CURRENT, possibly-unsaved content, not necessarily what's stored in the DB yet, matching the AI polish endpoints' own "operate on whatever the author is currently editing" contract - for every [[sage:expr]] marker, runs each one through a real, genuinely sandboxed Sage container (sage_sandbox.run_sage_code, see t…
• POST /publishers/chapters/{chapter_id}/draft-code · scope publishers:writeDraft CodeReal AI-drafted Python/Sage code from a plain-English description (task #159/160), meant for insertion into a real Jupyter cell - the author still reviews it and must explicitly click Run before anything executes in the sandbox, matching task #157's own "AI drafts, human triggers execution" boundary exactly. Never executed here - this endpoint only ever returns text.
• POST /publishers/chapters/{chapter_id}/draft-latex · scope publishers:writeDraft LatexReal AI-drafted LaTeX from a plain-English description (task #159/160) - closes the one real gap flagged once MathLive/SageMath/ Jupyter shipped with zero AI layer. The author still edits it live in MathLive and must explicitly insert/save it - this endpoint only ever returns text, it never touches the database. Gated on real house membership for this specific chapter, same as every other chapter-…
• GET /publishers/chapters/{chapter_id}/images · scope publishers:readList Chapter Images
• POST /publishers/chapters/{chapter_id}/images · scope publishers:writeUpload Chapter ImageA real uploaded illustration a chapter can reference inline via [[image:ID]] (see publishers_content_blocks.py) - rendered as a real embedded image in both EPUB and print PDF, not just stored. Run through enhance_image() before storage, same as every other image upload in this pillar.
• POST /publishers/chapters/{chapter_id}/jupyter/execute · scope publishers:writeExecute Jupyter CellRuns one real cell against an already-started session's live kernel - a later cell genuinely sees state an earlier cell in the SAME session defined, the whole point of task #157 over #156's one-shot primitive. Real ownership is enforced inside jupyter_sandbox.execute_in_session itself (a session belongs to the user who started it), independent of this chapter-level check.
• POST /publishers/chapters/{chapter_id}/jupyter/start · scope publishers:writeStart Jupyter SessionStarts one real, isolated, long-lived Jupyter kernel container (task #157 - see jupyter_sandbox.py's own module docstring for the full real isolation posture and the real Kernel Gateway investigation behind this design). Opportunistically sweeps any of THIS user's other sessions that have gone idle past the real timeout, so starting a fresh session is also the natural moment stale ones get reaped.
• POST /publishers/chapters/{chapter_id}/jupyter/stop · scope publishers:writeStop Jupyter SessionExplicitly, immediately tears down the real container - the honest, author-triggered counterpart to the idle-timeout sweep, so a session an author is done with doesn't sit consuming real memory/CPU until the timeout eventually catches it.
• POST /publishers/chapters/{chapter_id}/polish · scope publishers:writeRun PolishAnalyzes the chapter and REPLACES its still-pending suggestions with the fresh run's results (applied/dismissed history is never touched). Suggestions whose excerpt is not verbatim-findable in the plain text are dropped at creation - the model quoting loosely is a model problem, never the author's.
• GET /publishers/chapters/{chapter_id}/polish-suggestions · scope publishers:readList Suggestions
• GET /publishers/chapters/{chapter_id}/versions · scope publishers:readList Chapter Versions
• POST /publishers/chapters/{chapter_id}/versions · scope publishers:writeSave Chapter VersionReal per-chapter version snapshot (row 9) - the same real, reviewable revision-history discipline as save_manuscript_version below, scoped to just this one chapter so restoring a single scene never touches any other chapter's own, separately-made edits since.
• PATCH /publishers/comments/{comment_id} · scope publishers:writeUpdate Comment
• PATCH /publishers/competencies/{competency_id} · scope publishers:writeReview Competency
• PATCH /publishers/copyright-deposit-alerts/{alert_id}/acknowledge · scope publishers:writeAcknowledge Copyright Deposit Alert
• PATCH /publishers/course-conversion/{item_id} · scope publishers:writeReview Course Conversion
• DELETE /publishers/course-conversion/{item_id} · scope publishers:writeDiscard Course ConversionReal discard support - a 'proposed'/'reviewed'/'rejected' item that never became real Education content can be permanently removed. A 'pushed' item has real downstream course/module/lesson rows and real audit history behind it, so it must never be deleted - the 'rejected' status (a lighter 'mark bad, keep visible' alternative, matching manuscript_competency's own canon_state pattern) is the right …
• POST /publishers/course-conversion/{item_id}/push · scope publishers:writePush Course ConversionBook-to-Course bridge, step 2: creates REAL Education course/module/ lesson rows (migration 024's tables) from an approved mapping. This deliberately reuses Education's own RLS INSERT policies as the real authorization check instead of reimplementing school-staff logic here - a publisher with no admin/teacher role at the target school gets a genuine RLS rejection, not a fake permission check. One-…
• PATCH /publishers/distribution-records/{record_id} · scope publishers:writeUpdate Distribution Record
• PATCH /publishers/editions/{edition_id} · scope publishers:writeUpdate Edition
• DELETE /publishers/editions/{edition_id} · scope publishers:writeDelete Edition
• PATCH /publishers/editions/{edition_id}/archive · scope publishers:writeArchive Edition
• GET /publishers/editions/{edition_id}/auto-back-cover · scope publishers:readGenerate Auto Back CoverBack-cover analog of generate_auto_cover above - same real caching fix, same manual-upload-always-wins precedence via the persisted metadata_record.back_cover_image_storage_path.
• GET /publishers/editions/{edition_id}/auto-cover · scope publishers:readGenerate Auto CoverReal front-cover art, now genuinely CACHED (Phase C of the audit-fix pass, closing the "regenerated randomly on every GET" finding) - the first successful generation for this edition is persisted to metadata_record exactly like a manual upload, so a repeated GET returns the same real image every time instead of a fresh random one. Use POST .../regenerate-cover to deliberately force a genuinely new…
• POST /publishers/editions/{edition_id}/back-cover · scope publishers:writeUpload Back CoverManual back-cover override - always takes priority over the auto-composed one, same rule as the front cover. Enhanced before storage like every other image upload in this pillar.
• GET /publishers/editions/{edition_id}/back-cover · scope publishers:readGet Back Cover
• GET /publishers/editions/{edition_id}/can-delete · scope publishers:readCan Delete Edition
• POST /publishers/editions/{edition_id}/cover · scope publishers:writeUpload Cover
• GET /publishers/editions/{edition_id}/cover · scope publishers:readGet Cover
• GET /publishers/editions/{edition_id}/distribution-records · scope publishers:readList Distribution Records
• POST /publishers/editions/{edition_id}/distribution-records · scope publishers:writeCreate Distribution RecordA record tracks manual submission status per platform - it never calls a real KDP/Ingram API. Real auto-publishing to external marketplaces means real seller credentials and putting content up for real public sale, which this platform's spec keeps locked until explicit sign-off and legal review, per this project's standing rule.
• GET /publishers/editions/{edition_id}/epub · scope publishers:readGenerate Epub
• GET /publishers/editions/{edition_id}/isbn-assignment · scope publishers:readGet Isbn Assignment
• POST /publishers/editions/{edition_id}/isbn-assignment · scope publishers:writeAssign Isbn
• GET /publishers/editions/{edition_id}/marketplace-listing · scope publishers:readGet Marketplace Listing
• POST /publishers/editions/{edition_id}/marketplace-listing · scope publishers:writeList Edition On MarketplaceOne real action: lists a finished Publishers edition as a real Marketplace product with the actual real EPUB/M4B as its digital- delivery file. Auto-provisions a real Medusa vendor identity for the publisher house's own organization on first use (get_or_provision_vendor) - a house never has to separately sign up as a Marketplace vendor first. Re-listing an already-listed edition UPDATES the same r…
• GET /publishers/editions/{edition_id}/metadata · scope publishers:readGet Metadata
• PUT /publishers/editions/{edition_id}/metadata · scope publishers:writeUpsert Metadata
• GET /publishers/editions/{edition_id}/pod-asset · scope publishers:readGet Pod Asset
• POST /publishers/editions/{edition_id}/pod-asset · scope publishers:writeCreate Pod Asset
• GET /publishers/editions/{edition_id}/pod-print-jobs · scope publishers:readList Pod Print Jobs
• POST /publishers/editions/{edition_id}/pod-print-jobs · scope publishers:writeCreate Pod Print Job
• POST /publishers/editions/{edition_id}/polish-blurb · scope publishers:writePolish BlurbAI copy-edit assistance for the back-cover sales blurb (the same real gap the bio-polish endpoint closes above) - covers/illustrations already get AI drafting by default in this pillar, but the human-typed blurb text had none. Same "AI drafts, never authoritative" shape: the caller sends whatever's currently in the description field (saved or not), the stored metadata_record.description is never t…
• GET /publishers/editions/{edition_id}/print-pdf · scope publishers:readGenerate Print Pdf
• POST /publishers/editions/{edition_id}/regenerate-back-cover · scope publishers:writeRegenerate Auto Back CoverForces a genuinely fresh auto-composed back cover, same deliberate- override contract as regenerate_auto_cover above.
• POST /publishers/editions/{edition_id}/regenerate-cover · scope publishers:writeRegenerate Auto CoverForces a genuinely fresh AI-generated cover, deliberately overwriting whatever is currently cached (or even a prior manual upload - an explicit Regenerate click is a real, intentional override, matching how upload_cover already overwrites a prior generated one). Old cached file deleted first via the same helper's own cleanup, same discipline as every other image-replacement endpoint in this pillar…
• PATCH /publishers/editions/{edition_id}/restore · scope publishers:writeRestore Edition
• GET /publishers/editions/{edition_id}/submission-package · scope publishers:readGenerate Submission PackageBundles the EPUB, print PDF, cover (manual if uploaded, else the real auto-generated one), and a metadata JSON into one zip - ready for a human to manually upload to Amazon KDP/IngramSpark/etc. Deliberately NOT an API auto-publish integration - see the Distribution Center's own docstring for why real auto-publishing stays out of Core.
• GET /publishers/editions/{edition_id}/wraparound-cover · scope publishers:readGenerate Wraparound CoverA real, single continuous print-ready wraparound cover (back cover | spine | front cover) at this edition's own real per-format trim size (matching the actual print-interior PDF's own real trim for its format - paperback 5.5x8.5in, hardcover/large_print 6x9in) + bleed + 300 DPI. Requires the print-interior PDF to have been generated at least once already, since the spine width is computed from the…
• POST /publishers/figure-briefs/{brief_id}/status · scope publishers:writeSet Figure Status
• POST /publishers/houses · scope publishers:writeCreate House
• GET /publishers/houses/mine · scope publishers:readGet My House Endpoint
• PATCH /publishers/houses/{house_id} · scope publishers:writeUpdate HouseReal, minimal house settings update - currently just country_code, which real ISBN registration agencies key off of (a publisher must apply to the agency that operates where they're based, not any agency they choose - see the ISBN system's own real administration rule).
• GET /publishers/houses/{house_id}/allocations · scope publishers:readList Allocations
• PUT /publishers/houses/{house_id}/allocations · scope publishers:writeSet AllocationAny real house member can set another member's allocation cap - matches this pillar's own established collapsed-role convention (any member can act; owner-role override only where the spec actually names a distinct authority). The platform OWNER role's own spending is never subject to any cap regardless of what's recorded here for them.
• PATCH /publishers/houses/{house_id}/archive · scope publishers:writeArchive HouseNo DELETE endpoint exists for a house at all - see this module's own docstring for why (every real table in this pillar cascades from publisher_house_id, so a hard delete could never be meaningfully blocked - archive is the only safe path).
• GET /publishers/houses/{house_id}/authors · scope publishers:readList Authors
• POST /publishers/houses/{house_id}/authors · scope publishers:writeCreate AuthorAuthor registry with synthetic data (spec section 4 item 3): an author profile is real data owned by a real logged-in Fitinty user, but nothing requires legal-identity verification. link_my_account attaches the caller's own user_id (the common "I am the author" case); leaving it false creates a placeholder co-author/pen-name entry with no linked account, which the spec's own "synthetic data" frami…
• GET /publishers/houses/{house_id}/books · scope publishers:readList Books
• POST /publishers/houses/{house_id}/books · scope publishers:writeCreate BookA book can only be created from a manuscript already at status='approved' (spec section 17's pipeline starts at "approved manuscript") - checked here, not just implied by UI ordering.
• POST /publishers/houses/{house_id}/cart/total · scope publishers:writeCompute Cart Total
• POST /publishers/houses/{house_id}/checkout · scope publishers:writeCheckout CartSpends the house's real fuel pool for a real cart. Enforces (a) sufficient house balance, (b) the caller's own real per-user allocation cap, if one has been set for them. The platform OWNER role is always exempt from any allocation cap (the roadmap's own 'Owner exemption') - everyone else's cap, if they have one, is enforced honestly against their own recorded real spend.
• GET /publishers/houses/{house_id}/copyright-deposit-alerts · scope publishers:readList Copyright Deposit Alerts
• GET /publishers/houses/{house_id}/fuel-account · scope publishers:readGet Fuel AccountGet-or-create the house's real fuel pool. A house starts at 0 credits until it subscribes to a tier - there is no free grant here, unlike a person's own Pioneer grant in Tools, since a house choosing not to subscribe is a real, valid state.
• GET /publishers/houses/{house_id}/fuel-ledger · scope publishers:readGet Fuel Ledger
• GET /publishers/houses/{house_id}/imprints · scope publishers:readList Imprints
• POST /publishers/houses/{house_id}/imprints · scope publishers:writeCreate Imprint
• GET /publishers/houses/{house_id}/isbn-alert-rules · scope publishers:readList Isbn Alert Rules
• POST /publishers/houses/{house_id}/isbn-alert-rules · scope publishers:writeCreate Isbn Alert Rule
• GET /publishers/houses/{house_id}/isbn-alerts · scope publishers:readList Isbn Alerts
• GET /publishers/houses/{house_id}/isbn-inventory · scope publishers:readList Isbn Inventory
• POST /publishers/houses/{house_id}/isbn-inventory · scope publishers:writeCreate Isbn Inventory
• POST /publishers/houses/{house_id}/isbn-inventory/import-real · scope publishers:writeImport Real IsbnsImports real ISBN values the author already bought directly from a real agency (never fabricated, never resold by Fitinty - see migration 177's own comment for why). Every value is validated for real ISBN-13 shape/check-digit correctness and deduped against every ISBN already assigned or pooled anywhere on the platform before landing in a fresh real_import batch.
• GET /publishers/houses/{house_id}/lccn-requests · scope publishers:readList Lccn Requests
• POST /publishers/houses/{house_id}/logo · scope publishers:writeUpload House LogoReal publisher/imprint logo upload - previously zero logo/branding anywhere in the book pipeline. Same enhance_image() + local-disk pattern as upload_author_photo above, scoped to house-membership rather than author-house lookup.
• GET /publishers/houses/{house_id}/logo · scope publishers:readGet House Logo
• GET /publishers/houses/{house_id}/manuscripts · scope publishers:readList Manuscripts
• POST /publishers/houses/{house_id}/manuscripts · scope publishers:writeCreate Manuscript
• POST /publishers/houses/{house_id}/manuscripts/generate · scope publishers:writeGenerate ManuscriptProduce a manuscript from ideas via AI (spec section 1). The AI drafts a title/synopsis/chapter outline from the author's own notes - it never invents unrelated plot beyond what the notes support - and the result lands at status='idea', the earliest lifecycle stage, so nothing is treated as final until a human edits it through the same review-gated workflow every manuscript goes through.
• POST /publishers/houses/{house_id}/manuscripts/import · scope publishers:writeImport ManuscriptManuscript import (spec section 1: "Manuscript creation and import"). Parses .txt/.md/.docx/.epub into real chapters, never just stores the raw file - the author lands straight in a usable editor. genre/series_bible_id (Phase F of the audit-fix pass) match what the blank-create path (create_manuscript's own ManuscriptIn) already accepts - previously an import required an immediate follow-up PATCH…
• GET /publishers/houses/{house_id}/members · scope publishers:readList House Members
• GET /publishers/houses/{house_id}/provenance · scope publishers:readList Provenance
• POST /publishers/houses/{house_id}/provenance · scope publishers:writeCreate Provenance
• PATCH /publishers/houses/{house_id}/restore · scope publishers:writeRestore House
• GET /publishers/houses/{house_id}/rights-records · scope publishers:readList Rights Records
• POST /publishers/houses/{house_id}/rights-records · scope publishers:writeCreate Rights Record
• POST /publishers/houses/{house_id}/royalty-statements · scope publishers:writeGenerate StatementDraft = regenerated wholesale on every run. Final = refused (history).
• GET /publishers/houses/{house_id}/royalty-statements · scope publishers:readList Statements
• GET /publishers/houses/{house_id}/search · scope publishers:readSearchReal Postgres full-text search (tsvector/GIN), ranked, across manuscripts, chapters, Series/World Bibles, books, authors, and citations - not a placeholder LIKE query. Permission is applied before ranking: RLS already scopes every table to house members, and this additionally filters by house_id explicitly. book/author_profile/reference_entry (Phase F of the audit-fix pass, migration 189) close t…
• GET /publishers/houses/{house_id}/series-bibles · scope publishers:readList Series Bibles
• POST /publishers/houses/{house_id}/series-bibles · scope publishers:writeCreate Series Bible
• POST /publishers/houses/{house_id}/subscribe · scope publishers:writeSubscribeSubscribes the house to a real tier and grants its bundled credits immediately - a real, honest SANDBOX grant regardless of bank_payments.is_live_enabled()'s state. Never charges the house's real payment method (none is even wired here).
• GET /publishers/houses/{house_id}/voice-consent-records · scope publishers:readList Consent Records
• POST /publishers/houses/{house_id}/voice-consent-records · scope publishers:writeCreate Consent RecordReal consent capture (spec section 18) - typed full legal name + the exact statement agreed to, timestamped, plus an optional uploaded signed document for genuine written authorization. This is the gate itself, built ahead of any actual voice-synthesis engine: nothing in this platform reads this table to authorize synthesis yet, because that engine doesn't exist - this makes the consent mechanism …
• GET /publishers/houses/{house_id}/writing-voice-profiles · scope publishers:readList Voice Profiles
• POST /publishers/houses/{house_id}/writing-voice-profiles · scope publishers:writeCreate Voice Profile
• DELETE /publishers/imprints/{imprint_id} · scope publishers:writeDelete Imprint
• PATCH /publishers/imprints/{imprint_id}/archive · scope publishers:writeArchive Imprint
• GET /publishers/imprints/{imprint_id}/can-delete · scope publishers:readCan Delete Imprint
• PATCH /publishers/imprints/{imprint_id}/restore · scope publishers:writeRestore Imprint
• GET /publishers/integrations · scope publishers:readList IntegrationsHonest status per spec section 7's candidate list - reports what's genuinely wired into this codebase vs. what's a named candidate still needing its own license/security/sandbox review, same discipline as every other pillar's integration registry (Games, Marketplace, Education).
• GET /publishers/isbn-agencies · scope publishers:readList Isbn Agencies
• POST /publishers/isbn-agencies · scope publishers:writeCreate Isbn Agency
• PATCH /publishers/isbn-agencies/{agency_id} · scope publishers:writeUpdate Isbn Agency
• POST /publishers/isbn-agencies/{agency_id}/tiers · scope publishers:writeCreate Isbn Agency Tier
• PATCH /publishers/isbn-agency-tiers/{tier_id} · scope publishers:writeUpdate Isbn Agency Tier
• PATCH /publishers/isbn-alert-rules/{rule_id} · scope publishers:writeUpdate Isbn Alert RuleReal edit-after-creation for an alert rule - previously only ever creatable, never editable (a house wanting a different threshold, or to pause/resume the rule without deleting its history, had no way to do either).
• POST /publishers/isbn-alerts/{alert_id}/acknowledge · scope publishers:writeAcknowledge Isbn Alert
• PATCH /publishers/lccn-requests/{request_id} · scope publishers:writeUpdate Lccn Request
• GET /publishers/length-standards · scope publishers:readLength Standards
• POST /publishers/manuscript-versions/{version_id}/restore · scope publishers:writeRestore Manuscript VersionReal restore-to-a-prior-version. First snapshots the CURRENT chapter state as a brand new version (so the restore is itself reversible - see _snapshot_manuscript_version above), then applies the target version's own stored per-chapter title/content/position back onto the real `chapter` rows, matched by each chapter's own real id. Deliberately conservative, not a destructive full rollback: a chapt…
• GET /publishers/manuscripts/{manuscript_id} · scope publishers:readGet Manuscript
• PATCH /publishers/manuscripts/{manuscript_id} · scope publishers:writeUpdate Manuscript
• DELETE /publishers/manuscripts/{manuscript_id} · scope publishers:writeDelete Manuscript
• PATCH /publishers/manuscripts/{manuscript_id}/archive · scope publishers:writeArchive Manuscript
• POST /publishers/manuscripts/{manuscript_id}/book-type · scope publishers:writeSet Book Type
• POST /publishers/manuscripts/{manuscript_id}/build · scope publishers:writeStart BuildQueue the long-form build. Refuses without a book type (no band, no honest target) and refuses to double-run.
