# Platform, credentials and webhooks

Paths on this page are relative to <code>/api/liquidity-studio/v2</code>. Authentication and required headers vary by operation.

[API reference overview](/api-reference/overview/) · [OpenAPI download](/openapi/liquidity-operating-system-v2.openapi.json)

## Operations on this page

| Method | Path | Operation |
| --- | --- | --- |
| <code>GET</code> | <code>/public/plans</code> | [listWorkspacePlans](#listWorkspacePlans) |
| <code>GET</code> | <code>/public/acp/offering</code> | [getPublicAcpOffering](#getPublicAcpOffering) |
| <code>GET</code> | <code>/developer-credentials</code> | [listDeveloperCredentials](#listDeveloperCredentials) |
| <code>POST</code> | <code>/developer-credentials</code> | [createDeveloperCredentials](#createDeveloperCredentials) |
| <code>GET</code> | <code>/developer-credentials/{id}</code> | [getDeveloperCredentials](#getDeveloperCredentials) |
| <code>PATCH</code> | <code>/developer-credentials/{id}</code> | [supersedeDeveloperCredentials](#supersedeDeveloperCredentials) |
| <code>GET</code> | <code>/webhooks</code> | [listWebhooks](#listWebhooks) |
| <code>POST</code> | <code>/webhooks</code> | [createWebhooks](#createWebhooks) |
| <code>GET</code> | <code>/webhooks/{id}</code> | [getWebhooks](#getWebhooks) |
| <code>PATCH</code> | <code>/webhooks/{id}</code> | [supersedeWebhooks](#supersedeWebhooks) |
| <code>GET</code> | <code>/openapi.json</code> | [getOperatingSystemOpenApi](#getOperatingSystemOpenApi) |
| <code>GET</code> | <code>/status</code> | [getOperatingSystemStatus](#getOperatingSystemStatus) |
| <code>POST</code> | <code>/oauth/token</code> | [issueOperatingSystemOAuthToken](#issueOperatingSystemOAuthToken) |
| <code>GET</code> | <code>/workspace</code> | [getOperatingSystemWorkspace](#getOperatingSystemWorkspace) |
| <code>GET</code> | <code>/providers</code> | [listOperatingSystemProviders](#listOperatingSystemProviders) |
| <code>POST</code> | <code>/providers</code> | [putOperatingSystemProvider](#putOperatingSystemProvider) |
| <code>GET</code> | <code>/artifacts</code> | [listOperatingSystemArtifacts](#listOperatingSystemArtifacts) |
| <code>POST</code> | <code>/developer-credentials/{id}/rotate</code> | [rotateDeveloperCredential](#rotateDeveloperCredential) |
| <code>GET</code> | <code>/jobs</code> | [listOperatingSystemJobs](#listOperatingSystemJobs) |
| <code>GET</code> | <code>/public/brands/current</code> | [getVerifiedHostBrand](#getVerifiedHostBrand) |
| <code>GET</code> | <code>/public/partner-brand/logo/{contentHash}</code> | [getVerifiedPartnerBrandLogo](#getVerifiedPartnerBrandLogo) |

<a id="listWorkspacePlans"></a>

## Inspect configured workspace plan previews without a login or payment

`GET /public/plans`

Operation ID: <code>listWorkspacePlans</code>

**Authentication:** No authentication is required by this operation’s contract.

Read-only public terms, separate from vault billing. Missing or expired configuration returns NOT_CONFIGURED with no plans or version. PREVIEW requires a nonexpired timestamp, version and 1–12 unique plans. Does not create orders, accept terms, start checkout, establish allowances or grant financial authority. No deployment prices are assumed.

This operation declares no parameters.

