Field guide / Inventory APIReviewable source / main

Inventory API

Inventory coverage and hygiene: coverage summaries, OS baseline compliance, ownership-risk reads, and reconciliation.

8 routes

Response metadata: x-api-version, x-request-id, and traceresponse apply to normal routed responses and are omitted from the per-operation header tables below.

GET`/api/inventory/coverage-contract`

request access

Inventory coverage.

Permissions

Access class	Credential	Scoping
`request`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/inventory/coverage-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`domains`	`array<JSON value>`	Required	Value of `domains` returned in the response body.
`freshnessStates`	`array<JSON value>`	Required	Value of `freshnessStates` returned in the response body.
`gapTypes`	`array<JSON value>`	Required	Value of `gapTypes` returned in the response body.
`driftSignals`	`array<JSON value>`	Required	Value of `driftSignals` returned in the response body.
`evidence`	`array<JSON value>`	Required	Value of `evidence` returned in the response body.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/inventory/coverage-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "domains": [],
  "freshnessStates": [],
  "gapTypes": [],
  "driftSignals": [],
  "evidence": []
}

GET`/api/inventory/coverage/local/summary`

audit access

Inventory coverage local.

Permissions

Access class	Credential	Scoping
`audit`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/inventory/coverage/local/summary

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`coverage`	`string`	Required	Value of `coverage` returned in the response body.
`domains`	`array<JSON value>`	Required	Value of `domains` returned in the response body.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/inventory/coverage/local/summary'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "coverage": "<string>",
  "domains": [],
  "providerCallsEnabled": false
}

GET`/api/inventory/os-baseline-compliance-contract`

request access

Inventory os baseline.

Permissions

Access class	Credential	Scoping
`request`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/inventory/os-baseline-compliance-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`osFamilies`	`array<JSON value>`	Required	Value of `osFamilies` returned in the response body.
`domains`	`array<JSON value>`	Required	Value of `domains` returned in the response body.
`driftSignals`	`array<JSON value>`	Required	Value of `driftSignals` returned in the response body.
`requiredGuards`	`array<JSON value>`	Required	Value of `requiredGuards` returned in the response body.
`planSections`	`array<JSON value>`	Required	Value of `planSections` returned in the response body.
`blockedReasons`	`array<JSON value>`	Required	Value of `blockedReasons` returned in the response body.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/inventory/os-baseline-compliance-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "osFamilies": [],
  "domains": [],
  "driftSignals": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": []
}

GET`/api/inventory/ownership-risk-contract`

request access

Inventory ownership risk.

Permissions

Access class	Credential	Scoping
`request`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/inventory/ownership-risk-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`riskDomains`	`array<JSON value>`	Required	Value of `riskDomains` returned in the response body.
`scoreSignals`	`array<JSON value>`	Required	Value of `scoreSignals` returned in the response body.
`riskBands`	`array<JSON value>`	Required	Value of `riskBands` returned in the response body.
`timelineEvents`	`array<JSON value>`	Required	Value of `timelineEvents` returned in the response body.
`requiredGuards`	`array<JSON value>`	Required	Value of `requiredGuards` returned in the response body.
`blockedReasons`	`array<JSON value>`	Required	Value of `blockedReasons` returned in the response body.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/inventory/ownership-risk-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "riskDomains": [],
  "scoreSignals": [],
  "riskBands": [],
  "timelineEvents": [],
  "requiredGuards": [],
  "blockedReasons": []
}

GET`/api/inventory/ownership-risks`

audit access

Inventory ownership risks.

Permissions

Access class	Credential	Scoping
`audit`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/inventory/ownership-risks

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/inventory/ownership-risks'

POST`/api/inventory/reconcile`

execute access

Inventory run reconciliation.

Permissions

Access class	Credential	Scoping
`execute`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

POST https://<your-host>/api/inventory/reconcile

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`Idempotency-Key`	`string`	Optional	Optional at-most-once retry key for human mutations. When omitted, the idempotency middleware passes the request through without deduplication.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/inventory/reconcile'

GET`/api/inventory/resource-overview-contract`

request access

Inventory resource overview.

Permissions

Access class	Credential	Scoping
`request`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/inventory/resource-overview-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Value`

`200` response body

Structure: Value.

Name	Type	Requirement	Description
`source`	`string`	Required	Origin or authority of the returned data.
`providerCallsEnabled`	`boolean`	Required	Value of `providerCallsEnabled` returned in the response body.
`resourceTypes`	`array<JSON value>`	Required	Value of `resourceTypes` returned in the response body.
`statusSignals`	`array<JSON value>`	Required	Value of `statusSignals` returned in the response body.
`views`	`array<JSON value>`	Required	Value of `views` returned in the response body.
`requiredGuards`	`array<JSON value>`	Required	Value of `requiredGuards` returned in the response body.
`blockedReasons`	`array<JSON value>`	Required	Value of `blockedReasons` returned in the response body.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/inventory/resource-overview-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "resourceTypes": [],
  "statusSignals": [],
  "views": [],
  "requiredGuards": [],
  "blockedReasons": []
}

POST`/api/inventory/sync`

execute access

Inventory run sync.

Permissions

Access class	Credential	Scoping
`execute`	An authenticated session or API bearer token is required.	The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

POST https://<your-host>/api/inventory/sync

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Name	Type	Requirement	Description
`Authorization`	`string`	Optional	Human credential alternative: supply one `Bearer rys_...` session token, `ryk_...` API token, or validated identity-provider JWT here. Do not combine it with `X-Ryuki-Session-Id` or the session cookie; conflicting carriers fail closed.
`X-Ryuki-Session-Id`	`string`	Optional	Opaque `rys_...` session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
`Idempotency-Key`	`string`	Optional	Optional at-most-once retry key for human mutations. When omitted, the idempotency middleware passes the request through without deduplication.
`traceparent`	`string`	Optional	Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

Status	Description	Body
`200`	OK	`Vec<ryuki_engine::models::InventoryItem>`

For 200, the known response body type is Vec<ryuki_engine::models::InventoryItem>. Its field schema is unavailable, so no JSON shape is inferred.

Errors

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/inventory/sync'

Last updated 2026-07-16 · Generated from the API route registrations.

Inventory API

GET/api/inventory/coverage-contract

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET/api/inventory/coverage/local/summary

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET/api/inventory/os-baseline-compliance-contract

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET/api/inventory/ownership-risk-contract

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

200 response body

Errors

Examples

Request

Schematic response body

GET/api/inventory/ownership-risks

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

Errors

Examples

Request

POST/api/inventory/reconcile

Permissions

HTTP request

Path parameters

Query parameters

Request headers

Request body

Response

Errors

Examples

Request

GET/api/inventory/resource-overview-contract

Permissions

HTTP request

Path parameters

Query parameters

GET`/api/inventory/coverage-contract`

`200` response body

GET`/api/inventory/coverage/local/summary`

`200` response body

GET`/api/inventory/os-baseline-compliance-contract`

`200` response body

GET`/api/inventory/ownership-risk-contract`

`200` response body

GET`/api/inventory/ownership-risks`

POST`/api/inventory/reconcile`

GET`/api/inventory/resource-overview-contract`

`200` response body

POST`/api/inventory/sync`