• GET /publishers/manuscripts/{manuscript_id}/build-jobs · scope publishers:readBuild Jobs
• GET /publishers/manuscripts/{manuscript_id}/can-delete · scope publishers:readCan Delete Manuscript
• GET /publishers/manuscripts/{manuscript_id}/chapters · scope publishers:readList Chapters
• POST /publishers/manuscripts/{manuscript_id}/chapters · scope publishers:writeCreate Chapter
• POST /publishers/manuscripts/{manuscript_id}/chapters/reorder · scope publishers:writeReorder ChaptersReal chapter reordering (row 9) - the corkboard view's own drag-drop action. body.chapter_ids must be EXACTLY the manuscript's current real chapter id set (same count, same ids, any order) before anything is applied - a partial or stale list (e.g. a chapter deleted by someone else mid-drag) is rejected outright rather than silently reordering only some chapters and leaving the rest at ambiguous po…
• GET /publishers/manuscripts/{manuscript_id}/comments · scope publishers:readList Comments
• POST /publishers/manuscripts/{manuscript_id}/comments · scope publishers:writeCreate Comment
• GET /publishers/manuscripts/{manuscript_id}/competencies · scope publishers:readList CompetenciesRLS alone scopes this to houses the caller is actually a member of - the same reliance list_references already places on RLS for this exact class of manuscript-scoped child resource.
• POST /publishers/manuscripts/{manuscript_id}/completeness-check · scope publishers:writeRun Completeness CheckReal AI completeness pass (row 9, item 5) - reads the manuscript against its OWN stated scope (title/genre/synopsis) and flags real gaps a human should look at. A draft suggestion for the author to act on, never an automatic edit - this never writes to chapter/manuscript content itself, only returns findings.
• POST /publishers/manuscripts/{manuscript_id}/course-conversion · scope publishers:writePropose Course ConversionBook-to-Course bridge, step 1 (spec section 19): AI proposes a chapter -> module -> lesson -> learning-objective mapping. Nothing is written to Education yet - this only creates a reviewable course_conversion_item, matching "Global Push must create a reviewable change set, not overwrite approved courses automatically".
• GET /publishers/manuscripts/{manuscript_id}/course-conversion · scope publishers:readList Course Conversions
• POST /publishers/manuscripts/{manuscript_id}/edit-pass · scope publishers:writeStart Edit PassOne stage of the rail as a queued pass. Suggestions ride the SAME polish table and doors a person's own polish run uses - never a parallel pile; the pass files a real review_cycle row so the manuscript's approval gate sees the work.
• POST /publishers/manuscripts/{manuscript_id}/extract-competencies · scope publishers:writeExtract CompetenciesReal AI-assisted extraction (task #162) - grounded strictly in the manuscript's own real chapter text, never invented, mirroring Games' already-proven extracted_entity pattern. Every extracted item lands at canon_state='proposed' - nothing is ever treated as real/actionable until a human explicitly approves it via the review endpoint below. This is the extraction/foundation half of the standing "d…
• GET /publishers/manuscripts/{manuscript_id}/figure-briefs · scope publishers:readFigure Briefs
• GET /publishers/manuscripts/{manuscript_id}/references · scope publishers:readList ReferencesTask #124's real reference library - an author's bibliography entries for this manuscript, orderable by whichever ones are actually cited via [[cite:key]] (see collect_citation_order in publishers_content_blocks.py). No explicit access check here, same as list_chapters - reference_entry's own RLS policy already scopes this to real house members.
• POST /publishers/manuscripts/{manuscript_id}/references · scope publishers:writeCreate Reference
• PATCH /publishers/manuscripts/{manuscript_id}/restore · scope publishers:writeRestore Manuscript
• GET /publishers/manuscripts/{manuscript_id}/review-cycles · scope publishers:readList Review Cycles
• POST /publishers/manuscripts/{manuscript_id}/review-cycles · scope publishers:writeCreate Review Cycle
• GET /publishers/manuscripts/{manuscript_id}/thoroughness · scope publishers:readThoroughnessModel-free: real words against the type's band, the verdict in WORDS. A manuscript with no type gets its counts and a sentence, never a made-up target.
• GET /publishers/manuscripts/{manuscript_id}/translation-siblings · scope publishers:readList Translation SiblingsEvery real manuscript in this one's translation family - the original plus every other real materialized translated sibling - so a reader/editor can navigate to any language version from any other one. Resolves through the real original regardless of which family member manuscript_id points at (a sibling's own translated_from_manuscript_id, or its own id if it IS the original). Returns an empty li…
• POST /publishers/manuscripts/{manuscript_id}/translations · scope publishers:writeCreate Translation
• GET /publishers/manuscripts/{manuscript_id}/translations · scope publishers:readList Translations
• POST /publishers/manuscripts/{manuscript_id}/translations/bulk · scope publishers:writeCreate Translations BulkMulti-locale translation in one request - an author picks several target languages from Fitinty's own LANGUAGES registry instead of requesting one locale at a time. Reuses create_translation's own real per-locale insert/dedup logic (the same ON CONFLICT DO NOTHING check, so a locale that already has a translation is reported, never silently duplicated or re-queued) rather than a separate mechanism…
• GET /publishers/manuscripts/{manuscript_id}/versions · scope publishers:readList Manuscript Versions
• POST /publishers/manuscripts/{manuscript_id}/versions · scope publishers:writeSave Manuscript VersionSnapshots every current chapter's title/content/position into one manuscript_version row - real, reviewable revision history without a per-chapter version table.
• GET /publishers/narrator-voice-options · scope publishers:readList Narrator Voice Options
• DELETE /publishers/plan-items/{item_id} · scope publishers:writeRemove ItemOnly a still-'planned' promise may be withdrawn - in-progress and kept ones are history.
• POST /publishers/plan-items/{item_id}/link · scope publishers:writeLink ItemA kept promise names its proof - the human hand links what reconciliation cannot prove from tables (movies, games, trailers, campaigns).
• POST /publishers/plan-items/{item_id}/status · scope publishers:writeSet Item Status
• PATCH /publishers/pod-assets/{pod_id} · scope publishers:writeUpdate Pod Asset
• POST /publishers/pod-print-jobs/{job_id}/refresh · scope publishers:writeRefresh Pod Print JobRe-polls the provider for the job's current real status - stored verbatim, never normalized into locally-invented states.
• GET /publishers/pod-print/artifacts/{edition_id}/{kind} · scope publishers:readServe Signed ArtifactPublic (no-session) artifact route for the POD providers' own file fetchers. Access is not anonymous in the RLS sense: the HMAC-signed URL embeds the submitting user's id, and the artifact is assembled under that exact user's normal RLS context - the URL grants precisely the access its creator already had, time-limited, for these two artifacts only.
• GET /publishers/pod-print/providers · scope publishers:readProvider Status
• POST /publishers/polish-suggestions/{suggestion_id}/apply · scope publishers:writeApply Suggestion
• POST /publishers/polish-suggestions/{suggestion_id}/dismiss · scope publishers:writeDismiss Suggestion
• PATCH /publishers/references/{reference_id} · scope publishers:writeUpdate Reference
• DELETE /publishers/references/{reference_id} · scope publishers:writeDelete Reference
• PATCH /publishers/review-cycles/{review_id} · scope publishers:writeUpdate Review Cycle
• PATCH /publishers/rights-records/{record_id} · scope publishers:writeUpdate Rights Record
• PATCH /publishers/rights-records/{record_id}/copyright-details · scope publishers:writeUpdate Copyright DetailsA real, human-entered record of the author's own progress through the Copyright Office's eCO portal - registration_number/registration_filed_at once they receive their real certificate back, first_published_at as the real legal anchor for the mandatory-deposit deadline, deposit_method/ deposit_completed_at once they've actually deposited a copy. Never fabricates, files, or submits anything on the …
• GET /publishers/rights-records/{record_id}/document · scope publishers:readDownload Rights Document
• POST /publishers/royalty-lines/{line_id}/record-payment · scope publishers:writeRecord Line PaymentThe handshake record: the house paid the author by its own hand (bank, cash, cheque) and writes down how. Nothing here moves money - Rule 3 is the wall.
• DELETE /publishers/royalty-splits/{split_id} · scope publishers:writeRemove Split
• GET /publishers/royalty-statements/{statement_id} · scope publishers:readStatement Detail
• DELETE /publishers/royalty-statements/{statement_id} · scope publishers:writeVoid StatementThe escape from a trapped period: a DRAFT voids freely (it was a reading), and a FINAL statement voids ONLY when it holds nothing - no lines, so nothing was ever owed on it. A final statement with lines is history and never deletes.
• POST /publishers/royalty-statements/{statement_id}/finalize · scope publishers:writeFinalize Statement
• POST /publishers/series-bible-versions/{version_id}/restore · scope publishers:writeRestore Series Bible VersionReal restore-to-a-prior-version - the actual point of keeping version history at all, not just a read-only log. Restoring itself FIRST snapshots the current (about-to-be-overwritten) state as a brand new version, so a restore is itself reversible - the same "always snapshot before mutating" discipline update_series_bible already uses, applied one level up. The target snapshot's own immutable/manag…
• GET /publishers/series-bibles/{bible_id} · scope publishers:readGet Series Bible
• PATCH /publishers/series-bibles/{bible_id} · scope publishers:writeUpdate Series BibleEvery save snapshots the full prior state into series_bible_version before applying the update - real "version control" (spec section 10) without a per-field diff/merge engine. Snapshots the state BEFORE the change so version N always reads as "what it looked like going into change N+1".
• DELETE /publishers/series-bibles/{bible_id} · scope publishers:writeDelete Series Bible
• PATCH /publishers/series-bibles/{bible_id}/archive · scope publishers:writeArchive Series Bible
• GET /publishers/series-bibles/{bible_id}/books · scope publishers:readList Series Books
• GET /publishers/series-bibles/{bible_id}/can-delete · scope publishers:readCan Delete Series Bible
• POST /publishers/series-bibles/{bible_id}/plan/declare · scope publishers:writeDeclare Series PlanDeclared once at the series, MATERIALIZED onto every book in it - each volume carries and fulfills its own copy; a book that joins the series later gets the plan by running this again (adds only what's missing, per book).
• POST /publishers/series-bibles/{bible_id}/program-conversion · scope publishers:writePropose Series ProgramSeries -> Education Program bridge, step 1. Real per-book chapter/ module/lesson mapping stays entirely on the existing, unmodified propose_course_conversion/review_course_conversion/push_course_conversion flow - this only creates the program-level shell (title/description drafted from the series bible's own real fields, grounded, never invented) and, for every not-yet-linked book in the series, a…
• GET /publishers/series-bibles/{bible_id}/program-conversions · scope publishers:readList Series Program Conversions
• PATCH /publishers/series-bibles/{bible_id}/restore · scope publishers:writeRestore Series Bible
• GET /publishers/series-bibles/{bible_id}/versions · scope publishers:readList Series Bible Versions
• PATCH /publishers/series-program-conversions/{item_id} · scope publishers:writeReview Series Program
• DELETE /publishers/series-program-conversions/{item_id} · scope publishers:writeDiscard Series ProgramSame real discard rule as course_conversion_item above - a 'pushed' series program has a real education_program with real linked courses behind it, so it can never be deleted here.
• POST /publishers/series-program-conversions/{item_id}/push · scope publishers:writePush Series ProgramSeries -> Education Program bridge, step 2: creates the REAL education_program shell (now that a target school is known) and links every book's course_conversion_item to it via program_id. Each course itself still goes through the existing, unmodified per-book review_course_conversion/push_course_conversion flow - THAT is what actually creates the real course/module/lesson rows and, thanks to the …
• GET /publishers/service-catalog · scope publishers:readList Service Catalog
• POST /publishers/service-catalog · scope publishers:writeCreate Service Catalog Item
• GET /publishers/subscription-tiers · scope publishers:readList Subscription Tiers
• POST /publishers/subscription-tiers · scope publishers:writeCreate Subscription Tier
• DELETE /publishers/translations/{translation_id} · scope publishers:writeDelete Translation
• GET /publishers/translations/{translation_id}/chapters · scope publishers:readList Translated Chapters
• POST /publishers/translations/{translation_id}/create-manuscript · scope publishers:writeCreate Manuscript From TranslationMaterializes a real, human-reviewed translation into a genuine, independent `manuscript` row - a real sibling of the original, not just translated text sitting in manuscript_translation - so it flows through the exact same real editorial-review pipeline, book/edition creation, and EPUB/print-PDF generation every other manuscript already uses (see the translation-notice wiring in publishers_product…
• PATCH /publishers/translations/{translation_id}/mark-reviewed · scope publishers:writeMark ReviewedA human explicitly confirming the MT draft has been reviewed - never automatic, matching this project's standing 'AI drafts, never authoritative' pattern. Now requires a real, completed review_cycle approval first (task #123) - the same "real gate, not a cosmetic button" discipline already used for the manuscript's own production-status gate (publishers_manuscripts.py's GATED_STATUS check) - a tra…
• GET /publishers/translations/{translation_id}/review-cycles · scope publishers:readList Translation Review Cycles
• POST /publishers/translations/{translation_id}/review-cycles · scope publishers:writeCreate Translation Review CycleRequests a real, structured editorial review against a translation DRAFT - the same review_cycle machinery a manuscript uses, reused rather than duplicated (see migration 173). Only valid once the real MT draft actually exists (status='draft_ready' or later - requesting a review against a still-generating or failed translation makes no sense, since there's nothing real yet to review).
• GET /publishers/voice-calibration-scripts · scope publishers:readList Calibration Scripts
• GET /publishers/voice-consent-records/{record_id}/document · scope publishers:readDownload Consent Document
• PATCH /publishers/voice-consent-records/{record_id}/revoke · scope publishers:writeRevoke Consent Record
• GET /publishers/voice-consent-records/{record_id}/samples · scope publishers:readList Voice Samples
• POST /publishers/voice-consent-records/{record_id}/samples · scope publishers:writeUpload Voice SampleA real microphone recording of the person reading a calibration passage - captured with the browser's own mic permission prompt, never silently. Can ONLY be attached to a consent record that is still ACTIVE (checked here, not just assumed from the UI) - the actual mechanical enforcement of "no voice clone without consent," since nothing downstream can ever have a sample without a live consent reco…
• POST /publishers/voice-consent-records/{record_id}/train-voice-lora · scope publishers:writeTrain Voice LoraReal per-voice LoRA training (VoxCPM2) against every real captured sample for this consent record - the exact same mechanism already proven end-to-end for Cinema, now available to Publishers' own real, previously- unused consent samples. Blocks synchronously while training runs (real GPU time, can take several minutes) - matching cinema_identity.py's own train_voice_lora precedent for this exact e…
• DELETE /publishers/voice-samples/{sample_id} · scope publishers:writeDelete Voice Sample
• GET /publishers/voice-samples/{sample_id}/file · scope publishers:readGet Voice Sample File
• PATCH /publishers/writing-voice-profiles/{profile_id} · scope publishers:writeUpdate Voice Profile
• POST /publishers/writing-voice-profiles/{profile_id}/draft · scope publishers:writeDraft With VoiceAI drafting assistance (spec section 11): labeled suggestion, never saved automatically, never overwrites existing text - the caller pastes the returned draft into the manuscript editor themselves.

The tools every tenant works in - documents, mail, calendar, forms - and the ones sold direct to customers.

• GET /bi/dashboards · scope workspace:readList Dashboards
• POST /bi/dashboards · scope workspace:writeCreate Dashboard
• GET /bi/dashboards/{dashboard_id} · scope workspace:readGet Dashboard
• PATCH /bi/dashboards/{dashboard_id} · scope workspace:writeUpdate Dashboard
• DELETE /bi/dashboards/{dashboard_id} · scope workspace:writeDelete Dashboard
• GET /bi/dashboards/{dashboard_id}/values · scope workspace:readGet Dashboard Values
• POST /bi/dashboards/{dashboard_id}/widgets · scope workspace:writeCreate Widget
• GET /bi/dashboards/{dashboard_id}/widgets · scope workspace:readList Widgets
• GET /bi/metrics · scope workspace:readList Metrics
• GET /bi/my-organizations · scope workspace:readMy Organizations
• PATCH /bi/widgets/{widget_id} · scope workspace:writeUpdate Widget
• DELETE /bi/widgets/{widget_id} · scope workspace:writeDelete Widget
• GET /bookkeeping/bills · scope workspace:readList Bills
• POST /bookkeeping/bills · scope workspace:writeCreate Bill
• DELETE /bookkeeping/bills/{bill_id} · scope workspace:writeDelete Bill
• POST /bookkeeping/bills/{bill_id}/status · scope workspace:writeUpdate Bill Status
• GET /bookkeeping/invoices · scope workspace:readList Invoices
• POST /bookkeeping/invoices · scope workspace:writeCreate Invoice
• DELETE /bookkeeping/invoices/{invoice_id} · scope workspace:writeDelete Invoice
• POST /bookkeeping/invoices/{invoice_id}/status · scope workspace:writeUpdate Invoice Status
• GET /bookkeeping/my-organizations · scope workspace:readMy Organizations
• GET /bookkeeping/summary/{organization_id} · scope workspace:readSummary
• GET /brief/{organization_id}/latest · scope workspace:readLatest Brief
• POST /brief/{organization_id}/write · scope workspace:writeWrite Brief
• POST /community/announcements · scope workspace:writeCreate Announcement
• GET /community/announcements · scope workspace:readMy Announcements
• POST /community/announcements/{announcement_id}/publish · scope workspace:writePublish Announcement
• POST /community/clubs · scope workspace:writeCreate Club
• POST /community/clubs/{club_id}/join · scope workspace:writeJoin ClubAny signed-in person may join - the open-room design. The RLS WITH CHECK (you join AS YOURSELF) raises, so the polite sentences come first. FM10 (618): a share_room opens only to a holder of its plan, a growers_exchange only to someone on a farm's own membership - both asked on the caller's cursor, both refused in words.
• DELETE /community/clubs/{club_id}/join · scope workspace:writeLeave Club
• POST /community/clubs/{club_id}/posts · scope workspace:writePost To ClubMembers write as themselves. The membership sentence comes BEFORE the insert - the RLS WITH CHECK raises, never empty-returns (the EC1 lesson).
• POST /community/posts/{post_id}/hide · scope workspace:writeHide PostThe moderator's hand: hides with a REASON, never erases.
• GET /content-calendar/entries · scope workspace:readList Entries
• POST /content-calendar/entries · scope workspace:writeCreate Entry
• PATCH /content-calendar/entries/{entry_id} · scope workspace:writeUpdate Entry
• DELETE /content-calendar/entries/{entry_id} · scope workspace:writeDelete Entry
• POST /content-calendar/entries/{entry_id}/draft · scope workspace:writeDraft Entry
• POST /content-calendar/entries/{entry_id}/mark-posted · scope workspace:writeMark PostedThe tenant records that THEY posted this manually. The platform never posts for them - that is the standing real-communications gate, and it holds here.
• POST /content-calendar/entries/{entry_id}/status · scope workspace:writeSet StatusMoves an entry between planning states. 'posted' is deliberately NOT accepted here - it only exists via /mark-posted, which records the tenant's own manual action.
• POST /content-calendar/plan-month · scope workspace:writePlan MonthFills a month with idea entries from a plain brief. Ideas land as 'idea' status - the tenant curates; nothing is drafted, let alone posted, on its own.
• GET /content-calendar/shipped · scope workspace:readShippedReal dated output from the org's other pillars - published blog posts, simulated newsletter sends, published podcast episodes - so the plan sits next to reality.
• POST /content-translations · scope workspace:writeDraft TranslationA machine draft into one locale. It waits for a person before any visitor can see it.
• GET /content-translations/pending-review · scope workspace:readPending ReviewEvery machine draft this person may approve, the SOURCE beside each - a reviewer checks a translation against something, and it has to be on the same screen.
• GET /content-translations/subjects · scope workspace:readMy SubjectsEverything the person's businesses show on their storefronts, with the translations each already has - the list a tenant translates FROM.
• PUT /content-translations/{kind}/{subject_id}/{locale} · scope workspace:writeWrite TranslationA person's own translation: written = approved. Writes over a machine draft if one stands.
• DELETE /content-translations/{translation_id} · scope workspace:writeDelete Translation
• PATCH /content-translations/{translation_id}/mark-reviewed · scope workspace:writeMark ReviewedA person approving ONE machine draft - the only way a draft ever reaches a visitor.