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Current read-only catalog or explicit unconfigured state. | <code>application/json</code>: <code>object</code> |
| <code>429</code> | Public request limit exceeded. | <code>application/json</code>: <code>object</code> |

**<code>200</code> response headers**

| Header | Required | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>Cache-Control</code> | Yes | Constant <code>no-store</code> | — |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | [WorkspacePlanCatalog](/api-reference/schemas/workspace-plan-catalog/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

**<code>429</code> response headers**

| Header | Required | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>Cache-Control</code> | Yes | Constant <code>no-store</code> | — |
| <code>Retry-After</code> | Yes | <code>string</code> | Pattern: <code>^&#91;0-9&#93;+$</code> |

**<code>429</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>error</code> | Yes | <code>object</code> | Additional properties rejected |
| <code>error.code</code> | Yes | Constant <code>PUBLIC&#95;PLANS&#95;BUSY</code> | — |
| <code>error.message</code> | Yes | <code>string</code> | — |
| <code>error.retryable</code> | Yes | Constant <code>true</code> | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="getPublicAcpOffering"></a>

## Inspect the configured ACP public-analysis offering without a login or payment

`GET /public/acp/offering`

Operation ID: <code>getPublicAcpOffering</code>

**Authentication:** No authentication is required by this operation’s contract.

Deployment-owned, read-only offering preview. Missing or expired configuration returns NOT_CONFIGURED with null offering, catalogVersion and validUntil. PREVIEW requires a nonexpired timestamp, version and one public-only offering. No purchase, job, escrow, settlement, fund transfer, private tenant access or financial authority is created. No deployment price or SLA is assumed.

This operation declares no parameters.

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Current read-only offering preview or explicit unconfigured state. | <code>application/json</code>: <code>object</code> |
| <code>429</code> | Public request limit exceeded. | <code>application/json</code>: <code>object</code> |

**<code>200</code> response headers**

| Header | Required | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>Cache-Control</code> | Yes | Constant <code>no-store</code> | — |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | [AcpOfferingPreview](/api-reference/schemas/acp-offering-preview/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

**<code>429</code> response headers**

| Header | Required | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>Cache-Control</code> | Yes | Constant <code>no-store</code> | — |
| <code>Retry-After</code> | Yes | <code>string</code> | Pattern: <code>^&#91;0-9&#93;+$</code> |

**<code>429</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>error</code> | Yes | <code>object</code> | Additional properties rejected |
| <code>error.code</code> | Yes | Constant <code>PUBLIC&#95;ACP&#95;OFFERING&#95;BUSY</code> | — |
| <code>error.message</code> | Yes | <code>string</code> | — |
| <code>error.retryable</code> | Yes | Constant <code>true</code> | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="listDeveloperCredentials"></a>

## List developer credentials

`GET /developer-credentials`

Operation ID: <code>listDeveloperCredentials</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |
| <code>cursor</code> | query | No | <code>string</code> | Opaque cursor returned in the previous response metadata. |
| <code>limit</code> | query | No | <code>integer</code> | Default: <code>50</code>; Minimum: <code>1</code>; Maximum: <code>100</code> |

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Latest tenant-isolated aggregate versions | <code>application/json</code>: <code>object</code> |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | Array of All of: [RecordEnvelope](/api-reference/schemas/record-envelope/); <code>object</code> | — |
| <code>data&#91;&#93;.allOf&#91;2&#93;.payload</code> | Yes | [DeveloperCredential](/api-reference/schemas/developer-credential/) | — |
| <code>meta</code> | Yes | <code>object</code> | Additional properties rejected |
| <code>meta.count</code> | Yes | <code>integer</code> | Minimum: <code>0</code> |
| <code>meta.hasMore</code> | Yes | <code>boolean</code> | — |
| <code>meta.nextCursor</code> | No | <code>string</code> | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="createDeveloperCredentials"></a>

## Create a hashed developer credential and return its secret once

`POST /developer-credentials`

Operation ID: <code>createDeveloperCredentials</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>Idempotency-Key</code> | header | Yes | <code>string</code> | Min length: <code>8</code>; Max length: <code>160</code> |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |

### Request body

Required: **yes**.

