Catalog API

GET/api/catalog/access-control

audit access

Catalog access control.

Permissions

HTTP request

GET https://<your-host>/api/catalog/access-control

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/access-control'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "configuredForProduction": false,
  "entraGroupsConfigured": false,
  "requiredProductionProvider": "<string>",
  "actions": [],
  "capabilityPolicy": "<string>",
  "roles": null,
  "executionGuards": []
}

GET/api/catalog/approval-routes

request access

Catalog approval routes.

Permissions

HTTP request

GET https://<your-host>/api/catalog/approval-routes

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/approval-routes'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "configuredForProduction": false,
  "routes": []
}

GET/api/catalog/categories

request access

Catalog categories.

Permissions

HTTP request

GET https://<your-host>/api/catalog/categories

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/categories'

GET/api/catalog/evidence-manifest

audit access

Catalog evidence manifest.

Permissions

HTTP request

GET https://<your-host>/api/catalog/evidence-manifest

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/evidence-manifest'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "recordTypes": [],
  "prohibitedContent": [],
  "redactionStates": [],
  "exportReadiness": [],
  "requiredManifestFields": [],
  "requiredChecks": [],
  "safeExportTargets": [],
  "retentionClasses": [],
  "requiredEvidence": [],
  "blockedReasons": []
}

GET/api/catalog/evidence-redaction-contract

request access

Catalog evidence redaction.

Permissions

HTTP request

GET https://<your-host>/api/catalog/evidence-redaction-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/evidence-redaction-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "redactionMode": "<string>",
  "noSecretScanRequired": false,
  "providerSummaryOnly": false,
  "stackTraceSuppression": false,
  "identifierRedaction": false,
  "privateNetworkRedaction": false,
  "logLineFiltering": false,
  "exportReadinessGate": false,
  "safeExportTargets": [],
  "redactionStates": [],
  "exportReadiness": [],
  "prohibitedContent": [],
  "requiredChecks": [],
  "retentionClasses": [],
  "blockedReasons": [],
  "requiredEvidence": []
}

GET/api/catalog/offerings-contract

request access

Catalog offerings.

Permissions

HTTP request

GET https://<your-host>/api/catalog/offerings-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/offerings-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "catalogMode": "<string>",
  "catalogReadOnly": false,
  "providerCallsAllowed": false,
  "workflowMutationAllowed": false,
  "liveRequestCreationAllowed": false,
  "liveApprovalExecutionAllowed": false,
  "liveExecutionAllowed": false,
  "rawRequestPayloadsAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "rawLogContentAllowed": false,
  "rawRowsAllowed": false,
  "rawRecipientDataAllowed": false,
  "credentialValuesAllowed": false,
  "tenantIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "privateNetworkValuesAllowed": false,
  "categories": null,
  "offerings": []
}

GET/api/catalog/policy-guardrails

request access

The REAL parsed guardrail rules from the policy engine (catalog/policy-guardrails.yaml), evaluable per request via /api/requests/{id}/policy-eval.

Distinct from the -contract descriptor above, which is a static readiness disclaimer.

Permissions

HTTP request

GET https://<your-host>/api/catalog/policy-guardrails

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/policy-guardrails'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "version": null,
  "status": null,
  "ruleCount": null,
  "rules": null
}

GET/api/catalog/policy-guardrails-contract

request access

Catalog policy guardrails.

Permissions

HTTP request

GET https://<your-host>/api/catalog/policy-guardrails-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/policy-guardrails-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "evaluationMode": "<string>",
  "providerCallsEnabled": false,
  "livePolicyEvaluationAllowed": false,
  "liveProviderValidationAllowed": false,
  "requestPayloadEvaluationAllowed": false,
  "policyMutationAllowed": false,
  "rawRequestPayloadsAllowed": false,
  "rawPolicyInputsAllowed": false,
  "tenantIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "privateNetworkValuesAllowed": false,
  "credentialValuesAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "policyFamilies": [],
  "priorities": [],
  "decisions": [],
  "ruleIds": [],
  "requiredGuards": [],
  "blockedReasons": [],
  "requiredEvidence": [],
  "rules": []
}

GET/api/catalog/recommendations-contract

request access

Catalog recommendations.