• POST /document-assist/compare · scope workspace:writeCreate Compare
• GET /document-assist/documents · scope workspace:readList Documents
• POST /document-assist/documents · scope workspace:writeUpload Document
• DELETE /document-assist/documents/{document_id} · scope workspace:writeDelete Document
• POST /document-assist/draft · scope workspace:writeCreate Draft
• POST /document-assist/extract · scope workspace:writeCreate Extract
• GET /document-assist/jobs · scope workspace:readList Jobs
• GET /document-assist/jobs/{job_id}/download · scope workspace:readDownload Job
• POST /document-assist/minutes · scope workspace:writeCreate Minutes
• POST /document-assist/proofread · scope workspace:writeCreate Proofread
• GET /document-assist/qa · scope workspace:readQa History
• POST /document-assist/qa · scope workspace:writeAsk
• GET /domain-monitor · scope workspace:readList Watched Domains
• POST /domain-monitor · scope workspace:writeAdd Watched Domain
• GET /domain-monitor/my-organizations · scope workspace:readMy Organizations
• DELETE /domain-monitor/{watch_id} · scope workspace:writeRemove Watched Domain
• POST /domain-monitor/{watch_id}/check · scope workspace:writeCheck Watched Domain
• DELETE /field-inspection/items/{item_id} · scope workspace:writeDelete Template Item
• GET /field-inspection/my-organizations · scope workspace:readMy Organizations
• GET /field-inspection/runs · scope workspace:readList Runs
• POST /field-inspection/runs · scope workspace:writeCreate Run
• GET /field-inspection/runs/{run_id} · scope workspace:readGet Run
• DELETE /field-inspection/runs/{run_id} · scope workspace:writeDelete Run
• POST /field-inspection/runs/{run_id}/complete · scope workspace:writeComplete Run
• GET /field-inspection/runs/{run_id}/responses · scope workspace:readList Responses
• POST /field-inspection/runs/{run_id}/responses · scope workspace:writeRecord Response
• GET /field-inspection/runs/{run_id}/summary · scope workspace:readRun Summary
• GET /field-inspection/templates · scope workspace:readList Templates
• POST /field-inspection/templates · scope workspace:writeCreate Template
• GET /field-inspection/templates/{template_id} · scope workspace:readGet Template
• DELETE /field-inspection/templates/{template_id} · scope workspace:writeDelete Template
• POST /field-inspection/templates/{template_id}/items · scope workspace:writeAdd Template Item
• GET /fitinchat/analytics · scope workspace:readAnalyticsComputed from real rows, nothing sampled or estimated: AI-resolved = closed without a human ever claiming it; escalated = an escalation reason was recorded.
• GET /fitinchat/channels · scope workspace:readList Channels
• POST /fitinchat/channels · scope workspace:writeCreate Channel
• PATCH /fitinchat/channels/{channel_id} · scope workspace:writeUpdate Channel
• GET /fitinchat/conversations · scope workspace:readList Conversations
• POST /fitinchat/conversations/{conversation_id}/claim · scope workspace:writeClaim Conversation
• POST /fitinchat/conversations/{conversation_id}/close · scope workspace:writeClose Conversation
• GET /fitinchat/conversations/{conversation_id}/messages · scope workspace:readList Conversation Messages
• POST /fitinchat/conversations/{conversation_id}/reply · scope workspace:writeStaff Reply
• POST /fitinchat/kb-reindex · scope workspace:writeKb Reindex
• GET /fitinchat/my-organizations · scope workspace:readMy Organizations
• GET /fitinchat/site/{slug}/channel · scope workspace:readStorefront ChannelThe storefront's way in: the org's 'Storefront' channel, created lazily the first time a live storefront asks. Live-theme gated like every public window. Landing here means every visitor chat is a REAL fitinchat conversation the tenant's team sees, counts in 'unanswered messages', and can take over - the AI is the first responder, never a separate machine.
• GET /fitinchat/widget/conversations/{visitor_token} · scope workspace:readWidget Conversation Status
• GET /fitinchat/widget/conversations/{visitor_token}/messages · scope workspace:readWidget List Messages
• POST /fitinchat/widget/conversations/{visitor_token}/messages · scope workspace:writeWidget Send Message
• POST /fitinchat/widget/conversations/{visitor_token}/order-lookup · scope workspace:writeWidget Order LookupThe widget's explicit "Look up my order" form. Same trust model as the AI action (fitinchat_intelligence.lookup_order): order number + email must both match the REAL Medusa order and the order must contain this shop's products; the visible result is a public-safe summary posted into the conversation as an assistant message (so staff who later claim the chat see exactly what the visitor saw). Not-f…
• POST /fitinchat/widget/conversations/{visitor_token}/rate · scope workspace:writeWidget RatePost-conversation satisfaction, 1-5, only once and only after close - the widget shows the prompt when the conversation ends.
• POST /fitinchat/widget/conversations/{visitor_token}/request-human · scope workspace:writeWidget Request Human
• GET /fitinchat/widget/{channel_id} · scope workspace:readWidget Channel View
• POST /fitinchat/widget/{channel_id}/start · scope workspace:writeStart Conversation
• GET /fitincrm/book/{organization_id} · scope workspace:readRead BookThe one book. Segments are READERS over recorded touches, never stored lists - the same person appears in 'regular' and 'consented' at once because segments are views, not silos.
• GET /fitincrm/book/{organization_id}/advice · scope workspace:readSecond Sale AdviceCALL THESE FIVE TODAY. Deterministic rules over the recorded book - every line carries its evidence in words and a proposed_action, and NO MODEL writes any of it (the same contract as analytics_advice: advice is a reader, drafting is the only place AI touches).
• GET /fitincrm/book/{organization_id}/contacts/{contact_id} · scope workspace:readRead Contact Page
• POST /fitincrm/book/{organization_id}/contacts/{contact_id}/consent · scope workspace:writeRecord ConsentAppends to the consent ledger. The ORIGIN is required in words - 'she checked the box', 'he asked at the counter today' - because a yes nobody can place is a yes nobody can defend.
• POST /fitincrm/book/{organization_id}/contacts/{contact_id}/draft-winback · scope workspace:writeDraft WinbackAI DRAFTS, NEVER SENDS. The draft is grounded in this contact's real recorded moments and the org's identity-pack voice, and it is returned to the human to send by their own hand - nothing here transmits, so the mail rail's gate is not even in the path. CONSENT BY CONSTRUCTION: a marketing message to someone with no recorded 'granted' row is refused before any model runs - the machine cannot draf…
• GET /fitincrm/contacts · scope workspace:readList Contacts
• POST /fitincrm/contacts · scope workspace:writeCreate Contact
• DELETE /fitincrm/contacts/{contact_id} · scope workspace:writeDelete Contact
• GET /fitincrm/deals · scope workspace:readList Deals
• POST /fitincrm/deals · scope workspace:writeCreate Deal
• PATCH /fitincrm/deals/{deal_id} · scope workspace:writeUpdate Deal
• GET /fitincrm/deals/{deal_id}/activities · scope workspace:readList Activities
• POST /fitincrm/deals/{deal_id}/activities · scope workspace:writeCreate Activity
• POST /fitincrm/deals/{deal_id}/stage · scope workspace:writeMove Deal Stage
• GET /fitincrm/my-organizations · scope workspace:readMy Organizations
• GET /fitincrm/pipeline-summary/{organization_id} · scope workspace:readPipeline Summary
• GET /fitinevents/events · scope workspace:readList Events
• POST /fitinevents/events · scope workspace:writeCreate Event
• GET /fitinevents/events/{event_id} · scope workspace:readGet Event
• PATCH /fitinevents/events/{event_id} · scope workspace:writeUpdate Event
• DELETE /fitinevents/events/{event_id} · scope workspace:writeDelete Event
• POST /fitinevents/events/{event_id}/cancel · scope workspace:writeCancel Event
• POST /fitinevents/events/{event_id}/open-to-public · scope workspace:writeOpen Event To PublicMints the event's public slug. Publishing already made it real; this makes it REACHABLE - the door strangers register and pay through.
• POST /fitinevents/events/{event_id}/publish · scope workspace:writePublish Event
• GET /fitinevents/events/{event_id}/registrations · scope workspace:readList Registrations
• POST /fitinevents/events/{event_id}/registrations · scope workspace:writeRegister Attendee
• GET /fitinevents/my-organizations · scope workspace:readMy Organizations
• GET /fitinevents/registrations/mine · scope workspace:readMy SeatsTHE PERSON'S OWN SEATS (2026-09-11, the customer Space's "Elsewhere"): every event they hold a seat at, across every business, with the ticket code that IS their confirmation. A seat names its person only by the attendee's email - `registered_by` is the staff hand or 'public-registration', never the attendee - so ownership is the standing rule (own_identity): read on the system cursor, decided her…
• POST /fitinevents/registrations/{registration_id}/cancel · scope workspace:writeCancel Registration
• POST /fitinevents/registrations/{ticket_code}/check-in · scope workspace:writeCheck In
• GET /fitingive/donations · scope workspace:readList Donations
• POST /fitingive/donations · scope workspace:writeCreate Donation
• GET /fitingive/donations/mine · scope workspace:readMy Gifts
• GET /fitingive/donations/mine/{donation_id}/receipt · scope workspace:readMy Gift ReceiptThe giver's own copy of the church's receipt - the SAME renderer, so the two cannot differ. A gift not theirs is 404 (existence is not theirs to learn); a gift with no receipt says why.
• DELETE /fitingive/donations/{donation_id} · scope workspace:writeDelete Donation
• GET /fitingive/donations/{donation_id}/receipt · scope workspace:readDonation ReceiptThe printable receipt. Facts from the ledger row alone - amount, date, fund, the church's own name - plus the sentence US-style acknowledgment letters carry. Rendered for the CHURCH to print or save and hand over; nothing is emailed here (the mail rail is closed by ruling until launch).
• POST /fitingive/donations/{donation_id}/receipt-sent · scope workspace:writeMark Receipt Sent
• GET /fitingive/donors · scope workspace:readList Donors
• POST /fitingive/donors · scope workspace:writeCreate Donor
• DELETE /fitingive/donors/{donor_id} · scope workspace:writeDelete Donor
• GET /fitingive/funds · scope workspace:readList Funds
• POST /fitingive/funds · scope workspace:writeCreate Fund
• PATCH /fitingive/funds/{fund_id} · scope workspace:writeUpdate Fund
• GET /fitingive/grants · scope workspace:readList Grants
• POST /fitingive/grants · scope workspace:writeCreate Grant
• DELETE /fitingive/grants/{grant_id} · scope workspace:writeDelete Grant
• POST /fitingive/grants/{grant_id}/status · scope workspace:writeMove Grant Status
• GET /fitingive/my-organizations · scope workspace:readMy Organizations
• GET /fitingive/summary/{organization_id} · scope workspace:readSummary
• GET /fitinkb/articles · scope workspace:readList Articles
• POST /fitinkb/articles · scope workspace:writeCreate Article
• GET /fitinkb/articles/{article_id} · scope workspace:readGet Article
• PATCH /fitinkb/articles/{article_id} · scope workspace:writeUpdate Article
• DELETE /fitinkb/articles/{article_id} · scope workspace:writeDelete Article
• POST /fitinkb/articles/{article_id}/publish · scope workspace:writePublish Article
• POST /fitinkb/articles/{article_id}/unpublish · scope workspace:writeUnpublish Article
• GET /fitinkb/categories · scope workspace:readList Categories
• POST /fitinkb/categories · scope workspace:writeCreate Category
• PATCH /fitinkb/categories/{category_id} · scope workspace:writeUpdate Category
• DELETE /fitinkb/categories/{category_id} · scope workspace:writeDelete Category
• GET /fitinkb/my-organizations · scope workspace:readMy Organizations
• GET /fitinkb/search · scope workspace:readSearch Articles
• GET /fitinsign · scope workspace:readList Documents
• POST /fitinsign · scope workspace:writeCreate Document
• GET /fitinsign/my-organizations · scope workspace:readMy Organizations
• GET /fitinsign/sign/{token} · scope workspace:readView Signing Link
• POST /fitinsign/sign/{token} · scope workspace:writeSign Document
• POST /fitinsign/sign/{token}/decline · scope workspace:writeDecline Document
• GET /fitinsign/{document_id}/download · scope workspace:readDownload Document File
• GET /fitinsign/{document_id}/events · scope workspace:readList Events
• POST /fitinsign/{document_id}/send · scope workspace:writeSend Document
• POST /fitinsign/{document_id}/upload · scope workspace:writeUpload Document File
• POST /fitinsign/{document_id}/void · scope workspace:writeVoid Document
• GET /hiring/applications · scope workspace:readList Applications
• POST /hiring/applications/{application_id}/fit-summary · scope workspace:writeFit SummaryWORDS WITH EVIDENCE, never a score, never a decision - automated employment decisions are regulated territory (NYC LL144 and kin) and 'no model writes a decision' is this platform's own law. The summary quotes what the applicant SAID against what the post ASKS, names what is unknown, and the staff member decides. Runs on the staff member's own click (the /open precedent for a synchronous model cal…
• POST /hiring/applications/{application_id}/hire · scope workspace:writeHire ApplicantThe rail's destination: one move mints ST1's employee record and the sign-in invite. The application keeps the whole story - who applied, when, and what they became.
• POST /hiring/applications/{application_id}/interview · scope workspace:writeSchedule Interview
• POST /hiring/applications/{application_id}/offer · scope workspace:writeMake OfferThe offer LETTER is a deterministic draft from the owner's own data - no model writes a decision. Delivery is the owner's (the mail rail is gated); the screen says so.
• POST /hiring/applications/{application_id}/reject · scope workspace:writeReject Application
• GET /hiring/applications/{application_id}/resume · scope workspace:readRead Resume
• GET /hiring/internal-openings · scope workspace:readInternal OpeningsST7: published internal-first posts, visible to the signed-in team only - the promotion path a cashier can actually see.
• GET /hiring/posts · scope workspace:readList Posts
• POST /hiring/posts · scope workspace:writeCreate Post
• PATCH /hiring/posts/{post_id} · scope workspace:writeUpdate Post
• POST /hiring/posts/{post_id}/interview-questions · scope workspace:writeDraft Interview QuestionsQuestion DRAFTS from the post's own requirements, for the human interviewer - stored on the post so the whole team asks from one sheet.
• GET /hris/employees · scope workspace:readList Employees
• POST /hris/employees · scope workspace:writeCreate Employee
• GET /hris/employees/{employee_id} · scope workspace:readGet Employee
• PATCH /hris/employees/{employee_id} · scope workspace:writeUpdate Employee
• DELETE /hris/employees/{employee_id} · scope workspace:writeDelete Employee
• GET /hris/employees/{employee_id}/direct-reports · scope workspace:readList Direct Reports
• POST /hris/employees/{employee_id}/invite · scope workspace:writeInvite Employee
• POST /hris/employees/{employee_id}/on-leave · scope workspace:writeMark On Leave
• POST /hris/employees/{employee_id}/rehire · scope workspace:writeRehire EmployeeEH1 - THE WAY BACK. The SAME employee row returns, so reviews, warnings, documents and transitions stay one unbroken record; the old ending folds into the transition history instead of being erased. Sign-in access does NOT return by itself - it died with the termination, and a fresh invite is the honest way in.
• POST /hris/employees/{employee_id}/reinstate · scope workspace:writeReinstate Employee
• POST /hris/employees/{employee_id}/terminate · scope workspace:writeTerminate Employee
• GET /hris/locations · scope workspace:readList Locations
• POST /hris/locations · scope workspace:writeCreate Location
• PATCH /hris/locations/{location_id} · scope workspace:writeUpdate Location
• GET /hris/my-organizations · scope workspace:readMy Organizations
• GET /hris/public/staff-invite/{code} · scope workspace:readRead Staff InviteThe join page's data - org and employee NAME only, never the roster. No auth: the code is unguessable and this reveals exactly what the invitee already knows.
• POST /hris/staff-invite/{code}/claim · scope workspace:writeClaim Staff InviteSigned in (fresh from signup or not), the code becomes a key: the login links to the employee record and org membership is minted. System cursor - the claimant is by definition not yet a member, so RLS correctly cannot see the rows.
• POST /id-cards/employees/{employee_id}/card · scope workspace:writeMake CardCompose (or re-compose) the card. Reuses the employee's standing employment verification or mints one - the QR is that verification's public link, so ONE revocation story covers the card and the reference letter alike.
• GET /id-cards/employees/{employee_id}/card.png · scope workspace:readRead Card
• POST /id-cards/employees/{employee_id}/photo · scope workspace:writeSet Photo
• GET /network/directory · scope workspace:readDirectoryEvery org with a LIVE storefront that has not stepped out of the directory. Served through the public-read context because every fact here is already on a public page - being signed in is required only because the directory is a tenant-space tool.
• POST /network/partnerships · scope workspace:writePropose Partnership
• GET /network/partnerships · scope workspace:readList PartnershipsBoth directions, with the counterpart named and the referral evidence counted from the click ledger - a real count of recorded rows, never an estimate.
• POST /network/partnerships/{partnership_id}/connect-supplier · scope workspace:writeConnect SupplierTurns an ACCEPTED supplier partnership into a supplier row the buying org syncs from. New items always land as DRAFTS here (auto_publish=false) - the tenant's existing supplier dial flips that, behind the same publish gate every go-live passes through.
• POST /network/partnerships/{partnership_id}/decide · scope workspace:writeDecide PartnershipTHE SECOND HAND. Only the RECEIVING org's owner decides - the proposer holding both pens would make the two-hand a fiction.
• POST /network/partnerships/{partnership_id}/end · scope workspace:writeEnd PartnershipEither side's owner may end an accepted partnership. History stays - the row becomes 'ended', it does not vanish, and a fresh proposal is possible afterwards.
• POST /network/partnerships/{partnership_id}/storefront · scope workspace:writeToggle StorefrontEach side dials its OWN storefront only - the partner's page is the partner's design.
• PUT /network/profile/{organization_id} · scope workspace:writeSet Profile
• POST /staff-time/clock · scope workspace:writeClockThe employee's own login toggles their own clock - in if out, out if in.
• POST /staff-time/employees/{employee_id}/kiosk-pin · scope workspace:writeSet Kiosk PinThe OWNER or a manager sets it and hands it over - never self-set, never readable back (a hash is stored). A duplicate PIN in the same org is refused: the PIN is the identity at the kiosk.
• POST /staff-time/kiosk-clock · scope workspace:writeKiosk ClockThe store tablet (signed in as any team member) clocks whoever scans their card or, with no card to hand, enters their PIN. The card or the PIN identifies the EMPLOYEE; the signed-in session only proves the device belongs to the org - a stranger's tablet cannot fish for PINs or replay cards. ONE door, ONE writer: both paths resolve an employee and hand it to `_toggle_clock`, the same arithmetic th…
• GET /staff-time/pto · scope workspace:readList Pto
• POST /staff-time/pto · scope workspace:writeRequest Pto
• POST /staff-time/pto/{request_id}/decide · scope workspace:writeDecide Pto
• GET /staff-time/shifts · scope workspace:readList Shifts
• POST /staff-time/shifts · scope workspace:writeCreate Shift
• DELETE /staff-time/shifts/{shift_id} · scope workspace:writeDelete Shift
• GET /staff-time/timesheet · scope workspace:readTimesheet
• GET /storefront-blog/audience · scope workspace:readAudience
• GET /storefront-blog/issues · scope workspace:readList Issues
• POST /storefront-blog/issues/from-post/{post_id} · scope workspace:writeIssue From PostDrafts an issue from a published post: the post's title as subject, its HTML as the body, plus the mandatory unsubscribe footer every real newsletter carries.
• POST /storefront-blog/issues/{issue_id}/simulate-send · scope workspace:writeSimulate SendThe gated 'send': records the real active-subscriber count and marks the issue sent_simulated. NO EMAIL LEAVES THE PLATFORM - real dispatch waits for the standing real-communications sign-off, and will slot in behind this same issue model.
• GET /storefront-blog/posts · scope workspace:readList Posts
• POST /storefront-blog/posts · scope workspace:writeCreate Post
• PATCH /storefront-blog/posts/{post_id} · scope workspace:writeUpdate Post
• DELETE /storefront-blog/posts/{post_id} · scope workspace:writeDelete Post
• POST /storefront-blog/posts/{post_id}/publish · scope workspace:writeToggle Publish
• POST /storefront-campaigns/compose · scope workspace:writeCompose CampaignAI-drafts a campaign from a plain brief - subject + simple HTML paragraphs - and saves it as an editable DRAFT issue. The composer never sends anything.
• PATCH /storefront-campaigns/issues/{issue_id} · scope workspace:writeEdit Issue
• GET /storefront-campaigns/subscribers · scope workspace:readList Subscribers
• POST /storefront-campaigns/subscribers/bulk-add · scope workspace:writeBulk AddAdds emails the tenant already has a relationship with. Honest accounting: invalid addresses and existing subscribers are counted, never silently swallowed.
• POST /storefront-campaigns/subscribers/{subscriber_id}/remove · scope workspace:writeMember RemoveMember-initiated removal marks unsubscribed rather than deleting - the audit-friendly shape, and the person never silently reappears via a later bulk-add.