**<code>application/json</code>**

[DeveloperCredentialRequest](/api-reference/schemas/developer-credential-request/)

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>201</code> | Secret returned once; durable idempotency state contains only resource metadata | <code>application/json</code>: <code>object</code> |
| <code>409</code> | Identical retry cannot replay the already-returned secret | No response body declared |

**<code>201</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | <code>object</code> | Additional properties rejected |
| <code>data.credential</code> | Yes | All of: [RecordEnvelope](/api-reference/schemas/record-envelope/); <code>object</code> | — |
| <code>data.credential.allOf&#91;2&#93;.payload</code> | Yes | [DeveloperCredential](/api-reference/schemas/developer-credential/) | — |
| <code>data.secret</code> | Yes | <code>string</code> | — |
| <code>data.secretReturnedOnce</code> | Yes | Constant <code>true</code> | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="getDeveloperCredentials"></a>

## Get one developer credentials aggregate

`GET /developer-credentials/{id}`

Operation ID: <code>getDeveloperCredentials</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |
| <code>id</code> | path | Yes | <code>string</code> | — |

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Current immutable aggregate version | <code>application/json</code>: <code>object</code> |
| <code>404</code> | Not found | No response body declared |

**<code>200</code> response headers**

| Header | Required | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>ETag</code> | Yes | <code>string</code> | — |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | All of: [RecordEnvelope](/api-reference/schemas/record-envelope/); <code>object</code> | — |
| <code>data.allOf&#91;2&#93;.payload</code> | Yes | [DeveloperCredential](/api-reference/schemas/developer-credential/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="supersedeDeveloperCredentials"></a>

## Immediately revoke a developer credential

`PATCH /developer-credentials/{id}`

Operation ID: <code>supersedeDeveloperCredentials</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>Idempotency-Key</code> | header | Yes | <code>string</code> | Min length: <code>8</code>; Max length: <code>160</code> |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |
| <code>If-Match</code> | header | Yes | <code>string</code> | — |
| <code>id</code> | path | Yes | <code>string</code> | — |

### Request body

Required: **yes**.

**<code>application/json</code>**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>status</code> | No | <code>string</code> | Allowed: <code>REVOKED</code> |
| <code>evidenceHashes</code> | No | Array of [Hash](/api-reference/schemas/hash/) | Max items: <code>256</code> |
| <code>reason</code> | Yes | <code>string</code> | Min length: <code>3</code>; Max length: <code>500</code> |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Append-only bounded supersession accepted with deterministic evidence | <code>application/json</code>: <code>object</code> |
| <code>400</code> | Payload or safety transition is outside this bounded operation | No response body declared |
| <code>409</code> | Typed authority workflow is required | No response body declared |
| <code>412</code> | Strong precondition failed | No response body declared |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | All of: [RecordEnvelope](/api-reference/schemas/record-envelope/); <code>object</code> | — |
| <code>data.allOf&#91;2&#93;.payload</code> | Yes | [DeveloperCredential](/api-reference/schemas/developer-credential/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="listWebhooks"></a>

## List webhook subscriptions

`GET /webhooks`

Operation ID: <code>listWebhooks</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>) **OR** OAuth bearer token with <code>webhooks:manage</code> (<code>serviceCredential</code>)

**Service scope:** <code>webhooks:manage</code>. Session access and workspace roles are evaluated separately.

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |
| <code>cursor</code> | query | No | <code>string</code> | Opaque cursor returned in the previous response metadata. |
| <code>limit</code> | query | No | <code>integer</code> | Default: <code>50</code>; Minimum: <code>1</code>; Maximum: <code>100</code> |

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Latest tenant-isolated aggregate versions | <code>application/json</code>: <code>object</code> |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | Array of All of: [RecordEnvelope](/api-reference/schemas/record-envelope/); <code>object</code> | — |
| <code>data&#91;&#93;.allOf&#91;2&#93;.payload</code> | Yes | [WebhookSubscription](/api-reference/schemas/webhook-subscription/) | — |
| <code>meta</code> | Yes | <code>object</code> | Additional properties rejected |
| <code>meta.count</code> | Yes | <code>integer</code> | Minimum: <code>0</code> |
| <code>meta.hasMore</code> | Yes | <code>boolean</code> | — |
| <code>meta.nextCursor</code> | No | <code>string</code> | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="createWebhooks"></a>