Permissions

HTTP request

GET https://<your-host>/api/catalog/recommendations-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/recommendations-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "recommendationMode": "<string>",
  "recommendationsReadOnly": false,
  "roleDefaultsReadOnly": false,
  "siteDefaultsReadOnly": false,
  "evidenceReferencesReadOnly": false,
  "livePersonalizationAllowed": false,
  "liveCatalogQueryAllowed": false,
  "liveRequestCreationAllowed": false,
  "workflowMutationAllowed": false,
  "providerCallsAllowed": false,
  "identityLookupAllowed": false,
  "rawUserDataAllowed": false,
  "rawApplicationDataAllowed": false,
  "rawSiteDataAllowed": false,
  "rawRequestPayloadsAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "rawRecipientDataAllowed": false,
  "credentialValuesAllowed": false,
  "tokenValuesAllowed": false,
  "tenantIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "principalIdentifiersAllowed": false,
  "privateNetworkValuesAllowed": false,
  "recommendedOfferingIds": [],
  "recommendationDimensions": [],
  "recommendationSignals": [],
  "recommendationViews": [],
  "requiredGuards": [],
  "blockedReasons": [],
  "requiredEvidence": [],
  "rules": []
}

GET/api/catalog/request-form-contract

request access

Catalog request form.

Permissions

HTTP request

GET https://<your-host>/api/catalog/request-form-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/request-form-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "formMode": "<string>",
  "formSchemaReadOnly": false,
  "schemaDerivedFromOfferings": false,
  "liveRequestCreationAllowed": false,
  "formSubmissionAllowed": false,
  "approvalExecutionAllowed": false,
  "workflowMutationAllowed": false,
  "providerCallsAllowed": false,
  "rawRequestPayloadsAllowed": false,
  "rawFormSubmissionsAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "rawLogContentAllowed": false,
  "rawRowsAllowed": false,
  "rawRecipientDataAllowed": false,
  "credentialValuesAllowed": false,
  "tenantIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "privateNetworkValuesAllowed": false,
  "formSections": [],
  "inputKinds": [],
  "requiredInputNames": [],
  "offeringForms": [],
  "rules": []
}

GET/api/catalog/secret-references

audit access

Catalog secret references.

Permissions

HTTP request

GET https://<your-host>/api/catalog/secret-references

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/secret-references'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerModel": "<string>",
  "managementInterface": "<string>",
  "fallbackPolicy": "<string>",
  "admittedProviderClasses": [],
  "capabilityInterfaces": [],
  "providerCallsEnabled": false,
  "secretValuesAllowed": false,
  "configuredForProduction": false,
  "secretReferenceKinds": [],
  "readinessStates": [],
  "rotationPolicies": []
}

GET/api/catalog/site-catalog-contract

request access

Catalog site catalog.

Permissions

HTTP request

GET https://<your-host>/api/catalog/site-catalog-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/catalog/site-catalog-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "catalogMode": "<string>",
  "domain": "<string>",
  "ouPattern": "<string>",
  "network": "<string>",
  "organization": "<string>",
  "safeXmlFactsOnly": false,
  "providerCallsAllowed": false,
  "liveValidationAllowed": false,
  "xmlParsingAllowed": false,
  "workflowMutationAllowed": false,
  "rawXmlAllowed": false,
  "encryptedValuesAllowed": false,
  "passwordValuesAllowed": false,
  "credentialIdentifiersAllowed": false,
  "tenantIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "privateNetworkValuesAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "rawSiteInventoryRowsAllowed": false,
  "rawRecipientDataAllowed": false,
  "windowsBehavior": [],
  "sites": [],
  "requiredEvidence": []
}