• POST /storefront-campaigns/subscribers/{subscriber_id}/tags · scope workspace:writeSet Tags
• GET /storefront-links/links · scope workspace:readList Links
• POST /storefront-links/links · scope workspace:writeCreate Link
• PATCH /storefront-links/links/{link_id} · scope workspace:writeUpdate Link
• DELETE /storefront-links/links/{link_id} · scope workspace:writeDelete Link
• GET /storefront-links/short · scope workspace:readList Short Links
• POST /storefront-links/short · scope workspace:writeCreate Short Link
• PATCH /storefront-links/short/{code} · scope workspace:writeToggle Short Link
• GET /tenant-data/export/{organization_id}/contacts.csv · scope workspace:readExport Contacts
• GET /tenant-data/export/{organization_id}/manifest · scope workspace:readExport ManifestWhat the org owns, counted from the real tables. Always available - no meeting, no retention call, no waiting period. The counts name what the CSVs carry out.
• GET /tenant-data/export/{organization_id}/products.csv · scope workspace:readExport Products
• POST /tenant-data/import · scope workspace:writeStart Import
• POST /tenant-data/import/{job_id}/apply · scope workspace:writeApply ImportTHE SECOND HAND. Writes through the writers that already exist, drafts always, and returns an honest tally - a row that could not land is reported by line, not dropped.
• POST /tenant-data/import/{job_id}/discard · scope workspace:writeDiscard Import
• PATCH /tenant-data/import/{job_id}/mapping · scope workspace:writeEdit MappingThe human hand on the mapping. Every column it touches is re-labelled 'hand' - an AI guess survives only where the owner left it standing.
• GET /tenant-data/imports · scope workspace:readList Imports
• GET /theme · scope workspace:readGet Theme
• GET /theme/domains · scope workspace:readList Domains
• POST /theme/domains/claim · scope workspace:writeClaim DomainStart (or restart) ownership verification for a domain. Re-claiming an existing PENDING row keeps its token, so a tenant who already published the TXT record and comes back later does not have to edit their DNS again. A VERIFIED row is returned untouched - re-issuing a token there would spuriously un-verify a working domain.
• POST /theme/domains/verify · scope workspace:writeVerify DomainPerform the REAL DNS lookup and record the outcome.
• DELETE /theme/domains/{domain} · scope workspace:writeRemove DomainWithdraw a claim. Routing stops immediately, because both the routing lookup and the certificate gate require a verified row to exist.
• PATCH /theme/draft · scope workspace:writeUpdate Theme Draft
• GET /theme/live · scope workspace:readGet Live ThemeDashboard-only auth for now. The response contract is shaped so a future genuinely-public variant only swaps the auth dependency (JWT -> domain-resolved org) -- the body never changes. Returns empty defaults rather than 404 when nothing has been published yet, so a future public renderer degrades gracefully.
• POST /theme/logo · scope workspace:writeUpload Theme Logo
• GET /theme/logo · scope workspace:readGet Theme Logo
• GET /theme/my-organizations · scope workspace:readMy Organizations
• GET /theme/preview · scope workspace:readPreview Theme`page` accepted and currently unused (no public pages exist yet) -- always returns the draft snapshot. Swapping in real page-specific rendering later changes only the response body, not the URL contract callers already use.
• POST /theme/publish · scope workspace:writePublish Theme
• GET /theme/site-analytics · scope workspace:readSite AnalyticsLast-30-days storefront traffic for the org's own members. Aggregated daily counters only -- there is no per-visitor data to show, by design. Human and crawler traffic are reported SEPARATELY (migration 262). `unclassified` is traffic recorded before bot separation existed; it is a genuine mixture, so it is neither hidden nor folded into the human figure, and it ages out of the 30-day window by i…
• GET /theme/site-funnel · scope workspace:readSite FunnelLast-30-days conversion funnel for this org's storefront. Three real stages, from data that already exists (no new table): page views (human only) -> intent started -> intent claimed HONEST ABOUT WHAT STAGE 1 IS. site_visit_daily counts PAGE VIEWS, not unique visitors - there is deliberately no per-visitor record to count. One person browsing four pages is four views. So the view->inten…
• GET /theme/site-preview · scope workspace:readSite PreviewThe Theme Editor's real-storefront preview: same payload shape as the public GET /public/site/{slug}, but themed with the org's DRAFT instead of its live version. Authenticated + membership-checked -- drafts never leak to anonymous visitors; the public content blocks are collected through the same public-read cursor the real storefront uses, so preview can't show anything the live site wouldn't.
• GET /theme/site-preview-detail · scope workspace:readSite Preview DetailPer-PAGE draft preview (STOREFRONT_GAPS "Per-PAGE preview targets"): the storefront's course / service / event / product detail pages, rendered by the editor's iframe with the DRAFT theme even before the site is published. Same membership gate as /site-preview; the detail rows come from the very loaders the public endpoints use, through the same public-read cursor - so a preview can never reveal a…
• GET /theme/versions · scope workspace:readList Theme Versions
• POST /theme/versions/duplicate · scope workspace:writeDuplicate Theme VersionSaves a named, unpublished copy of an existing version into the library -- does not touch the current draft or the live pointer (rollback covers restores).
• POST /theme/versions/rollback · scope workspace:writeRollback Theme VersionCopy-forward rollback: creates a NEW version row that becomes live, and resets the draft to match, so the editor never shows a stale draft silently diverging from the just-restored live state. History is never rewritten.
• GET /translate/audio · scope workspace:readList Jobs
• POST /translate/audio · scope workspace:writeUpload Audio
• GET /translate/audio/{job_id}/download · scope workspace:readDownload
• POST /translate/audio/{job_id}/dub · scope workspace:writeCreate Dub
• POST /translate/audio/{job_id}/dub-consent · scope workspace:writeFile Dub Consent
• GET /translate/documents · scope workspace:readList Jobs
• POST /translate/documents · scope workspace:writeCreate Job
• GET /translate/documents/{job_id}/download · scope workspace:readDownload Result
• GET /translate/images · scope workspace:readList Jobs
• POST /translate/images · scope workspace:writeUpload Image
• GET /translate/images/{job_id}/download · scope workspace:readDownload
• GET /wallet-passes/issuances/{issuance_id} · scope workspace:readGet Issuance
• GET /wallet-passes/issuances/{issuance_id}/pass-payload · scope workspace:readGet Pass PayloadReal, correctly-structured pass content, honestly labeled unsigned unless a real credential is genuinely configured (checked live, never assumed).
• POST /wallet-passes/issuances/{issuance_id}/revoke · scope workspace:writeRevoke Issuance
• GET /wallet-passes/my-organizations · scope workspace:readMy Organizations
• GET /wallet-passes/signing-status · scope workspace:readSigning StatusReal, live-checked readiness — never a cached/assumed value.
• GET /wallet-passes/templates · scope workspace:readList Templates
• POST /wallet-passes/templates · scope workspace:writeCreate Template
• GET /wallet-passes/templates/{template_id} · scope workspace:readGet Template
• PATCH /wallet-passes/templates/{template_id} · scope workspace:writeUpdate Template
• DELETE /wallet-passes/templates/{template_id} · scope workspace:writeDelete Template
• GET /wallet-passes/templates/{template_id}/issuances · scope workspace:readList Issuances
• POST /wallet-passes/templates/{template_id}/issuances · scope workspace:writeCreate Issuance
• POST /watch · scope workspace:writeCreate Watch
• GET /watch · scope workspace:readWatch BoardThe board. Opening it takes at most ONE lawful look per watch per interval; inside the interval the last snapshot is re-read instead of the rival's server. Changes are the diff of the two latest OK snapshots, with the readings as evidence.
• POST /watch/field-intel · scope workspace:writeAdd Field Intel
• PATCH /watch/field-intel/{intel_id} · scope workspace:writeCorrect Field IntelThe tenant's hand corrects the AI's reading - and the origin says so.
• PATCH /watch/{watch_id} · scope workspace:writeUpdate Watch
• POST /workspace-documents/approvals/{approval_id}:decide · scope workspace:writeDecide Approval
• PATCH /workspace-documents/collaborators/{collaborator_id} · scope workspace:writePatch Collaborator
• DELETE /workspace-documents/collaborators/{collaborator_id} · scope workspace:writeRevoke Collaborator
• POST /workspace-documents/collaborators/{collaborator_id}:respond · scope workspace:writeRespond Invite
• DELETE /workspace-documents/comments/{comment_id} · scope workspace:writeDelete Comment
• POST /workspace-documents/comments/{comment_id}:reopen · scope workspace:writeReopen Comment
• POST /workspace-documents/comments/{comment_id}:resolve · scope workspace:writeResolve Comment
• POST /workspace-documents/projects/{project_id}/approvals · scope workspace:writeRequest Approval
• POST /workspace-documents/projects/{project_id}/collaborators · scope workspace:writeAdd Collaborator
• GET /workspace-documents/projects/{project_id}/comments · scope workspace:readList Comments
• POST /workspace-documents/projects/{project_id}/comments · scope workspace:writeAdd Comment
• POST /workspace-documents/projects/{project_id}/share-links · scope workspace:writeCreate Share Link
• GET /workspace-documents/projects/{project_id}/sharing · scope workspace:readGet Sharing
• PATCH /workspace-documents/projects/{project_id}/sharing · scope workspace:writePatch Sharing
• POST /workspace-documents/projects/{project_id}:restore · scope workspace:writeRestore Project
• POST /workspace-documents/projects/{project_id}:takedown · scope workspace:writeTakedown Project
• POST /workspace-documents/reports · scope workspace:writeFile Report
• GET /workspace-documents/reports · scope workspace:readList Reports
• PATCH /workspace-documents/reports/{report_id} · scope workspace:writePatch Report
• DELETE /workspace-documents/share-links/{link_id} · scope workspace:writeRevoke Share Link
• GET /workspace-documents/shared-with-me · scope workspace:readShared With Me
• GET /workspace/audit · scope workspace:readList Audit EventsRelies entirely on audit_events' own RLS policy (migration 009) to scope results to orgs the caller is a member of, or everything for the platform owner role - no additional filtering needed here.
• GET /workspace/automations · scope workspace:readList Automations
• POST /workspace/automations · scope workspace:writeCreate Automation
• GET /workspace/automations/catalog · scope workspace:readCatalogWhat can be built. Named on the screen so a tenant is choosing from what exists rather than imagining what might.
• DELETE /workspace/automations/{automation_id} · scope workspace:writeDelete Automation
• PATCH /workspace/automations/{automation_id}/active · scope workspace:writeSet Active
• POST /workspace/automations/{automation_id}/test · scope workspace:writeTest AutomationWould this rule have matched? Evaluates the conditions and performs NOTHING. A rule people cannot try before trusting is a rule they will not trust - and the only safe way to offer that is a path that cannot create anything at all.
• GET /workspace/booking/bookings · scope workspace:readList BookingsThe status filter belongs HERE, not on the screen. The screen showed only confirmed bookings and filtered the list after fetching it. That is harmless while the list is whole and wrong the moment it is a page: the pager would count every booking including cancelled ones and announce "showing 1-25 of 40" above a list of six. A pager that miscounts is worse than no pager - it is a number people tru…
• POST /workspace/booking/bookings/{booking_id}/cancel · scope workspace:writeCancel Booking
• GET /workspace/booking/types · scope workspace:readList Types
• POST /workspace/booking/types · scope workspace:writeCreate Type
• PATCH /workspace/booking/types/{type_id} · scope workspace:writeUpdate Type
• DELETE /workspace/booking/types/{type_id} · scope workspace:writeDelete Type
• PUT /workspace/booking/types/{type_id}/availability · scope workspace:writeSet Availability
• GET /workspace/brand-kits · scope workspace:readList Brand KitsReal Brand Kit Manager (Workspace tools manifest id 79) - a personal registry of brand guidelines (palette, voice, logo) other AI-drafting tools across the platform can eventually reference, closing a real, previously-nonexistent gap. Never exposes logo_storage_path (a raw filesystem path), matching AuthorProfileOut's own established precedent.
• POST /workspace/brand-kits · scope workspace:writeCreate Brand Kit
• PATCH /workspace/brand-kits/{kit_id} · scope workspace:writeUpdate Brand Kit
• DELETE /workspace/brand-kits/{kit_id} · scope workspace:writeDelete Brand Kit
• POST /workspace/brand-kits/{kit_id}/logo · scope workspace:writeUpload Brand Kit LogoReal logo upload, same enhance_image() + local-disk pattern already proven for Publishers' house logo (publishers_foundation.py).
• GET /workspace/brand-kits/{kit_id}/logo · scope workspace:readGet Brand Kit Logo
• GET /workspace/calendar/calendars · scope workspace:readList Calendars
• POST /workspace/calendar/calendars · scope workspace:writeCreate Calendar
• POST /workspace/calendar/check-conflicts · scope workspace:writeCheck ConflictsWhat would this new event collide with? Advisory - it never refuses the booking. Double-booking is sometimes deliberate, and a calendar that forbids it is one people work around by not using it.
• GET /workspace/calendar/events · scope workspace:readList Events
• POST /workspace/calendar/events · scope workspace:writeCreate Event
• PATCH /workspace/calendar/events/{event_id} · scope workspace:writeUpdate Event
• DELETE /workspace/calendar/events/{event_id} · scope workspace:writeDelete Event
• POST /workspace/calendar/events/{event_id}/respond · scope workspace:writeRespondYour answer, and only yours. The policy allows nobody else to write this row.
• GET /workspace/calendar/free-busy · scope workspace:readFree BusyWhen am I actually busy? Declined invitations and cancelled events are not busy. A conflict check that counts them tells people they are unavailable when they are free, and the first time somebody is told they are busy during an hour they know is empty, they stop believing the calendar.
• GET /workspace/compliance-audit · scope workspace:readList Compliance Audit EventsSame real audit_events table and the same RLS-only access control as list_audit_events above - the compliance lens is purely a WHERE filter on `action`'s real dotted-domain prefix, no new schema or migration.
• GET /workspace/contacts · scope workspace:readList ContactsReal personal contacts registry (Workspace tools manifest id 26, FitinContacts) - same personal-by-default scoping as Notes/Task Registry, mirrored field-for-field from workspace_note.
• POST /workspace/contacts · scope workspace:writeCreate Contact
• PATCH /workspace/contacts/{contact_id} · scope workspace:writeUpdate Contact
• DELETE /workspace/contacts/{contact_id} · scope workspace:writeDelete Contact
• GET /workspace/docker-status · scope workspace:readDocker StatusReal host-level Docker introspection (Workspace tools manifest id 112) - shells out to the real `docker ps` CLI (a fixed, hardcoded command with no interpolated input, matching tools.py's own nvidia-smi subprocess pattern), never fabricated. Local-dev-only infrastructure - this reports on whatever's genuinely running on THIS machine, not a remote fleet.
• GET /workspace/files · scope workspace:readList Files
• POST /workspace/files · scope workspace:writeUpload File
• POST /workspace/files/ai-draft · scope workspace:writeCreate Ai Drafted Document
• POST /workspace/files/blank · scope workspace:writeCreate Blank Document
• DELETE /workspace/files/{file_id} · scope workspace:writeDelete File
• POST /workspace/files/{file_id}/analyze-spreadsheet · scope workspace:writeAnalyze Spreadsheet
• GET /workspace/files/{file_id}/download · scope workspace:readDownload File
• POST /workspace/files/{file_id}/office-callback · scope workspace:writeOffice CallbackCalled directly by the OnlyOffice Document Server, not by a Fitinty session. Must respond {"error": 0} regardless of outcome, per OnlyOffice's own callback contract.
• GET /workspace/files/{file_id}/office-config · scope workspace:readGet Office Config
• GET /workspace/files/{file_id}/office-content · scope workspace:readGet Office ContentFetched directly by the OnlyOffice Document Server container - no Fitinty session available, so access is gated by a short-lived HMAC-signed token instead.
• GET /workspace/forms · scope workspace:readList Forms
• POST /workspace/forms · scope workspace:writeCreate Form
• POST /workspace/forms/purge-expired · scope workspace:writePurge ExpiredEnforces the retention promise. Retention that is only ever displayed is not retention. This is callable by the form owner and is safe to run repeatedly; RLS confines it to that owner's own forms, so it can never reach across tenants even if it is called by the wrong person.
• GET /workspace/forms/templates/catalog · scope workspace:readTemplate CatalogThe starter shelf - key, title, why, and the question count, never the full definitions (the builder shows those after the mint, where they are editable).
• POST /workspace/forms/templates/{key} · scope workspace:writeCreate From TemplateMint a DRAFT form from a template. An unknown key is refused - the catalog is the picker, never free text (the silent-zero lesson).
• GET /workspace/forms/{form_id} · scope workspace:readGet Form
• PATCH /workspace/forms/{form_id} · scope workspace:writeUpdate Form
• DELETE /workspace/forms/{form_id} · scope workspace:writeDelete Form
• POST /workspace/forms/{form_id}/analyze · scope workspace:writeAnalyze Responses
• GET /workspace/forms/{form_id}/export.csv · scope workspace:readExport Csv
• PUT /workspace/forms/{form_id}/fields · scope workspace:writeReplace FieldsThe builder saves the whole question list at once. Ids are preserved where the client sends one, because a field id is what an already-submitted answer is filed under. Regenerating them on every save would orphan every response the form has already collected.
• GET /workspace/forms/{form_id}/responses · scope workspace:readList Responses
• DELETE /workspace/forms/{form_id}/responses/{response_id} · scope workspace:writeDelete Response
• GET /workspace/forms/{form_id}/summary · scope workspace:readForm Summary
• GET /workspace/health · scope workspace:readFull HealthEverything, with the addresses and the topology. Owner only — this describes the Forge.
• GET /workspace/health/service/{key} · scope workspace:readService HealthDeliberately tenant-readable, and deliberately narrow. A tenant is entitled to know why the thing they just clicked is not working — that is the entire point of this wave. What they are NOT given is the address, the host, or anything else about Fitinty's infrastructure: `status`, `label` and `breaks` are the whole payload a screen needs, and the screens ask for exactly the one service they are ab…
• GET /workspace/home-trends · scope workspace:readHome TrendsThe tenant home's org-level series (AN3) - storefront visitors, subscribers, link clicks, event registrations - from the series spine, beside the pulse rather than inside it so the heartbeat stays fast. A read failure is a sentence, not a missing section.
• GET /workspace/local-ports · scope workspace:readLocal PortsReal host-level listening-port introspection (Workspace tools manifest id 117) - reuses the exact `psutil` dependency Tools' own hardware telemetry already proved works on this machine, in the same lazy-import-with-graceful-fallback style. Local-dev-only infrastructure, matching Docker Status (id 112) - reports on whatever's genuinely listening on THIS machine right now, not a remote fleet. Proces…
• GET /workspace/meetings · scope workspace:readList Meetings
• POST /workspace/meetings · scope workspace:writeCreate Meeting
• GET /workspace/meetings/capacity · scope workspace:readCapacityWhat standing up Fitinty-hosted rooms would actually require. Owner only - these are infrastructure decisions, not tenant settings.
• GET /workspace/meetings/hosted-status · scope workspace:readRead Hosted StatusReadable by any tenant: somebody who cannot create a Fitinty room deserves to know why, and that it is a platform state rather than something wrong with their account.
• PATCH /workspace/meetings/{meeting_id} · scope workspace:writeUpdate Meeting
• DELETE /workspace/meetings/{meeting_id} · scope workspace:writeDelete Meeting
• GET /workspace/my-tenants · scope workspace:readList My TenantsReal cross-pillar aggregator (Workspace tools manifest id 55, "Tenant Dashboard") - queries each pillar's own real tenant/membership tables directly (see _TENANT_QUERIES) and merges the results. No new schema, no fabricated data - a genuinely empty pillar section here means the caller really has no tenant there.
• GET /workspace/notes · scope workspace:readList Notes
• POST /workspace/notes · scope workspace:writeCreate Note
• PATCH /workspace/notes/{note_id} · scope workspace:writeUpdate Note
• DELETE /workspace/notes/{note_id} · scope workspace:writeDelete Note
• GET /workspace/payments · scope workspace:readList PaymentsFitintyPay Control Center (manifest item 89) - a real, owner-only, read-only view of real Stripe TEST-mode transactions, sourced live from Medusa's own admin API (the same integration Marketplace checkout already uses). Deliberately read-only - no payout/refund/capture action exists here. Real money movement stays hard-blocked regardless of the 2026-08-01 "ignore all locks" instruction - that inst…
• POST /workspace/perfection-reviews · scope workspace:writeCreate Review
• GET /workspace/perfection-reviews · scope workspace:readList Reviews
• GET /workspace/perfection-reviews/{review_id} · scope workspace:readGet Review
• POST /workspace/perfection-reviews/{review_id}/advance · scope workspace:writeAdvance ReviewRun the current Council stage's review (draft/audit/verify) and advance.
• POST /workspace/perfection-reviews/{review_id}/reject · scope workspace:writeReject Review
• POST /workspace/perfection-reviews/{review_id}/seal · scope workspace:writeSeal ReviewThe Emperor applies the Imperial Seal - final approval after peer review.