## Create a signed webhook and return its signing secret once

`POST /webhooks`

Operation ID: <code>createWebhooks</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>) **OR** OAuth bearer token with <code>webhooks:manage</code> (<code>serviceCredential</code>)

**Service scope:** <code>webhooks:manage</code>. Session access and workspace roles are evaluated separately.

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>Idempotency-Key</code> | header | Yes | <code>string</code> | Min length: <code>8</code>; Max length: <code>160</code> |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |

### Request body

Required: **yes**.

**<code>application/json</code>**

[WebhookRequest](/api-reference/schemas/webhook-request/)

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>201</code> | Signing secret returned once; durable idempotency state contains only resource metadata | <code>application/json</code>: <code>object</code> |
| <code>409</code> | Identical retry cannot replay the already-returned signing secret | No response body declared |

**<code>201</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | <code>object</code> | Additional properties rejected |
| <code>data.subscription</code> | Yes | All of: [RecordEnvelope](/api-reference/schemas/record-envelope/); <code>object</code> | — |
| <code>data.subscription.allOf&#91;2&#93;.payload</code> | Yes | [WebhookSubscription](/api-reference/schemas/webhook-subscription/) | — |
| <code>data.signingSecret</code> | Yes | <code>string</code> | — |
| <code>data.signatureInput</code> | Yes | Constant <code>timestamp.deliveryId.body</code> | — |
| <code>data.secretReturnedOnce</code> | Yes | Constant <code>true</code> | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="getWebhooks"></a>

## Get one webhook subscriptions aggregate

`GET /webhooks/{id}`

Operation ID: <code>getWebhooks</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>) **OR** OAuth bearer token with <code>webhooks:manage</code> (<code>serviceCredential</code>)

**Service scope:** <code>webhooks:manage</code>. Session access and workspace roles are evaluated separately.

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |
| <code>id</code> | path | Yes | <code>string</code> | — |

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Current immutable aggregate version | <code>application/json</code>: <code>object</code> |
| <code>404</code> | Not found | No response body declared |

**<code>200</code> response headers**

| Header | Required | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>ETag</code> | Yes | <code>string</code> | — |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | All of: [RecordEnvelope](/api-reference/schemas/record-envelope/); <code>object</code> | — |
| <code>data.allOf&#91;2&#93;.payload</code> | Yes | [WebhookSubscription](/api-reference/schemas/webhook-subscription/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="supersedeWebhooks"></a>

## Immediately pause or revoke a webhook subscription

`PATCH /webhooks/{id}`

Operation ID: <code>supersedeWebhooks</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>Idempotency-Key</code> | header | Yes | <code>string</code> | Min length: <code>8</code>; Max length: <code>160</code> |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |
| <code>If-Match</code> | header | Yes | <code>string</code> | — |
| <code>id</code> | path | Yes | <code>string</code> | — |

### Request body

Required: **yes**.

**<code>application/json</code>**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>status</code> | No | <code>string</code> | Allowed: <code>PAUSED</code>, <code>REVOKED</code> |
| <code>evidenceHashes</code> | No | Array of [Hash](/api-reference/schemas/hash/) | Max items: <code>256</code> |
| <code>reason</code> | Yes | <code>string</code> | Min length: <code>3</code>; Max length: <code>500</code> |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Append-only bounded supersession accepted with deterministic evidence | <code>application/json</code>: <code>object</code> |
| <code>400</code> | Payload or safety transition is outside this bounded operation | No response body declared |
| <code>409</code> | Typed authority workflow is required | No response body declared |
| <code>412</code> | Strong precondition failed | No response body declared |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | All of: [RecordEnvelope](/api-reference/schemas/record-envelope/); <code>object</code> | — |
| <code>data.allOf&#91;2&#93;.payload</code> | Yes | [WebhookSubscription](/api-reference/schemas/webhook-subscription/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="getOperatingSystemOpenApi"></a>

## Download the checked-in v2 OpenAPI contract

`GET /openapi.json`

Operation ID: <code>getOperatingSystemOpenApi</code>

**Authentication:** No authentication requirement is declared in this OpenAPI operation. Consult the access guide and deployed service configuration.