• GET /workspace/pillar-health · scope workspace:readPillar HealthReal, platform-wide Pillar Health Board (Workspace tools manifest id 126) - distinct from both the Pillar Registry Viewer (build status, no live data) and /my-tenants (personal, per-user). Owner-bypass RLS gives a genuine, unfiltered COUNT(*) per pillar's own real tenant table - the same f"SELECT count(*)..." pattern already proven in kpi.py's own TENANT_TABLES, reused here as a health/activity si…
• GET /workspace/pulse · scope workspace:readTenant Pulse
• GET /workspace/risk-alerts · scope workspace:readList Risk AlertsReal Risk Alerts (Workspace tools manifest id 10) - distinct from the already-built, static High-Risk Task Viewer (id 52). Joins the AI Agency's own real high-risk build_task ledger against this platform's own per-user acknowledgment table, so a genuinely NEW risk (never acknowledged by this owner session) is visibly distinguishable from one already reviewed - the real proactive-alerting mechanism…
• POST /workspace/risk-alerts/{task_id}/acknowledge · scope workspace:writeAcknowledge Risk Alert
• GET /workspace/search · scope workspace:readSearch
• GET /workspace/search/sources · scope workspace:readList SourcesWhat search covers. Named on the screen so a tenant knows what a result set does and does not include, rather than inferring it from what happened to come back.
• POST /workspace/songs · scope workspace:writeCreate Song
• GET /workspace/songs · scope workspace:readList Songs
• DELETE /workspace/songs/{song_id} · scope workspace:writeDelete Song
• GET /workspace/songs/{song_id}/audio · scope workspace:readDownload Song Audio
• GET /workspace/system-health · scope workspace:readSystem HealthReal reachability checks only - no fabricated "Council"/agent status. There's no governed agent registry yet (see Part 02's agent control plane gap in CLAUDE.md), so reporting on AI "council members" here would just be invented data. This checks the services that actually exist: Postgres, Redis, and Medusa.
• GET /workspace/tasks · scope workspace:readList Tasks
• POST /workspace/tasks · scope workspace:writeCreate Task
• GET /workspace/tasks/all · scope workspace:readList All TasksMaster Task Registry Viewer (manifest item 45) - a genuinely distinct view from the personal Task Registry: every task across every user, owner-only. RLS still scopes the underlying SELECT (a non-owner caller would just see their own tasks), the 403 here is the intended access boundary for this specific cross-user view.
• PATCH /workspace/tasks/{task_id} · scope workspace:writeUpdate Task
• DELETE /workspace/tasks/{task_id} · scope workspace:writeDelete Task
• GET /workspace/tenant-brand-voice · scope workspace:readTenant Brand VoiceReal, personal, cross-pillar aggregator (Workspace tools manifest id 65, "Tenant Brand Voice Settings") - the caller's own real voice-profile COUNT(*) across every games/publishers tenant they belong to, no new schema. A tenant genuinely having zero profiles renders as an honest zero, not hidden - the actual add/edit UI stays on each pillar's own real page (href), never duplicated here.
• GET /workspace/tenant-region-settings · scope workspace:readTenant Region SettingsReal, personal, cross-pillar aggregator (Workspace tools manifest id 66, "Tenant Language / Region Settings") - the caller's own real region/languages/time_zone fields across every farms/manufacturing/ logistics tenant they belong to, no new schema. Editing happens through the pillar's own already-existing PATCH endpoint (patch_href), never a duplicate write path - this endpoint is read-only.
• POST /workspace/tickets · scope workspace:writeCreate Ticket
• GET /workspace/tickets/all · scope workspace:readList All TicketsOwner-only support inbox - RLS still applies, so a non-owner caller would just get back their own tickets rather than everyone's, but the endpoint itself is intended for owner use.
• GET /workspace/tickets/mine · scope workspace:readList My Tickets
• PATCH /workspace/tickets/{ticket_id} · scope workspace:writeUpdate Ticket Status
• GET /workspace/tickets/{ticket_id}/replies · scope workspace:readList Replies
• POST /workspace/tickets/{ticket_id}/replies · scope workspace:writeCreate Reply

Bookable work: listings, requests and the calendar behind them.

• GET /services/availability · scope services:readList Rules
• POST /services/availability · scope services:writeAdd Rule
• DELETE /services/availability/{rule_id} · scope services:writeDelete Rule
• POST /services/booking-series/{series_id}/stop · scope services:writeStop Series
• POST /services/bookings · scope services:writeCreate Booking
• GET /services/bookings/mine · scope services:readList My Bookings
• GET /services/bookings/providing · scope services:readList Bookings To Fulfill
• PATCH /services/bookings/{booking_id} · scope services:writeUpdate Booking Status
• GET /services/bookings/{booking_id}/deliverables · scope services:readList Deliverables
• POST /services/bookings/{booking_id}/deliverables · scope services:writeUpload Deliverable
• POST /services/bookings/{booking_id}/make-recurring · scope services:writeMake RecurringSL3 - the customer turns one booking into a standing order. Completion of each visit mints the NEXT pending booking (event-driven - no daemon; nothing a tenant waits on runs on a timer). Either side can stop the series any time.
• POST /services/bookings/{booking_id}/pay · scope services:writeStart Booking CheckoutThe customer's pay door on their own booking. Stripe hosts the page; the customer pays the PROVIDER; Fitinty's cut rides Stripe's own split. One purchase per booking - a cancelled checkout leaves a pending row this door REUSES rather than doubles.
• GET /services/bookings/{booking_id}/payment · scope services:readBooking Payment StatusThree honest answers, kept apart: paid (with the captured moment), pending (a checkout was started and no money moved), or no payment record at all.
• POST /services/bookings/{booking_id}/satisfaction · scope services:writeSubmit Satisfaction
• GET /services/bookings/{booking_id}/satisfaction · scope services:readGet Satisfaction
• GET /services/bookings/{booking_id}/value-report · scope services:readGet Value Report
• POST /services/bookings/{booking_id}/value-report · scope services:writeSave Value Report
• POST /services/clients · scope services:writeCreate Client
• GET /services/clients/mine · scope services:readList My Clients
• PATCH /services/clients/{client_id} · scope services:writeUpdate Client
• DELETE /services/clients/{client_id} · scope services:writeDelete Client
• GET /services/corrections/mine · scope services:readList My Corrections
• PATCH /services/corrections/{correction_id} · scope services:writeResolve Correction
• GET /services/deliverables/{deliverable_id}/download · scope services:readDownload Deliverable
• GET /services/leads · scope services:readList LeadsThe desk: every lead with its DERIVED band and reasons, plus the conversion truth - how many leads became captured money. The numbers competitors cannot have, beside the promise they cannot make.
• POST /services/leads · scope services:writeAdd Manual LeadThe tenant's own hand - a phone call, a walk-in, a referral heard at church.
• POST /services/leads/from-form-response · scope services:writeFile Form Response As LeadThe tenant's door from Fitinty Forms: an answer that reads like an enquiry gets FILED to the desk by a human hand - deliberate, never auto-classified. The email is found deterministically (the response's answer to an email-kind question).
• GET /services/leads/offers · scope services:readList Offers
• POST /services/leads/offers/{offer_id}/withdraw · scope services:writeWithdraw Offer
• PATCH /services/leads/{lead_id} · scope services:writeSet Lead Status
• GET /services/listing-kits/mine · scope services:readMy Listing KitThe kit for the provider's own vertical - or an honest 'none for yours yet'.
• POST /services/listing-kits/mine/mint · scope services:writeMint Listing KitMints the vertical's kit as INACTIVE drafts - building is free, and switching each one live walks through pay-to-open like any hand-built listing. Skips any title the provider already has, so minting twice doubles nothing.
• GET /services/listings · scope services:readList Active Listings
• POST /services/listings · scope services:writeCreate Listing
• GET /services/listings/mine · scope services:readList My Listings
• PATCH /services/listings/{listing_id} · scope services:writeUpdate Listing
• POST /services/listings/{listing_id}/feature · scope services:writeFeature ListingSL3 - featured placement in the public market, Fitinty's own future stream. Until Dodo takes live payments this is the EMPEROR'S COMP HAND (the promoted- listings pattern): owner-only, days counted, and the market shows the label - a featured listing is marked, never smuggled.
• POST /services/listings/{listing_id}/image · scope services:writeSet Listing ImageA service listing's FACE (LST cross-pillar pass, 2026-08-30): the pillar had no images at all - migration 436 added the column and this gives it a writer. Enhanced through the same pipeline as every platform image; stored on the API's own disk (deliverables' pattern) and served publicly through the storefront's own gated route.
• GET /services/listings/{listing_id}/packages · scope services:readList Packages
• POST /services/listings/{listing_id}/packages · scope services:writeCreate Package
• GET /services/packages/mine · scope services:readList My Packages
• PATCH /services/packages/{package_id} · scope services:writeUpdate Package
• POST /services/providers · scope services:writeCreate Provider
• GET /services/providers/mine · scope services:readGet My Provider Endpoint
• PATCH /services/providers/{provider_id} · scope services:writeUpdate Provider
• GET /services/providers/{slug}/listings · scope services:readGet Provider Listings
• POST /services/quotes · scope services:writeCreate QuoteThe provider's estimate, born a DRAFT. It must answer something real - a request or a lead of this organization - so a quote can never be conjured at a stranger.
• GET /services/quotes · scope services:readList Quotes
• POST /services/quotes/accept/{token} · scope services:writeAccept QuoteSIGNED-IN acceptance (the claim posture). The job is born on the standing booking object with NO TIME YET - trades schedule after acceptance, and 'not scheduled yet' is stated, never invented.
• POST /services/quotes/{quote_id}/send · scope services:writeSend QuoteMarks the quote SENT and hands back the accept link. Sending the link stays the provider's hand - chat, a reply, on paper; mail drafts wait for the rail.
• POST /services/quotes/{quote_id}/withdraw · scope services:writeWithdraw Quote
• POST /services/requests · scope services:writeCreate Request
• GET /services/requests/incoming · scope services:readList Incoming Requests
• GET /services/requests/mine · scope services:readList My Requests
• PATCH /services/requests/{request_id} · scope services:writeUpdate Request Status
• GET /services/verticals · scope services:readList VerticalsReal, curated vertical + field-template catalog - Vertical Business Operations v1 (Connected Apps cost-elimination audit, 2026-08-12). The frontend already mirrors this in lib/vertical-fields.ts for zero-latency rendering; this endpoint exists so any other real client (a future mobile app, a script) has one authoritative source, and so the backend's own validation logic below is provably reading t…
• POST /services/webhook · scope services:writeServices Stripe WebhookThe pillar's own verified door, education's shape exactly: signature or refusal, captured events only, idempotent by the pending->paid guard + the fee ledger's unique payment id.

Congregations: members, giving, live events and the people who run them.

• PUT /give-payments/page · scope ministries:writeUpsert PageCreate or update this organization's giving page. Defaults to INACTIVE. A giving link that goes live the moment a row exists is a link that goes live before anybody has read the wording on it - the same rule booking pages already follow.
• GET /ministries/archive/search · scope ministries:readSearch Archive
• GET /ministries/churches · scope ministries:readList Churches
• POST /ministries/churches · scope ministries:writeCreate Church
• GET /ministries/churches/mine · scope ministries:readGet My Church Endpoint
• GET /ministries/churches/{church_id}/live-events · scope ministries:readList Events
• GET /ministries/churches/{church_id}/members · scope ministries:readList Church Members
• POST /ministries/churches/{church_id}/members · scope ministries:writeAdd Church Member
• GET /ministries/cohorts · scope ministries:readList Cohorts
• POST /ministries/cohorts · scope ministries:writeCreate Cohort
• GET /ministries/congregation/care-requests · scope ministries:readList Care RequestsA congregation's pastors, leaders and admins see every request that came to THEIR congregation; anyone else sees only what the requester let the congregation see. The leaders_only wall is enforced HERE by real role, not by the screen.
• PATCH /ministries/congregation/care-requests/{request_id} · scope ministries:writeSet Care StatusTending a request is pastoral work: only those who tend care for the congregation it came to may move it, and a refusal returns nothing of the request - not its words, not its asker.
• POST /ministries/congregation/funds/{fund_id}/share · scope ministries:writeMake Fund ShareableMints the fund's public campaign slug - the link travels beyond the congregation; every gift through it still lands on the church's own account at 0%, designated to this fund.
• GET /ministries/congregation/groups · scope ministries:readList GroupsEvery group the person can see, or one congregation's when the desk names it - a person in two congregations must not see one church's choir on the other's desk.
• POST /ministries/congregation/groups · scope ministries:writeCreate Group
• GET /ministries/congregation/groups/{group_id}/members · scope ministries:readList Group MembersWho is in the group, leaders first - the roster a leader serves.
• POST /ministries/congregation/groups/{group_id}/members · scope ministries:writeAdd Group MemberAdding someone already in the group changes their role - the one door for both.
• DELETE /ministries/congregation/groups/{group_id}/members/{membership_id} · scope ministries:writeRemove Group MemberLeaving a group removes the person from THAT group only - they stay in the congregation.
• GET /ministries/congregation/mine · scope ministries:readMy Congregations
• GET /ministries/congregation/newcomers · scope ministries:readList NewcomersThe shepherd's desk: everyone who reached toward the church, with the honest measure beside it - who returned, who connected, who became a member. Exclusive to this congregation; never resold, never pooled.
• POST /ministries/congregation/newcomers · scope ministries:writeAdd Newcomer
• PATCH /ministries/congregation/newcomers/{newcomer_id} · scope ministries:writeUpdate Newcomer
• GET /ministries/events · scope ministries:readList Events
• POST /ministries/events · scope ministries:writeCreate Event
• GET /ministries/guardrails · scope ministries:readList Guardrails
• POST /ministries/guardrails · scope ministries:writePropose GuardrailAI may propose content but cannot publish doctrinal material automatically (spec section 7.3) - every guardrail lands as 'draft' regardless of who creates it; a separate approve call moves it forward.
• POST /ministries/guardrails/{guardrail_id}/approve · scope ministries:writeApprove Guardrail
• GET /ministries/integrations · scope ministries:readList Integrations
• POST /ministries/live-events · scope ministries:writeSchedule Event
• GET /ministries/live-events/{event_id} · scope ministries:readGet Event
• GET /ministries/live-events/{event_id}/attendance · scope ministries:readEvent AttendanceAttendance audit metrics (church staff). The 'engagement heatmap' is the per-attendee join_count + presence window.
• POST /ministries/live-events/{event_id}/end · scope ministries:writeEnd Event
• POST /ministries/live-events/{event_id}/join · scope ministries:writeJoin EventRecord attendance and return the room. Any church member may join.
• POST /ministries/live-events/{event_id}/leave · scope ministries:writeLeave Event
• POST /ministries/live-events/{event_id}/start · scope ministries:writeStart Event
• GET /ministries/pastor-workspace · scope ministries:readPastor Workspace
• GET /ministries/sermons · scope ministries:readList Sermons
• POST /ministries/sermons · scope ministries:writeCreate Sermon
• GET /ministries/sermons/{sermon_id} · scope ministries:readGet Sermon
• GET /ministries/sermons/{sermon_id}/download · scope ministries:readDownload Sermon
• POST /ministries/sermons/{sermon_id}/multiplier · scope ministries:writeSermon MultiplierAI-assisted "sermon multiplier" (spec section 9) - drafts a summary, discussion questions, and a Bible-study outline from the sermon's own transcript only, never invented content. Labeled draft, never auto-published (section 9: "No automatic public publishing"; section 7.4: "Fitinty shall not claim theological authority").
• PATCH /ministries/sermons/{sermon_id}/status · scope ministries:writeSet Sermon Status
• PATCH /ministries/sermons/{sermon_id}/transcript · scope ministries:writeSet TranscriptReal transcription (Faster-Whisper per spec section 22) is a bigger infrastructure decision not made yet - this is the manual-entry shell the spec's own build sequence (N08) calls "Transcription shell" before a real engine is wired in, matching this project's honest-scoping pattern for AI/media infra it hasn't built yet (e.g. Publishers' audiobook narration).
• GET /ministries/studies · scope ministries:readList Studies
• POST /ministries/studies · scope ministries:writeCreate Study
• PATCH /ministries/studies/{lesson_id}/status · scope ministries:writeSet Study Status

Productions and published media, and the rights that travel with them.

• GET /design-canvas/assets · scope media:readList Assets
• POST /design-canvas/assets/generate · scope media:writeGenerate AssetReal FLUX.1-dev generation on the local GPU via ComfyUI - reuses the shared flux_image_engine. Slow by nature (a real diffusion render); the frontend calls this with a long timeout.
• POST /design-canvas/assets/upload · scope media:writeUpload Asset
• GET /design-canvas/assets/{asset_id}/file · scope media:readAsset File
• GET /design-canvas/designs · scope media:readList Designs
• POST /design-canvas/designs · scope media:writeCreate Design
• GET /design-canvas/designs/{design_id} · scope media:readGet Design
• PATCH /design-canvas/designs/{design_id} · scope media:writeSave Design
• DELETE /design-canvas/designs/{design_id} · scope media:writeDelete Design
• POST /design-canvas/designs/{design_id}/duplicate · scope media:writeDuplicate Design
• GET /design-canvas/templates · scope media:readList TemplatesThe shelf - key, name and size only; the layout ships when one is minted.
• POST /design-canvas/templates/{key} · scope media:writeMint From TemplateMints an ordinary DRAFT design from the shelf - from here on it is any other design: the editor owns it, nothing auto-publishes anywhere.
• GET /identity/organizations/{org}/pack · scope media:readGet Pack
• PUT /identity/organizations/{org}/pack · scope media:writePut Pack
• POST /identity/song/{project_id}:apply · scope media:writeApply To Song
• POST /identity/song/{project_id}:check · scope media:writeCheck Song
• POST /identity/video/{project_id}:apply · scope media:writeApply To VideoA new brief version (source 'identity_pack') with the shot grammar and voice merged in. Nothing renders; existing shots are not rewritten - the check names them instead.
• POST /identity/video/{project_id}:check · scope media:writeCheck Video
• POST /media-payments/licenses · scope media:writeCreate LicenseThe tenant sells usage rights to an episode's audio: the TERMS live in words on the row, the pay link travels like a sponsorship, and the file is delivered only on captured money. The offer IS the pending purchase - one table, one rail.
• GET /media-payments/licenses · scope media:readList Licenses
• GET /media-payments/purchases/mine · scope media:readMy MediaTHE LISTENER'S OWN PURCHASES (2026-09-11, the customer Space's "Elsewhere"): premium episodes, show memberships, licences, sponsorships and tips a person paid for, across every show. A purchase names its person by `buyer_user_id` when they were signed in, and otherwise by the email they paid with - the standing ownership rule (own_identity), decided here per row on the system cursor. PAID only: a …
• POST /media-payments/sponsorships · scope media:writeCreate SponsorshipThe offer IS the pending purchase row - one table, no parallel invoice system. The tenant sends the returned link; nothing is emailed for them (no mail rail).
• GET /media-payments/sponsorships · scope media:readList SponsorshipsThe tenant's sponsorship desk: every offer with its state and its link.
• POST /media-payments/sponsorships/{purchase_id}/void · scope media:writeVoid SponsorshipWithdrawing an offer nobody paid. A PAID sponsorship is history, never voidable - money that moved stays on the books.
• POST /media-payments/webhook · scope media:writeMedia Stripe WebhookThe pillar's own verified door, education's shape exactly: signature or refusal, captured events only.
• GET /media/assets · scope media:readList Assets
• POST /media/assets · scope media:writeUpload Asset
• GET /media/assets/{asset_id}/download · scope media:readDownload Asset
• GET /media/audience-insights · scope media:readList Audience Insights
• POST /media/audience-insights/generate · scope media:writeGenerate Audience InsightExplicitly synthetic (spec section 16: 'Safe Core supports synthetic audience segments') - real external audience data collection is locked regardless of instruction, same as every other real-external-data boundary in this pillar.
• GET /media/briefs · scope media:readList Briefs
• POST /media/briefs · scope media:writeCreate Brief
• POST /media/briefs/{brief_id}/approve · scope media:writeApprove Brief
• GET /media/calendar · scope media:readList Calendar
• POST /media/calendar · scope media:writeCreate Calendar Item
• GET /media/campaigns · scope media:readList Campaigns
• POST /media/campaigns · scope media:writeCreate Campaign
• PATCH /media/campaigns/{campaign_id}/status · scope media:writeTransition Campaign
• GET /media/distribution · scope media:readList Distribution Jobs
• POST /media/distribution · scope media:writeCreate Distribution Job
• PATCH /media/distribution/{job_id}/status · scope media:writeTransition Distribution JobReal external posting states are never enabled here (spec section 15) - `simulated` is the terminal success state, there is no `posted`/`published` status in the allow-list at all.
• GET /media/experiments · scope media:readList Experiments
• POST /media/experiments · scope media:writeCreate Experiment
• PATCH /media/experiments/variants/{variant_id}/results · scope media:writeRecord Variant Results
• PATCH /media/experiments/variants/{variant_id}/short-link · scope media:writeBind Variant Short LinkMD6 - binds the variant to ONE of the tenant's own short links. From then on its reading is the link's real clicks; the synthetic numbers stop mattering for this variant and the banner comes off honestly.
• POST /media/experiments/{experiment_id}/complete · scope media:writeComplete ExperimentDeclares a winner by real conversion-rate comparison across recorded synthetic variants - refuses to declare a winner from insufficient data (spec section 12: 'must avoid declaring winners from insufficient data'), using a minimum-sample-size floor rather than just picking whichever variant has the highest raw rate.
• GET /media/hooks · scope media:readList Hooks
• POST /media/hooks · scope media:writeCreate Hook
• GET /media/integrations · scope media:readList Integrations
• GET /media/live-recaps · scope media:readList Recaps
• POST /media/live-recaps · scope media:writeCreate Recap
• POST /media/live-recaps/{recap_id}/draft-summary · scope media:writeDraft Recap Summary
• GET /media/provenance · scope media:readList Provenance
• POST /media/provenance · scope media:writeCreate ProvenanceSigning status stays 'unsigned' by default - production C2PA signing is a separately-gated real infrastructure decision (spec section 26/37), not something recorded here just because a row was created.
• GET /media/reputation · scope media:readList Reputation Signals
• POST /media/reputation/generate · scope media:writeGenerate Reputation Signal
• POST /media/workspaces · scope media:writeCreate Workspace
• GET /media/workspaces/mine · scope media:readGet My Workspace Endpoint
• DELETE /multimedia-factory/items/{iid} · scope media:writeUnlink ItemUnlinks; the project itself stays in its factory.
• GET /multimedia-factory/productions · scope media:readList Productions
• POST /multimedia-factory/productions · scope media:writeCreate Production
• GET /multimedia-factory/productions/{pid} · scope media:readGet Production
• DELETE /multimedia-factory/productions/{pid} · scope media:writeDelete ProductionRemoves the production and its links. The song / video / deck projects stay in their factories - they are the person's work, not the production's.
• GET /multimedia-factory/productions/{pid}/brief.md · scope media:readProduction Brief MdThe one-page production brief a human collaborator (a musician, an editor, a designer) can work from - the same spine the factories got.
• POST /multimedia-factory/productions/{pid}/certificate · scope media:writeIssue Certificate
• GET /multimedia-factory/productions/{pid}/certificate · scope media:readGet Certificate
• PUT /multimedia-factory/productions/{pid}/intake · scope media:writePut Intake
• POST /multimedia-factory/productions/{pid}/items · scope media:writeLink ItemLink an existing project (made before the production, or by hand) so it is rolled up too.
• PUT /multimedia-factory/productions/{pid}/message · scope media:writePut Message
• POST /multimedia-factory/productions/{pid}/plan · scope media:writePlan ProductionThe Producer: message spine + which outputs / roles / order / why + facts + open questions. Falls back to the deterministic rules (and says so) when the model is busy or unavailable.
• PUT /multimedia-factory/productions/{pid}/plan · scope media:writePatch PlanThe person's edits: outputs on/off, roles, titles, briefs, order - kept as 'user' authored.
• POST /multimedia-factory/productions/{pid}/produce · scope media:writeProduceCreates the chosen outputs as real projects in their factories, briefs prefilled from the spine, sources copied into the deck's ledger, facts handed to the song and the video. Kinds already linked are skipped (no duplicates); nothing renders here.
• POST /multimedia-factory/productions/{pid}/sources · scope media:writeAdd Source
• DELETE /multimedia-factory/sources/{sid} · scope media:writeDelete Source
• PATCH /podcasts/episodes/{episode_id} · scope media:writeUpdate Episode
• DELETE /podcasts/episodes/{episode_id} · scope media:writeDelete Episode
• POST /podcasts/episodes/{episode_id}/audio · scope media:writeUpload Episode Audio
• POST /podcasts/episodes/{episode_id}/publish · scope media:writeToggle Episode Publish
• GET /podcasts/shows · scope media:readList Shows
• POST /podcasts/shows · scope media:writeCreate Show
• PATCH /podcasts/shows/{show_id} · scope media:writeUpdate Show
• POST /podcasts/shows/{show_id}/artwork · scope media:writeUpload Artwork
• GET /podcasts/shows/{show_id}/episodes · scope media:readList Episodes
• POST /podcasts/shows/{show_id}/episodes · scope media:writeCreate Episode
• POST /podcasts/shows/{show_id}/publish · scope media:writeToggle Show Publish
• GET /presentation-factory/accessibility-reports/{rid} · scope media:readGet Report
• GET /presentation-factory/accessibility-reports/{rid}/markdown · scope media:readReport MarkdownThe handable version. Plain Markdown, because the person who asked for this may well need to paste it into an e-mail or a tender response.
• POST /presentation-factory/approvals/{approval_id}:decide · scope media:writeDecide Approval
• POST /presentation-factory/certificates/{cid}:verify · scope media:writeVerify Certificate
• PATCH /presentation-factory/claims/{cid} · scope media:writePatch Claim
• DELETE /presentation-factory/claims/{cid} · scope media:writeDelete Claim
• PATCH /presentation-factory/collaborators/{collaborator_id} · scope media:writePatch Collaborator
• DELETE /presentation-factory/collaborators/{collaborator_id} · scope media:writeRevoke Collaborator
• POST /presentation-factory/collaborators/{collaborator_id}:respond · scope media:writeRespond Invite
• DELETE /presentation-factory/comments/{comment_id} · scope media:writeDelete Comment
• POST /presentation-factory/comments/{comment_id}:reopen · scope media:writeReopen Comment
• POST /presentation-factory/comments/{comment_id}:resolve · scope media:writeResolve Comment
• GET /presentation-factory/datasets/{did} · scope media:readGet Dataset
• DELETE /presentation-factory/datasets/{did} · scope media:writeDelete Dataset
• PUT /presentation-factory/datasets/{did}/columns · scope media:writePatch Dataset ColumnsEdit types/units (the honest metadata) - names and data are the snapshot's, immutable.
• POST /presentation-factory/datasets/{did}:refresh · scope media:writeRefresh DatasetA NEW snapshot from the current file / a fresh paste, with the drift named. Charts keep showing their reviewed snapshot until someone updates them - never silently.
• DELETE /presentation-factory/domains/{did} · scope media:writeDelete Domain
• POST /presentation-factory/domains/{did}:verify · scope media:writeVerify DomainLook for the token at the .well-known path. Nothing about this is taken on trust: the fetch goes through the same guard as any other, and a near-miss is reported as a failure.
• GET /presentation-factory/exports/{eid}/certificate · scope media:readGet Certificate
• GET /presentation-factory/exports/{eid}/file · scope media:readExport File
• POST /presentation-factory/followups/{fid}:answer · scope media:writeAnswer FollowupSaves the presenter's answer. Evidence ids are checked against this deck's ledger - an id from somewhere else is dropped, not trusted - and an answer with none is stored `unsourced`.
• POST /presentation-factory/followups/{fid}:decline · scope media:writeDecline FollowupNot every question can be answered, and pretending otherwise is worse than saying so. A declined follow-up keeps the question and the reason; it just stops being open work.
• POST /presentation-factory/followups/{fid}:draft · scope media:writeDraft AnswerDrafts, but never saves - the presenter is the one who answers the room. The draft comes back with its evidence and with any invented number named out loud.
• POST /presentation-factory/followups/{fid}:publish · scope media:writePublish Followup
• POST /presentation-factory/layout:preview · scope media:writeLayout Preview
• DELETE /presentation-factory/locks/{lid} · scope media:writeUnlock Route
• GET /presentation-factory/media/available · scope media:readAvailable MediaWhat this person can attach: their ready Song Factory renders and Video Factory exports, each with the certificate it already carries.
• PATCH /presentation-factory/media/{mid} · scope media:writePatch Media
• DELETE /presentation-factory/media/{mid} · scope media:writeDelete Media
• GET /presentation-factory/media/{mid}/captions · scope media:readMedia Captions
• GET /presentation-factory/media/{mid}/file · scope media:readMedia File
• GET /presentation-factory/narrations/{nid} · scope media:readGet Narration
• DELETE /presentation-factory/narrations/{nid} · scope media:writeDelete Narration
• GET /presentation-factory/narrations/{nid}/audio · scope media:readNarration Audio
• GET /presentation-factory/narrations/{nid}/captions · scope media:readNarration Captions
• POST /presentation-factory/narrations/{nid}/share · scope media:writeShare Talk
• POST /presentation-factory/narrations/{nid}/share:revoke · scope media:writeRevoke Talk
• GET /presentation-factory/narrations/{nid}/transcript · scope media:readNarration TranscriptThe whole talk as text - the thing a person can read instead of listening, or search.
• GET /presentation-factory/narrations/{nid}/what-would-be-published · scope media:readWhat Would Be PublishedShown BEFORE the share button does anything: the exact words that would become public, in order, so the decision gets made looking at the thing rather than at a checkbox.
• POST /presentation-factory/organizations/{org_id}/claims · scope media:writeCreate Claim
• GET /presentation-factory/organizations/{org_id}/claims · scope media:readList Claims
• PATCH /presentation-factory/organizations/{org_id}/claims/{cid} · scope media:writeUpdate ClaimEditing the library NEVER touches a deck. The response says how many decks now differ, so the consequence of the edit is visible at the moment it is made rather than discovered later.
• GET /presentation-factory/organizations/{org_id}/claims/{cid}/usage · scope media:readClaim Usage
• POST /presentation-factory/organizations/{org_id}/claims/{cid}:retire · scope media:writeRetire ClaimRetiring names the decks it affects. You cannot retire evidence into the void.
• POST /presentation-factory/organizations/{org_id}/claims/{cid}:verify · scope media:writeVerify ClaimA person went and looked. That is the only thing that resets the clock - there is no automatic re-verification here, because nothing about a stored row can tell you the world still agrees.
• GET /presentation-factory/organizations/{org_id}/claims:drift · scope media:readDriftEverywhere the library and a deck no longer agree, plus the claims nobody has checked. This is the report that answers "which eleven decks still say 1,240?".
• POST /presentation-factory/organizations/{org_id}/domains · scope media:writeAdd DomainRegisters a domain as the organisation's own. It starts DECLARED - which means somebody typed it. Verification is a separate, provable step.
• GET /presentation-factory/organizations/{org_id}/domains · scope media:readList Domains
• GET /presentation-factory/organizations/{org_id}/insights · scope media:readOrg InsightsThe same honesty, one level up: across an organisation's decks. RLS decides which decks are visible - this adds no visibility of its own.
• PUT /presentation-factory/organizations/{organization_id}/brand-profile · scope media:writePut Brand Profile
• DELETE /presentation-factory/polls/{poll_id} · scope media:writeDelete Poll
• GET /presentation-factory/projects · scope media:readList Projects
• POST /presentation-factory/projects · scope media:writeCreate Project
• GET /presentation-factory/projects/{pid} · scope media:readGet Project
• DELETE /presentation-factory/projects/{pid} · scope media:writeDelete Project
• GET /presentation-factory/projects/{pid}/accessibility · scope media:readCheck AccessibilityThe live view. Recomputed every time, so it is never stale - and never a certificate.
• GET /presentation-factory/projects/{pid}/accessibility/reports · scope media:readList Reports
• POST /presentation-factory/projects/{pid}/accessibility:issue · scope media:writeIssue ReportFreezes the report against this version, hashes it, and stores it. Failures do not block - a report that only exists when everything passes is a marketing document, and the whole value of this one is that it can say what is wrong. But issuing over failures is recorded.
• GET /presentation-factory/projects/{pid}/brand · scope media:readGet Brand
• POST /presentation-factory/projects/{pid}/brand:apply · scope media:writeApply BrandApply the organisation's Theme Editor tokens to the deck: colours, fonts, the logo (as a data URI at render time so exports stay self-contained), the required footer line.
• POST /presentation-factory/projects/{pid}/brief · scope media:writeSave Brief
• POST /presentation-factory/projects/{pid}/brief:strategist · scope media:writeStrategist
• POST /presentation-factory/projects/{pid}/check:notes · scope media:writeCheck NotesDo the notes and the slide agree? Rules catch the numbers; the model catches the ones written in words. When the model is unavailable the rules still run, and the answer says which ran.
• GET /presentation-factory/projects/{pid}/checks · scope media:readChecks
• POST /presentation-factory/projects/{pid}/claims · scope media:writeAdd Claim
• POST /presentation-factory/projects/{pid}/claims:adopt · scope media:writeAdopt ClaimsCopies library claims into this deck. A retired claim is refused rather than quietly adopted.
• POST /presentation-factory/projects/{pid}/datasets · scope media:writeCreate Dataset
• POST /presentation-factory/projects/{pid}/deck · scope media:writeSave Deck
• POST /presentation-factory/projects/{pid}/deck:architect · scope media:writeArchitect
• GET /presentation-factory/projects/{pid}/delivery · scope media:readDelivery ReportAcross every ended session of this deck: what the plan said, what actually happened, and the slides that keep costing you time. Nothing here is modelled - it is your own stopwatch.
• GET /presentation-factory/projects/{pid}/diff · scope media:readDiffCompare two versions. `base` defaults to the previous version, `against` to the current one.
• POST /presentation-factory/projects/{pid}/evidence:map · scope media:writeEvidence Map
• POST /presentation-factory/projects/{pid}/exports · scope media:writeExport Deck
• POST /presentation-factory/projects/{pid}/followups · scope media:writeAdd FollowupA question asked out loud that never made it to a phone still deserves an answer.
• GET /presentation-factory/projects/{pid}/followups · scope media:readList Followups
• PATCH /presentation-factory/projects/{pid}/freshness · scope media:writeSet HorizonHow long this deck's evidence stays fresh. A safety briefing and a conference keynote do not age at the same rate, and the platform should not pretend to know which one this is.
• POST /presentation-factory/projects/{pid}/import:pptx · scope media:writeImport Pptx DeckA .pptx comes in as a DRAFT deck version - text and speaker notes - with a report of what did not come across. Nothing is overwritten; it is a new version to edit or discard.
• GET /presentation-factory/projects/{pid}/insights · scope media:readDeck InsightsWhat this deck's rooms are telling you. Read-only; nothing here is stored.
• POST /presentation-factory/projects/{pid}/locks · scope media:writeLock Route
• GET /presentation-factory/projects/{pid}/logo · scope media:readProject Logo
• POST /presentation-factory/projects/{pid}/media · scope media:writeAttach MediaAttach a Song Factory render or a Video Factory export, snapshotting its provenance and pulling its accessibility material (captions / lyrics) in.
• GET /presentation-factory/projects/{pid}/media · scope media:readList Media
• GET /presentation-factory/projects/{pid}/media/{sid} · scope media:readSource MediaA Song Factory render / Video export attached as a source, for the slide's <audio>/<video>.
• POST /presentation-factory/projects/{pid}/narration · scope media:writeStart NarrationSpeaks the deck's own speaker notes. Refuses if there are no notes at all rather than inventing a talk - a narration built from headlines would be a script the presenter never wrote.
• GET /presentation-factory/projects/{pid}/narrations · scope media:readList Narrations
• GET /presentation-factory/projects/{pid}/parts · scope media:readParts Route
• POST /presentation-factory/projects/{pid}/polls · scope media:writeCreate Poll
• GET /presentation-factory/projects/{pid}/polls · scope media:readList Polls
• GET /presentation-factory/projects/{pid}/preflight · scope media:readPreflightWhat to read in the two minutes before you start a session. Same assessment, ordered worst first and stripped to what a person can actually act on while walking to the front.
• POST /presentation-factory/projects/{pid}/presence · scope media:writePresence Route
• GET /presentation-factory/projects/{pid}/present · scope media:readPresentThe in-app accessible web deck for the CURRENT version (same renderer as the export).
• GET /presentation-factory/projects/{pid}/readiness · scope media:readReadiness
• POST /presentation-factory/projects/{pid}/rehearsal · scope media:writeStart RehearsalThe skeptical panel + the toughest questions, from the brief's own audience and objections. `use_rules` (or a busy GPU) gives the deterministic panel and says so.
• POST /presentation-factory/projects/{pid}/sessions · scope media:writeStart SessionStarts a live session on the deck's CURRENT version and pins it. Unlike an export, this does NOT block on the quality checker: someone is standing in front of a room and the deck is what it is. The unresolved count comes back with the code so it is said out loud, not buried.
• GET /presentation-factory/projects/{pid}/sessions · scope media:readList Sessions
• GET /presentation-factory/projects/{pid}/since-approval · scope media:readSince ApprovalWhat has moved since somebody put their name to this. If nothing was ever approved it says so rather than quietly comparing against something else and calling it the same question.
• POST /presentation-factory/projects/{pid}/slides/{part_id}:ai-edit · scope media:writeAi Edit Route
• POST /presentation-factory/projects/{pid}/sources · scope media:writeAdd Source
• POST /presentation-factory/projects/{pid}/sources:staleness · scope media:writeStalenessRun the evidence refresh now (same handler the automation loop runs): re-verify every claim's verbatim excerpt, mark vanished ones 'stale', report workspace-file drift.
• POST /presentation-factory/projects/{pid}/sources:web · scope media:writeAdd Web SourceFetch a page and keep it as a snapshot. The permission field defaults to 'unknown' and stays the person's declaration - Fitinty does not decide that a page is reusable because it loaded.
• POST /presentation-factory/projects/{pid}/suggestions · scope media:writeSuggest Route
• POST /presentation-factory/projects/{pid}/templates/{tid}:apply · scope media:writeApply Template
• POST /presentation-factory/projects/{pid}/theme · scope media:writeSet Theme
• POST /presentation-factory/projects/{pid}/variants · scope media:writeCreate VariantA LOCALE VARIANT: a full linked deck in the target language - brief, sources and claims copied (evidence stays the single source of truth), slides machine-translated (marked, flagged 'native review needed' until a person marks it reviewed) and judged at the target language's text length. The parent deck is never touched.
• POST /presentation-factory/projects/{pid}:mark-reviewed · scope media:writeMark ReviewedA person who read the variant in its language signs it off; recorded, not assumed.
• POST /presentation-factory/projects/{project_id}/approvals · scope media:writeRequest Approval
• POST /presentation-factory/projects/{project_id}/collaborators · scope media:writeAdd Collaborator
• GET /presentation-factory/projects/{project_id}/comments · scope media:readList Comments
• POST /presentation-factory/projects/{project_id}/comments · scope media:writeAdd Comment
• POST /presentation-factory/projects/{project_id}/share-links · scope media:writeCreate Share Link
• GET /presentation-factory/projects/{project_id}/sharing · scope media:readGet Sharing
• PATCH /presentation-factory/projects/{project_id}/sharing · scope media:writePatch Sharing
• POST /presentation-factory/projects/{project_id}:restore · scope media:writeRestore Project
• POST /presentation-factory/projects/{project_id}:takedown · scope media:writeTakedown Project
• GET /presentation-factory/rehearsals/{rid} · scope media:readGet Rehearsal
• POST /presentation-factory/rehearsals/{rid}:answer · scope media:writeAnswer RehearsalGrade one typed answer against the claim ledger. An invented number is a failed answer.
• POST /presentation-factory/rehearsals/{rid}:finish · scope media:writeFinish RehearsalThe readiness report: what held, what failed, which objections still have no home, timing.
• POST /presentation-factory/rehearsals/{rid}:timing · scope media:writeTiming RehearsalThe timing drill: actual seconds per slide (measured by the client) vs the budgets. Pure.
• POST /presentation-factory/reports · scope media:writeFile Report
• GET /presentation-factory/reports · scope media:readList Reports
• PATCH /presentation-factory/reports/{report_id} · scope media:writePatch Report
• GET /presentation-factory/sessions/{sid} · scope media:readGet SessionThe presenter's own view: every question INCLUDING the hidden ones (with the reason recorded against them), live poll counts, and the running timeline.
• DELETE /presentation-factory/sessions/{sid} · scope media:writeDelete Session
• POST /presentation-factory/sessions/{sid}/followup-page:publish · scope media:writePublish PageMints (once) an unguessable link the presenter can hand back to the room. This publishes the answers they marked as publishable - nothing else, and nobody is e-mailed or texted.
• POST /presentation-factory/sessions/{sid}/followup-page:revoke · scope media:writeRevoke Page
• POST /presentation-factory/sessions/{sid}/followups:collect · scope media:writeCollect FollowupsTurns every question the room asked that was never answered into a follow-up item. Hidden questions are NOT collected - they were taken off the screen for a reason - but the count of them comes back, so the presenter is told what was left behind rather than left to assume.
• POST /presentation-factory/sessions/{sid}/polls/{poll_id}:open · scope media:writeOpen PollOne poll open at a time - a room cannot answer two questions at once, and the DB index says so.