This operation declares no parameters.

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | OpenAPI 3.1 contract | <code>application/json</code>: [OpenApiDocument](/api-reference/schemas/open-api-document/) |

<a id="getOperatingSystemStatus"></a>

## Read fail-closed v2 service readiness

`GET /status`

Operation ID: <code>getOperatingSystemStatus</code>

**Authentication:** No authentication requirement is declared in this OpenAPI operation. Consult the access guide and deployed service configuration.

This operation declares no parameters.

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Service and adapter readiness | <code>application/json</code>: <code>object</code> |
| <code>503</code> | PostgreSQL or v1 dependency unavailable | No response body declared |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | [OperatingSystemStatus](/api-reference/schemas/operating-system-status/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="issueOperatingSystemOAuthToken"></a>

## Exchange OAuth client credentials for a scoped one-hour token

`POST /oauth/token`

Operation ID: <code>issueOperatingSystemOAuthToken</code>

**Authentication:** HTTP Basic client credentials (<code>clientBasic</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |

### Request body

Required: **yes**.

**<code>application/x-www-form-urlencoded</code>**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>grant&#95;type</code> | Yes | Constant <code>client&#95;credentials</code> | — |
| <code>scope</code> | No | <code>string</code> | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Scoped bearer token | <code>application/json</code>: [OAuthTokenResponse](/api-reference/schemas/o-auth-token-response/) |
| <code>401</code> | Invalid or inactive OAuth client | No response body declared |

<a id="getOperatingSystemWorkspace"></a>

## Get all release-train availability and aggregate counts

`GET /workspace`

Operation ID: <code>getOperatingSystemWorkspace</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Role-aware workspace | <code>application/json</code>: <code>object</code> |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | [OperatingSystemWorkspace](/api-reference/schemas/operating-system-workspace/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="listOperatingSystemProviders"></a>

## List tenant-scoped signed provider registrations and health

`GET /providers`

Operation ID: <code>listOperatingSystemProviders</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Provider registry | <code>application/json</code>: <code>object</code> |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | Array of [OperatingSystemProvider](/api-reference/schemas/operating-system-provider/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="putOperatingSystemProvider"></a>

## Register or rotate an attested provider generation

`POST /providers`

Operation ID: <code>putOperatingSystemProvider</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

**Conditional version precondition:** <code>The providerId and capability generation already exists.</code>

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>Idempotency-Key</code> | header | Yes | <code>string</code> | Min length: <code>8</code>; Max length: <code>160</code> |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |
| <code>If-Match</code> | header | No | <code>string</code> | Pattern: <code>^"&#91;^"&#92;&#92; &#93;+"$</code> |

### Request body

Required: **yes**.

**<code>application/json</code>**

[ProviderRegistrationRequest](/api-reference/schemas/provider-registration-request/)

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>201</code> | Provider generation registered | <code>application/json</code>: <code>object</code> |
| <code>412</code> | Existing provider generation changed | No response body declared |

**<code>201</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | [OperatingSystemProvider](/api-reference/schemas/operating-system-provider/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="listOperatingSystemArtifacts"></a>

## List immutable object-storage lineage for reports and large evidence

`GET /artifacts`

Operation ID: <code>listOperatingSystemArtifacts</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>) **OR** OAuth bearer token with <code>proof:read</code> (<code>serviceCredential</code>)

**Service scope:** <code>proof:read</code>. Session access and workspace roles are evaluated separately.

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |
| <code>recordType</code> | query | No | <code>string</code> | — |
| <code>recordId</code> | query | No | <code>string</code> | — |