• POST /presentation-factory/sessions/{sid}/polls:close · scope media:writeClose Poll
• POST /presentation-factory/sessions/{sid}/questions/{qid}:answered · scope media:writeMark Answered
• POST /presentation-factory/sessions/{sid}/questions/{qid}:hide · scope media:writeHide QuestionTakes a question off the room's screen. It is NOT deleted: the words stay, with who hid them and why, and the session summary counts them. Moderation you can audit is the only honest kind.
• POST /presentation-factory/sessions/{sid}/questions/{qid}:restore · scope media:writeRestore Question
• POST /presentation-factory/sessions/{sid}/runs/{run_id}:to-dataset · scope media:writePoll Run To DatasetPull a closed poll's numbers into the deck as a dataset - carrying the provenance sentence with them, permanently. The room's answer can be shown; it cannot be laundered into a statistic, because the sentence that says what it really is travels in the same row.
• POST /presentation-factory/sessions/{sid}/slide · scope media:writeGo To SlideMoving on closes the previous slide's stopwatch. That is the whole source of the honest 'planned 4 minutes, took 11' report at the end - nothing is estimated after the fact.
• POST /presentation-factory/sessions/{sid}:end · scope media:writeEnd SessionEnds the room and writes the record once. The part that matters most is the list of questions that were NEVER answered - the thing a presenter forgets by the time they reach the car park.
• DELETE /presentation-factory/share-links/{link_id} · scope media:writeRevoke Share Link
• GET /presentation-factory/shared-with-me · scope media:readShared With Me
• PATCH /presentation-factory/sources/{sid} · scope media:writePatch Source
• DELETE /presentation-factory/sources/{sid} · scope media:writeDelete Source
• GET /presentation-factory/sources/{sid}/snapshots · scope media:readList Snapshots
• GET /presentation-factory/sources/{sid}/text · scope media:readSource Text
• POST /presentation-factory/sources/{sid}:recheck · scope media:writeRecheck Web SourceFetch the page again and say plainly whether it still says what was cited. Drift is reported, never silently applied: the old snapshot stays, and the claims keep pointing at what was read.
• POST /presentation-factory/suggestions/{sid}:accept · scope media:writeAccept Route
• POST /presentation-factory/suggestions/{sid}:reject · scope media:writeReject Route
• GET /presentation-factory/templates · scope media:readList Templates
• POST /presentation-factory/templates · scope media:writeSave Template
• DELETE /presentation-factory/templates/{tid} · scope media:writeDelete Template
• POST /presentation-factory/templates/{tid}:approve · scope media:writeApprove Template
• GET /presentation-factory/versions/{vid} · scope media:readGet Version
• POST /presentation-factory/versions/{vid}:restore · scope media:writeRestore Version
• POST /song-factory/approvals/{approval_id}:decide · scope media:writeDecide Approval
• GET /song-factory/bridges/cinema/projects · scope media:readList Cinema ProjectsCinema projects the caller can add a music track to (RLS-scoped) - the "Send to Cinema" picker.
• GET /song-factory/bridges/cinema/renders · scope media:readList Scoreable RendersCompleted Cinema renders the caller can see (RLS on render_attempt / render_job / cinema_project does the scoping), newest first - the picker for "Score a Cinema render".
• POST /song-factory/bridges/cinema/score-render · scope media:writeScore Cinema Render
• POST /song-factory/bridges/cinema/send/{gen_id} · scope media:writeSend Generation To CinemaA ready/exported generation -> Cinema music asset + audio_track + provenance record, with the Rights Certificate issued first and summarised on the asset.
• GET /song-factory/bridges/games/assets · scope media:readList Scoreable Game Assets
• POST /song-factory/bridges/games/import · scope media:writeImport Game Asset
• GET /song-factory/bridges/games/projects · scope media:readList Game Projects
• POST /song-factory/bridges/games/send/{gen_id} · scope media:writeSend Generation To Game-> game_asset audio, source fitinty_song_factory, certificate summary in `license`, file_hash = audio sha, review_state proposed (the game's own review gate still decides).
• POST /song-factory/bridges/import · scope media:writeImport Source
• GET /song-factory/bridges/marketing/assets · scope media:readList Scoreable Marketing Assets
• GET /song-factory/bridges/marketing/campaigns · scope media:readList Marketing CampaignsSend targets: a profile (music for the brand) or a specific campaign under it.
• POST /song-factory/bridges/marketing/import · scope media:writeImport Marketing Asset
• POST /song-factory/bridges/marketing/send/{gen_id} · scope media:writeSend Generation To Marketing-> marketing_content_asset with audio (migration 272) + marketing_provenance_record + marketing_cross_pillar_link (destination song_factory, accepted).
• GET /song-factory/bridges/media/assets · scope media:readList Scoreable Media AssetsImages and videos in Media workspaces the caller can see (is_media_staff via RLS).
• POST /song-factory/bridges/media/import · scope media:writeImport Media AssetA Media image -> Visual Score reference; a Media video -> measured video cue. Same rows, same declarations as a direct upload, with the provenance of where it came from.
• POST /song-factory/bridges/media/send/{gen_id} · scope media:writeSend Generation To MediaA ready/exported generation -> Media audio asset (ai_generated, consent_confirmed, the certificate summarised in rights_metadata) + media_provenance_record.
• GET /song-factory/bridges/media/workspaces · scope media:readList Media Workspaces
• GET /song-factory/bridges/publishers/covers · scope media:readList Scoreable Covers
• POST /song-factory/bridges/publishers/import · scope media:writeImport Cover
• POST /song-factory/bridges/send/{gen_id} · scope media:writeSend Generation
• GET /song-factory/bridges/sources · scope media:readList SourcesOne list for the UI: [{pillar, kind: image|video, ref_id, label}] across pillars, each RLS-scoped by its own query. Empty pillars simply contribute nothing.
• GET /song-factory/bridges/targets · scope media:readList TargetsEverywhere a finished render can be sent: [{pillar, ref_id, label}]. Workspace is always available (it is the person's own files).
• GET /song-factory/bridges/workspace/files · scope media:readList Scoreable Workspace Files
• POST /song-factory/bridges/workspace/import · scope media:writeImport Workspace File
• POST /song-factory/bridges/workspace/send/{gen_id} · scope media:writeSend Generation To Workspace-> two workspace_file rows: the FLAC and "<name>.certificate.json" beside it. workspace_file has no metadata column; a delivered song never travels without its certificate, so the certificate becomes a file of its own.
• GET /song-factory/certificates/{cert_id}/verify · scope media:readVerify Certificate
• PATCH /song-factory/clips/{clip_id} · scope media:writePatch Clip
• DELETE /song-factory/clips/{clip_id} · scope media:writeDelete Clip
• POST /song-factory/clips/{clip_id}:split · scope media:writeSplit ClipNon-destructive split: the clip ends at `at`, a new clip starts there with the matching source offset. Fades stay where they were (in on the left part, out on the right).
• PATCH /song-factory/collaborators/{collaborator_id} · scope media:writePatch Collaborator
• DELETE /song-factory/collaborators/{collaborator_id} · scope media:writeRevoke Collaborator
• POST /song-factory/collaborators/{collaborator_id}:respond · scope media:writeRespond Invite
• DELETE /song-factory/comments/{comment_id} · scope media:writeDelete Comment
• POST /song-factory/comments/{comment_id}:reopen · scope media:writeReopen Comment
• POST /song-factory/comments/{comment_id}:resolve · scope media:writeResolve Comment
• GET /song-factory/generations/{gen_id} · scope media:readGet Generation
• GET /song-factory/generations/{gen_id}/audio · scope media:readGeneration Audio
• GET /song-factory/generations/{gen_id}/certificate · scope media:readGet Certificate
• GET /song-factory/generations/{gen_id}/consistency · scope media:readGeneration ConsistencyScore a generation against its project's identity using what was ACTUALLY sent.
• GET /song-factory/generations/{gen_id}/export · scope media:readExport GenerationDownload + certificate in one act (plan 12.1 - the package is bigger later; today it is the master and the certificate). Marks the generation EXPORTED.
• GET /song-factory/generations/{gen_id}/export-package · scope media:readExport PackagePlan 12.1 - the delivery package as one ZIP: the FLAC master, the WAV with the C2PA manifest (sandbox-signed when the SDK is present, else unsigned + the manifest JSON beside it), certificate.json, manifest.json, the .c2pa store when signed, and a README that says which is which and what is NOT warranted. Marks the generation exported.
• GET /song-factory/generations/{gen_id}/provenance · scope media:readGet Provenance
• GET /song-factory/generations/{gen_id}/provenance/asset · scope media:readProvenance Asset
• POST /song-factory/generations/{gen_id}/provenance:issue · scope media:writeIssue Provenance
• POST /song-factory/generations/{gen_id}/qc · scope media:writeQc GenerationThe audio quality gate (measured, with fixes): EBU R128 loudness, true peak, lead/trail silence, duration vs the brief. Report, never a block - the person decides.
• POST /song-factory/generations/{gen_id}:cancel · scope media:writeCancel Generation
• POST /song-factory/generations/{gen_id}:confirm · scope media:writeConfirm Generation
• POST /song-factory/generations/{gen_id}:reroute · scope media:writeReroute GenerationAsk for a fallback estimate by hand - for a failed render that did not get one (no other model was loaded at the time), or to retry routing later. Same rules as the automatic offer.
• DELETE /song-factory/locks/{lid} · scope media:writeUnlock Route
• DELETE /song-factory/markers/{marker_id} · scope media:writeDelete Marker
• GET /song-factory/models · scope media:readList Models
• DELETE /song-factory/notes/{note_id} · scope media:writeDelete Note
• GET /song-factory/projects · scope media:readList Projects
• POST /song-factory/projects · scope media:writeCreate Project
• POST /song-factory/projects/{pid}/locks · scope media:writeLock Route
• GET /song-factory/projects/{pid}/parts · scope media:readParts Route
• POST /song-factory/projects/{pid}/parts/{part_id}:ai-edit · scope media:writeAi Edit Route
• POST /song-factory/projects/{pid}/presence · scope media:writePresence Route
• POST /song-factory/projects/{pid}/suggestions · scope media:writeSuggest Route
• GET /song-factory/projects/{project_id} · scope media:readGet Project
• DELETE /song-factory/projects/{project_id} · scope media:writeDelete Project
• POST /song-factory/projects/{project_id}/approvals · scope media:writeRequest Approval
• POST /song-factory/projects/{project_id}/brief · scope media:writeSave Brief
• POST /song-factory/projects/{project_id}/collaborators · scope media:writeAdd Collaborator
• GET /song-factory/projects/{project_id}/comments · scope media:readList Comments
• POST /song-factory/projects/{project_id}/comments · scope media:writeAdd Comment
• GET /song-factory/projects/{project_id}/consistency · scope media:readProject ConsistencyScore the project's CURRENT brief against its bound identity (no render needed).
• POST /song-factory/projects/{project_id}/generations:estimate · scope media:writeEstimate Generation
• POST /song-factory/projects/{project_id}/lyrics · scope media:writeSave Lyrics
• POST /song-factory/projects/{project_id}/lyrics:generate · scope media:writeGenerate Lyrics
• POST /song-factory/projects/{project_id}/moment:compile · scope media:writeCompile Moment
• POST /song-factory/projects/{project_id}/references · scope media:writeUpload ReferenceUpload a reference recording. Three declarations are required and stored verbatim with a timestamp; there is no identity detection and none is claimed (plan 7.5: the certificate's no-warranty line exists precisely because of what this cannot check).
• GET /song-factory/projects/{project_id}/references · scope media:readList References
• POST /song-factory/projects/{project_id}/share-links · scope media:writeCreate Share Link
• GET /song-factory/projects/{project_id}/sharing · scope media:readGet Sharing
• PATCH /song-factory/projects/{project_id}/sharing · scope media:writePatch Sharing
• POST /song-factory/projects/{project_id}/sonic-identity:apply · scope media:writeApply IdentityOnly an APPROVED version is applied (brand/legal gate). Writes a brief version with the identity's rules enforced and binds the project to identity + version.
• POST /song-factory/projects/{project_id}/sonic-identity:unbind · scope media:writeUnbind Identity
• GET /song-factory/projects/{project_id}/timeline · scope media:readGet TimelineGet-or-create the project's timeline. A fresh timeline gets one empty track and tempo from the brief (bpm / time signature) when the brief has them.
• POST /song-factory/projects/{project_id}/variations:estimate · scope media:writeEstimate VariationsPlan 5.2: one brief, N seeds, one estimate. Every row is a full generation (own certificate, own export); the group is how they are confirmed, rendered and shown together.
• POST /song-factory/projects/{project_id}/videos · scope media:writeUpload Video
• GET /song-factory/projects/{project_id}/videos · scope media:readList Videos
• POST /song-factory/projects/{project_id}/visuals · scope media:writeUpload Visual
• GET /song-factory/projects/{project_id}/visuals · scope media:readList Visuals
• POST /song-factory/projects/{project_id}/visuals:analyze · scope media:writeAnalyze VisualsPer-image analysis (cached on the row) + a synthesized VisualMusicBrief. Returns both; applies nothing - the person edits and applies (plan 5.6 steps 5-7).
• POST /song-factory/projects/{project_id}/visuals:apply · scope media:writeApply Visual Brief
• POST /song-factory/projects/{project_id}:remix · scope media:writeRemix Project
• POST /song-factory/projects/{project_id}:restore · scope media:writeRestore Project
• POST /song-factory/projects/{project_id}:takedown · scope media:writeTakedown Project
• GET /song-factory/provenance/sdk · scope media:readProvenance Sdk
• DELETE /song-factory/references/{ref_id} · scope media:writeDelete Reference
• GET /song-factory/references/{ref_id}/audio · scope media:readReference Audio
• GET /song-factory/renders/{render_id}/audio · scope media:readRender Audio
• POST /song-factory/reports · scope media:writeFile Report
• GET /song-factory/reports · scope media:readList Reports
• PATCH /song-factory/reports/{report_id} · scope media:writePatch Report
• DELETE /song-factory/share-links/{link_id} · scope media:writeRevoke Share Link
• GET /song-factory/shared-with-me · scope media:readShared With Me
• GET /song-factory/sonic-identities · scope media:readList Identities
• POST /song-factory/sonic-identities · scope media:writeCreate Identity
• GET /song-factory/sonic-identities/organizations · scope media:readList Identity OrgsThe organizations this person can hold a Sonic Identity for (member or owner).
• GET /song-factory/sonic-identities/{identity_id} · scope media:readGet Identity
• GET /song-factory/sonic-identities/{identity_id}/series · scope media:readSeries ConsistencyEvery render across projects bound to this identity, scored - the 'episode consistency' view for a series or campaign (plan 5.7 / SF-031).
• POST /song-factory/sonic-identities/{identity_id}/versions · scope media:writeAdd VersionEditing = a new version. Approval does not carry over: the new version is unapproved until an owner approves it (the identity's status drops back to draft if it was approved).
• POST /song-factory/sonic-identities/{identity_id}:approve · scope media:writeApprove IdentityBrand / legal review (plan 5.7): an org OWNER approves the CURRENT version. Members can draft; only owners approve - the same line themes draw for publishing.
• POST /song-factory/sonic-identities/{identity_id}:archive · scope media:writeArchive Identity
• GET /song-factory/studio/peaks · scope media:readPeaks
• POST /song-factory/suggestions/{sid}:accept · scope media:writeAccept Route
• POST /song-factory/suggestions/{sid}:reject · scope media:writeReject Route
• PATCH /song-factory/timelines/{timeline_id} · scope media:writePatch Timeline
• POST /song-factory/timelines/{timeline_id}/clips · scope media:writeAdd Clip
• POST /song-factory/timelines/{timeline_id}/clips:place · scope media:writePlace Clip
• GET /song-factory/timelines/{timeline_id}/daw-package · scope media:readDaw PackagePlan 12.1 'aligned DAW export': mix.wav, stems/<track>.wav each rendered alone and padded to the full length (so they line up on import), markers.csv, edl.json, tempo.txt, lyrics.txt, certificates/<generation>.json for every render used, README.
• POST /song-factory/timelines/{timeline_id}/markers · scope media:writeAdd Marker
• POST /song-factory/timelines/{timeline_id}/notes · scope media:writeAdd Note
• POST /song-factory/timelines/{timeline_id}/regenerate-region · scope media:writeRegenerate RegionA region -> a new render at the region's EXACT length. Writes a new brief version (the duration, and instrumental when no excerpt) and, with an excerpt, a new lyrics version - both append-only, so the regeneration is provenance, not a side channel. Returns the estimate; the person confirms it in Generate; when ready, `clips:place` drops it into the region.
• POST /song-factory/timelines/{timeline_id}/renders · scope media:writeRender TimelineSynchronous delivery render of the mix (seconds for a few minutes of audio).
• POST /song-factory/timelines/{timeline_id}/tracks · scope media:writeAdd Track
• PATCH /song-factory/tracks/{track_id} · scope media:writePatch Track
• DELETE /song-factory/tracks/{track_id} · scope media:writeDelete Track
• POST /song-factory/variation-groups/{group_id}:cancel · scope media:writeCancel VariationsCancels every row of the grid that has not started rendering; ones already on the GPU finish (the runner skips canceled rows before it starts each one).
• POST /song-factory/variation-groups/{group_id}:confirm · scope media:writeConfirm VariationsOne set of declarations for the whole grid; the same checks as a single confirm, applied to every row; one background runner for the group.
• DELETE /song-factory/videos/{video_id} · scope media:writeDelete Video
• GET /song-factory/videos/{video_id}/media · scope media:readVideo Media
• POST /song-factory/videos/{video_id}:apply · scope media:writeApply Video BriefThe edited direction becomes a brief version with the clip's EXACT duration, the energy arc, the hit points, and video_reference_id for provenance.
• POST /song-factory/videos/{video_id}:measure · scope media:writeMeasure VideoMeasure (cached), describe a few frames with the vision model, synthesize a direction. Returns measurement + direction; applies nothing.
• DELETE /song-factory/visuals/{visual_id} · scope media:writeDelete Visual
• GET /song-factory/visuals/{visual_id}/image · scope media:readVisual Image
• GET /video-factory/animatics/{aid} · scope media:readGet Animatic
• GET /video-factory/animatics/{aid}/file · scope media:readAnimatic File
• POST /video-factory/approvals/{approval_id}:decide · scope media:writeDecide Approval
• GET /video-factory/audio-masters/{mid} · scope media:readGet Master
• GET /video-factory/audio-masters/{mid}/file · scope media:readMaster File
• GET /video-factory/board-frames/{fid}/image · scope media:readBoard Image
• POST /video-factory/certificates/{cert_id}:verify · scope media:writeVerify Certificate
• PATCH /video-factory/collaborators/{collaborator_id} · scope media:writePatch Collaborator
• DELETE /video-factory/collaborators/{collaborator_id} · scope media:writeRevoke Collaborator
• POST /video-factory/collaborators/{collaborator_id}:respond · scope media:writeRespond Invite
• DELETE /video-factory/comments/{comment_id} · scope media:writeDelete Comment
• POST /video-factory/comments/{comment_id}:reopen · scope media:writeReopen Comment
• POST /video-factory/comments/{comment_id}:resolve · scope media:writeResolve Comment
• GET /video-factory/conforms/{cid} · scope media:readGet Conform
• POST /video-factory/conforms/{cid}:apply · scope media:writeApply ConformTurn a read timeline into a new cut version - only when every clip in it is media this project already holds. The new cut carries `conformed_from` for the rest of its life, so any certificate issued from it says the edit was made outside Fitinty.
• GET /video-factory/consent/{record_id}/trace · scope media:readTraceWhere has this person's voice ended up? Asked without changing anything.
• POST /video-factory/consent/{record_id}/withdraw · scope media:writeWithdrawTake back what can be taken back, and say plainly what cannot.
• GET /video-factory/continuity-reviews/{rid} · scope media:readGet Review
• POST /video-factory/continuity-reviews/{rid}/decide · scope media:writeDecideA person telling the machine whether it was right. `disagreed` is a first-class outcome, not an override to be argued with - the model is wrong often enough that a review with no way to say so would just be a machine's opinion with extra steps.
• GET /video-factory/cost/mine · scope media:readMy FootprintEverything you have asked this machine to do, across all your films. The number an operator would otherwise have to ask for, answerable by the person themselves - which is the point. Somebody who can see their own footprint can manage it; somebody who can only be told about it by an administrator finds out when it is already a conversation.
• GET /video-factory/credits/{cid} · scope media:readGet Credits
• GET /video-factory/credits/{cid}/video · scope media:readCredits Video
• POST /video-factory/cuts/{cut_id}/handoff · scope media:writeCreate HandoffWrite the cut as a timeline an editor can open, and say plainly what did not come with it.
• GET /video-factory/cuts/{cut_id}/handoffs · scope media:readList Handoffs
• POST /video-factory/cuts/{cut_id}:render · scope media:writeRender CutSynchronous ffmpeg render of the EDL -> MP4 review export (+ WebVTT sidecar). Typically seconds for a few shots; the caller shows 'rendering'.
• GET /video-factory/delivery-reports/{rid} · scope media:readGet Report
• POST /video-factory/delivery-reports/{rid}/answer · scope media:writeAnswer`intended` is a real answer, not an override to be argued with. Most of what this report raises will turn out to be somebody's deliberate edit, and a report that treats every one of those as an outstanding failure is a report people stop opening.
• PATCH /video-factory/entities/{eid} · scope media:writePatch Entity
• DELETE /video-factory/entities/{eid} · scope media:writeDelete Entity
• GET /video-factory/exports/{export_id}/accessibility · scope media:readCheck
• POST /video-factory/exports/{export_id}/accessibility:issue · scope media:writeIssue
• GET /video-factory/exports/{export_id}/captions · scope media:readExport Captions
• GET /video-factory/exports/{export_id}/certificate · scope media:readGet Certificate
• POST /video-factory/exports/{export_id}/credits · scope media:writeCreate
• GET /video-factory/exports/{export_id}/credits · scope media:readList Credits
• GET /video-factory/exports/{export_id}/credits:preview · scope media:readPreviewWhat the credits would say, before anything is rendered.
• GET /video-factory/exports/{export_id}/deliverable · scope media:readWhat Would GoWhat a package for this export would contain, without building one. Worth its own route: the answer is a decision aid - "is this film ready to send?" - and asking it should not cost a zip of a film that is not ready to go anywhere yet.
• GET /video-factory/exports/{export_id}/described-audio · scope media:readDescribed TrackThe descriptions as a WebVTT `descriptions` track - the standard way to ship audio description as text a screen reader can speak, without re-rendering the video.
• GET /video-factory/exports/{export_id}/descriptions · scope media:readList DescriptionsEvery shot, with whatever description exists - and, for generated shots with none, what the shot was ASKED to be, offered as a starting point and labelled as such.
• PUT /video-factory/exports/{export_id}/descriptions · scope media:writeSave DescriptionSaving a description marks it `human`: somebody has looked and written it. There is no path that promotes a suggestion to a description without a person passing it through here.
• POST /video-factory/exports/{export_id}/loudness · scope media:writeNormaliseMake a rendition at a named delivery loudness. A NEW file - never a replacement.
• POST /video-factory/exports/{export_id}/package · scope media:writeCreatePut everything that belongs with this film in one place, and say what does not.
• GET /video-factory/exports/{export_id}/packages · scope media:readList Packages
• GET /video-factory/exports/{export_id}/provenance/asset · scope media:readProvenance Asset
• POST /video-factory/exports/{export_id}/provenance:issue · scope media:writeIssue Provenance
• POST /video-factory/exports/{export_id}/qc · scope media:writeQc ExportThe video quality gate (measured, with fixes). Report, never a block.
• GET /video-factory/exports/{export_id}/sound · scope media:readSound ReportEverything about this file's sound: how loud it is, where the speech is, where the silence is, and whether the audio description written for it can actually be heard.
• POST /video-factory/exports/{export_id}/subtitles · scope media:writeCreateTranslate this film's captions into another language, and measure whether they can be read.
• GET /video-factory/exports/{export_id}/subtitles · scope media:readList Tracks
• POST /video-factory/exports/{export_id}/variants · scope media:writeExport VariantsCut the master into per-channel aspects (9:16 social, 1:1 feed, 4:5 portrait feed). Each variant is a real export row: its own QC, its own certificate (same EDL provenance).
• GET /video-factory/exports/{export_id}/video · scope media:readExport Video
• GET /video-factory/exports/{export_id}/withdrawn · scope media:readExport WithdrawnWhether this film contains material somebody has taken back, and what is waiting on a person.
• POST /video-factory/exports/{export_id}/withdrawn-decision · scope media:writeDecideA person decides what happens to a finished film that holds withdrawn material. `destroy` really destroys the film file. `keep` does not un-flag anything - it records that a named person looked at this and chose to keep it, which is a different and more useful fact than the flag quietly disappearing.
• GET /video-factory/exports/{to_export_id}/notes-from/{from_export_id} · scope media:readPreviewWhat the notes on the older cut point at now. Nothing is stored or moved.
• POST /video-factory/exports/{to_export_id}/notes-from/{from_export_id} · scope media:writeIssueKeep the reading, so decisions about individual notes can be recorded against it.
• PATCH /video-factory/footage/{fid} · scope media:writeUpdate Footage
• DELETE /video-factory/footage/{fid} · scope media:writeDelete Footage
• POST /video-factory/footage/{fid}/lipsync · scope media:writeRefuse Footage LipsyncA route that exists in order to refuse, and to say why in full. Returning 404 here would be cheaper and would teach nobody anything. Somebody who tries this is asking a reasonable-sounding question - "can I sync my own footage?" - and deserves the real answer rather than a dead end.
• POST /video-factory/footage/{fid}/transcript · scope media:writeStart Transcript
• GET /video-factory/footage/{fid}/transcript · scope media:readGet Transcript
• PUT /video-factory/footage/{fid}/transcript · scope media:writeSave TranscriptCorrecting a line is what turns a guess into a record. `mark_checked` is the person saying they have actually read it - it is not set for them by editing one segment.
• GET /video-factory/formats · scope media:readFormatsWhich format to pick, and the honest reason for each.
• GET /video-factory/generations/{gen_id} · scope media:readGet Generation
• GET /video-factory/generations/{gen_id}/thumbnail · scope media:readGeneration Thumbnail
• GET /video-factory/generations/{gen_id}/video · scope media:readGeneration Video
• POST /video-factory/generations/{gen_id}:cancel · scope media:writeCancel
• POST /video-factory/generations/{gen_id}:confirm · scope media:writeConfirm
• POST /video-factory/generations/{gen_id}:retry · scope media:writeRetryPlan MVF3 retry/recovery: a retryable or provider-unavailable take goes back to the queue with the SAME declaration (the person already made it) once the engine is reachable.
• POST /video-factory/generations/{gid}/grade · scope media:writeStart GradeBring one shot closer to the rest of the film. Writes a new file; never touches the take.
• POST /video-factory/generations/{gid}/lipsync · scope media:writeStart LipsyncRe-animate the mouth in this take to the lines spoken for its shot.
• GET /video-factory/generations/{gid}/readings · scope media:readShot Readings
• GET /video-factory/grades/{gid}/video · scope media:readGrade Video
• GET /video-factory/handoffs/{hid}/file · scope media:readHandoff File
• GET /video-factory/line-takes/{take_id}/audio · scope media:readTake Audio
• GET /video-factory/lipsync/{lid}/video · scope media:readLipsync Video
• DELETE /video-factory/locks/{lid} · scope media:writeUnlock Route
• GET /video-factory/look-reports/{rid} · scope media:readGet Report
• POST /video-factory/look-reports/{rid}/answer · scope media:writeAnswer"That shot is meant to look different" is the correct answer more often than not.
• GET /video-factory/models · scope media:readList Models
• POST /video-factory/note-carries/{cid}/decide · scope media:writeDecideCarry one note onto the new cut, drop it, or leave it where it was. `carry` writes a NEW comment on the new export rather than moving the old one - the original is what a reviewer actually wrote against a film they actually saw, and rewriting its timecode would make the record of that conversation untrue.
• PUT /video-factory/organizations/{org_id}/machine-rate · scope media:writeSet RateSay what an hour of this machine is worth to you. Optional, and nothing is estimated in its absence. Recorded with a name because a figure that turns up in somebody's budget should be traceable to the person who chose it.
• GET /video-factory/organizations/{org_id}/machine-rate · scope media:readGet Rate
• GET /video-factory/organizations/{org_id}/stranded-projects · scope media:readStrandedWhich of this organisation's films are held by people who have left. The operational question nobody could ask before. Restricted to owners of the organisation: "whose work is stuck" is a management question, and it names departed colleagues.
• GET /video-factory/packages/{pkg_id} · scope media:readGet Package
• GET /video-factory/packages/{pkg_id}/download · scope media:readDownload
• GET /video-factory/projects · scope media:readList Projects
• POST /video-factory/projects · scope media:writeCreate Project
• PUT /video-factory/projects/{pid}/adaptation · scope media:writeSave AdaptationThe person's edit: a new version authored 'human' (or 'mixed' after an AI draft).
• POST /video-factory/projects/{pid}/adaptation:draft · scope media:writeDraft AdaptationLogline + treatment + beat sheet from the ingested source. A new adaptation version; the person edits it freely afterwards.
• POST /video-factory/projects/{pid}/animatic · scope media:writeBuild AnimaticCuts the boarded panels to the planned durations. A shot with no panel becomes a plain card rather than being skipped - the shape of the film depends on that shot taking its time whether or not anybody drew it.
• GET /video-factory/projects/{pid}/animatics · scope media:readList Animatics
• GET /video-factory/projects/{pid}/bible · scope media:readGet Bible
• PUT /video-factory/projects/{pid}/bible · scope media:writeSave BibleApply the change; the impact it had is recorded on the version, not just previewed.
• POST /video-factory/projects/{pid}/bible:impact · scope media:writePreview Bible ImpactWhat this change would touch - BEFORE it propagates (plan 7.2). Read-only.
• POST /video-factory/projects/{pid}/board · scope media:writeDraw Board
• GET /video-factory/projects/{pid}/board · scope media:readGet Board
• POST /video-factory/projects/{pid}/claim · scope media:writeClaimTake custody of a film whose maker has left. Only that - see the refusals.
• GET /video-factory/projects/{pid}/composition · scope media:readCompositionWhat the latest cut actually contains - and therefore what the certificate is allowed to say.
• POST /video-factory/projects/{pid}/conform · scope media:writeRead TimelineRead a timeline that came back from an editor. Nothing is applied - this says what is in it.
• GET /video-factory/projects/{pid}/conforms · scope media:readList Conforms
• GET /video-factory/projects/{pid}/continuity · scope media:readContinuity
• POST /video-factory/projects/{pid}/continuity-review · scope media:writeStart ReviewSamples frames from every rendered take and asks a vision model what it sees. Off the request: three frames a shot on a twenty-shot film is minutes of GPU.
• GET /video-factory/projects/{pid}/continuity-reviews · scope media:readList ReviewsA review a person cannot find again is a review that did not happen. Reloading the page must bring back the findings they had not decided on yet.
• GET /video-factory/projects/{pid}/cost · scope media:readProject CostWhat this film has taken out of the machine.
• GET /video-factory/projects/{pid}/custody · scope media:readCustodyWho controls this film, who made it, and whether either of those is a problem.
• GET /video-factory/projects/{pid}/delivery · scope media:readPreviewThe film against its own script, recomputed now. Nothing is stored.
• POST /video-factory/projects/{pid}/delivery · scope media:writeIssueKeep a dated copy, against the script version it was measured on - so a later rewrite cannot silently invalidate a report somebody has already read and acted on.
• GET /video-factory/projects/{pid}/delivery-reports · scope media:readList Reports
• GET /video-factory/projects/{pid}/entities · scope media:readList Entities
• POST /video-factory/projects/{pid}/entities · scope media:writeAdd Entity
• POST /video-factory/projects/{pid}/entities:extract · scope media:writeExtract EntitiesPull the characters, locations and props out of the source/treatment. Everything lands as DRAFT - a human approves each identity pack (and its rights) before shots may use it.
• GET /video-factory/projects/{pid}/fit · scope media:readGet FitJust the fit report, for the panel that has to show it beside the shot list.
• POST /video-factory/projects/{pid}/footage · scope media:writeIngest FootageBring in a clip somebody actually shot. What ffprobe finds beats what the uploader says, and the rights declaration travels with the file from here to the certificate.
• GET /video-factory/projects/{pid}/footage · scope media:readList Footage
• GET /video-factory/projects/{pid}/grades · scope media:readList Grades
• GET /video-factory/projects/{pid}/graph · scope media:readProduction GraphThe whole graph in one call for the Story step.
• POST /video-factory/projects/{pid}/handover · scope media:writeHandoverGive this film to somebody else. The ordinary path, taken while you are still here.
• GET /video-factory/projects/{pid}/lipsync · scope media:readList Lipsync
• POST /video-factory/projects/{pid}/locks · scope media:writeLock Route
• POST /video-factory/projects/{pid}/look · scope media:writeStart ReportMeasure every shot in the cut and say which ones stand apart from the rest.
• GET /video-factory/projects/{pid}/look-reports · scope media:readList Reports
• GET /video-factory/projects/{pid}/note-carries · scope media:readList Carries
• GET /video-factory/projects/{pid}/parts · scope media:readParts Route
• POST /video-factory/projects/{pid}/parts/{part_id}:ai-edit · scope media:writeAi Edit Route
• GET /video-factory/projects/{pid}/pitch.md · scope media:readPitch PackageThe one-document pitch a human hands to a producer: what it is, what it costs to render, who and what is in it, where the rights stand, and what is still open.
• GET /video-factory/projects/{pid}/plan · scope media:readProduction Plan
• POST /video-factory/projects/{pid}/presence · scope media:writePresence Route
• GET /video-factory/projects/{pid}/scenes · scope media:readList Scenes
• POST /video-factory/projects/{pid}/scenes · scope media:writeAdd Scene
• POST /video-factory/projects/{pid}/scenes:breakdown · scope media:writeBreakdown ScenesTreatment + beats -> the scene list, each naming the entities it uses. Replaces DRAFT scenes only; approved scenes are never overwritten by the assistant.
• GET /video-factory/projects/{pid}/score · scope media:readScore ReportDoes the music fit the film? Analyses the piece the first time it is asked about, and reuses that analysis for every cut afterwards - the phrase boundaries belong to the piece, not the cut.
• POST /video-factory/projects/{pid}/score:listen · scope media:writeListenListen to the piece on this project's cut and find where it can end.
• POST /video-factory/projects/{pid}/source:ingest · scope media:writeIngest SourceBring the source in behind the rights gate. A Publishers manuscript must be confirmed owned/licensed there, or the person declares the adaptation right here - either way the declaration is stored verbatim and quoted by the certificate.
• POST /video-factory/projects/{pid}/speak · scope media:writeSpeak LinesSay every line in the script, in the voice cast for its speaker.
• GET /video-factory/projects/{pid}/speech · scope media:readGet SpeechEvery line take, and the fit report - which is the part worth reading.
• POST /video-factory/projects/{pid}/suggestions · scope media:writeSuggest Route
• GET /video-factory/projects/{pid}/voices · scope media:readGet CastWho speaks in this film, who is cast, and who has nobody.
• POST /video-factory/projects/{pid}/voices · scope media:writeCast Voice
• POST /video-factory/projects/{pid}/voices-reconfirmed · scope media:writeReconfirm VoicesSay, by name, that you have checked the people who lent their voices still agree. A name and not a checkbox, for the same reason a subtitle track records who read it through: a box that somebody ticked is not a claim anybody made, and this one is about a real person's voice.
• GET /video-factory/projects/{project_id} · scope media:readGet Project
• DELETE /video-factory/projects/{project_id} · scope media:writeDelete Project
• POST /video-factory/projects/{project_id}/approvals · scope media:writeRequest Approval
• POST /video-factory/projects/{project_id}/brief · scope media:writeSave Brief
• POST /video-factory/projects/{project_id}/collaborators · scope media:writeAdd Collaborator
• GET /video-factory/projects/{project_id}/comments · scope media:readList Comments
• POST /video-factory/projects/{project_id}/comments · scope media:writeAdd Comment
• POST /video-factory/projects/{project_id}/cuts · scope media:writeSave Cut
• POST /video-factory/projects/{project_id}/cuts:auto · scope media:writeAuto CutA first cut from the approved (or latest ready) take of every shot, in shot order.
• POST /video-factory/projects/{project_id}/description:compile · scope media:writeCompile Description
• POST /video-factory/projects/{project_id}/generations:estimate · scope media:writeEstimate
• POST /video-factory/projects/{project_id}/moment:compile · scope media:writeCompile Moment
• POST /video-factory/projects/{project_id}/script · scope media:writeSave Script
• POST /video-factory/projects/{project_id}/script:draft · scope media:writeDraft Script
• POST /video-factory/projects/{project_id}/share-links · scope media:writeCreate Share Link
• GET /video-factory/projects/{project_id}/sharing · scope media:readGet Sharing
• PATCH /video-factory/projects/{project_id}/sharing · scope media:writePatch Sharing
• POST /video-factory/projects/{project_id}/shots · scope media:writeAdd Shot
• POST /video-factory/projects/{project_id}/shots:plan · scope media:writePlan ShotsScript -> shot list with contracts. Replaces PLANNED shots that have no takes yet; shots that already rendered are kept (the person's work is never thrown away by a re-plan).
• POST /video-factory/projects/{project_id}:recover · scope media:writeRecoverPlan MVF3 recovery. For every take of this project that an interrupted process left in preparing / generating / post_processing: if ComfyUI still has the job, leave it (the person can wait or cancel); if ComfyUI finished it and still holds the output, collect it; otherwise mark it failed_retryable with the reason, so Retry re-queues it under the same declaration.
• POST /video-factory/projects/{project_id}:restore · scope media:writeRestore Project
• POST /video-factory/projects/{project_id}:score-in-song-factory · scope media:writeScore In Song FactoryOpens a Song Factory project whose brief carries this video's music intent and whose video reference is the review export (SF6 measures cuts/energy and the Studio gets hit points).
• POST /video-factory/projects/{project_id}:takedown · scope media:writeTakedown Project
• GET /video-factory/queue · scope media:readRead QueueWhat the machine is doing, and where your work sits in it. Your own jobs come back in full. Everything else is a COUNT - how many are ahead of you is a number you need; whose they are and what they are for is not.
• GET /video-factory/queue/history · scope media:readRead HistoryYour own finished jobs, with what they really cost.
• GET /video-factory/queue/machine · scope media:readRead MachineThe card itself, and what each kind of work has really cost on it. Every number here is about the MACHINE, not about this caller - which is why it reads nothing tenant-scoped. Authentication is still required: what the Forge is holding and how long a render takes on it is not a public fact.
• POST /video-factory/queue/{jid}/cancel · scope media:writeCancelLeave the line. A running job is not stopped from here - see the note.
• POST /video-factory/reports · scope media:writeFile Report
• GET /video-factory/reports · scope media:readList Reports
• PATCH /video-factory/reports/{report_id} · scope media:writePatch Report
• PATCH /video-factory/scenes/{sid} · scope media:writePatch Scene
• DELETE /video-factory/scenes/{sid} · scope media:writeDelete Scene
• GET /video-factory/search · scope media:readDo SearchFind a film by something inside it.
• GET /video-factory/search/recent · scope media:readRecentYour own recent searches, and how long the live scan really took. The timing is the point: it is the number that will one day decide whether a pre-built index is worth the staleness it brings, and it should be measured by then rather than argued about.
• DELETE /video-factory/share-links/{link_id} · scope media:writeRevoke Share Link
• GET /video-factory/shared-with-me · scope media:readShared With Me
• GET /video-factory/shot-readings/{reading_id}/frame · scope media:readReading FrameThe frame a finding came from. Without this route the report can say "check it yourself" and then give a person no way to look, which is worse than saying nothing.
• PATCH /video-factory/shots/{shot_id} · scope media:writePatch Shot
• DELETE /video-factory/shots/{shot_id} · scope media:writeDelete Shot
• POST /video-factory/shots/{shot_id}/scene · scope media:writeAttach Shot To SceneComplete the graph: shot -> scene (and so -> entities, beats, source).
• GET /video-factory/storage · scope media:readAuditWhat is really on the disk, what nothing points at, and what points at nothing.
• GET /video-factory/storage/audits · scope media:readList Audits
• POST /video-factory/storage/mark-ghosts · scope media:writeMark GhostsMake the rows tell the truth. Marks; never deletes. Only exports, generations and (since 567) voice takes carry a status this can be said in. The rest are reported and left exactly as they are: inventing a state on a table to record a fact about the disk would be a worse lie than the broken link. Voice takes were added because for them the broken link WAS the worse lie - a 'ready' take is what ev…
• POST /video-factory/storage/sweep · scope media:writeSweepDelete the orphans, and only the orphans. `confirm_bytes` has to match what the audit said it would free. If the disk changed between looking and deciding, this refuses - somebody agreeing to free 40 MB has not agreed to free 4 GB, and a delete that silently took more than was shown would be unrecoverable.
• GET /video-factory/subtitles/{tid} · scope media:readGet Track
• POST /video-factory/subtitles/{tid}/reviewed · scope media:writeMark ReviewedRecord that somebody who speaks the language has been through it. Machine output and reviewed output are different things, and a track that cannot tell them apart will eventually be shipped as though a person had checked it.
• GET /video-factory/subtitles/{tid}/vtt · scope media:readTrack Vtt
• POST /video-factory/suggestions/{sid}:accept · scope media:writeAccept Route
• POST /video-factory/suggestions/{sid}:reject · scope media:writeReject Route
• DELETE /video-factory/voices/{cast_id} · scope media:writeUncast
• GET /video-factory/withdrawals/{wid} · scope media:readGet Withdrawal