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Tenant-isolated content-addressed artifact lineage | <code>application/json</code>: <code>object</code> |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | Array of [OperatingSystemArtifact](/api-reference/schemas/operating-system-artifact/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="rotateDeveloperCredential"></a>

## Rotate a hashed API key or OAuth client secret

`POST /developer-credentials/{id}/rotate`

Operation ID: <code>rotateDeveloperCredential</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>Idempotency-Key</code> | header | Yes | <code>string</code> | Min length: <code>8</code>; Max length: <code>160</code> |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |
| <code>id</code> | path | Yes | <code>string</code> | — |
| <code>If-Match</code> | header | Yes | <code>string</code> | Pattern: <code>^"&#91;^"&#92;&#92; &#93;+"$</code> |

### Request body

Required: **yes**.

**<code>application/json</code>**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>reason</code> | Yes | <code>string</code> | Min length: <code>3</code>; Max length: <code>500</code> |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | New secret returned exactly once; prior secret revoked; durable idempotency is metadata-only | <code>application/json</code>: <code>object</code> |
| <code>409</code> | Identical retry cannot replay the already-returned replacement secret | No response body declared |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | <code>object</code> | Additional properties rejected |
| <code>data.credential</code> | Yes | All of: [RecordEnvelope](/api-reference/schemas/record-envelope/); <code>object</code> | — |
| <code>data.credential.allOf&#91;2&#93;.payload</code> | Yes | [DeveloperCredential](/api-reference/schemas/developer-credential/) | — |
| <code>data.secret</code> | Yes | <code>string</code> | — |
| <code>data.priorSecretRevoked</code> | Yes | Constant <code>true</code> | — |
| <code>data.secretReturnedOnce</code> | Yes | Constant <code>true</code> | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="listOperatingSystemJobs"></a>

## List fenced worker jobs and dead-letter visibility

`GET /jobs`

Operation ID: <code>listOperatingSystemJobs</code>

**Authentication:** <code>&#95;&#95;Host-klineo&#95;session</code> cookie (<code>sessionCookie</code>)

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>x-klineo-organization-id</code> | header | Yes | <code>string</code> | — |

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Worker job states | <code>application/json</code>: <code>object</code> |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | Array of [OperatingSystemJob](/api-reference/schemas/operating-system-job/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

<a id="getVerifiedHostBrand"></a>

## Resolve a privacy-safe brand only for the exact verified request host

`GET /public/brands/current`

Operation ID: <code>getVerifiedHostBrand</code>

**Authentication:** No authentication requirement is declared in this OpenAPI operation. Consult the access guide and deployed service configuration.

This operation declares no parameters.

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Host-bound accessible brand tokens | <code>application/json</code>: <code>object</code> |
| <code>404</code> | No unique verified brand is bound to this host | No response body declared |

**<code>200</code> response headers**

| Header | Required | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>Cache-Control</code> | Yes | Constant <code>no-store</code> | — |

**<code>200</code> <code>application/json</code> body**

<code>object</code> — Additional properties rejected

| Field | Required at this level | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>data</code> | Yes | [PublicPartnerBrand](/api-reference/schemas/public-partner-brand/) | — |

Nested required fields apply when their parent object or matching union branch is present. Named types link to their complete schema.

**<code>404</code> response headers**

| Header | Required | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>Cache-Control</code> | Yes | Constant <code>no-store</code> | — |

<a id="getVerifiedPartnerBrandLogo"></a>

## Serve the exact current host-bound content-addressed PNG logo

`GET /public/partner-brand/logo/{contentHash}`

Operation ID: <code>getVerifiedPartnerBrandLogo</code>

**Authentication:** No authentication requirement is declared in this OpenAPI operation. Consult the access guide and deployed service configuration.

### Parameters

| Name | Location | Required | Type | Description and constraints |
| --- | --- | --- | --- | --- |
| <code>contentHash</code> | path | Yes | <code>string</code> | — |

### Responses

| Status | Description | Content type and schema |
| --- | --- | --- |
| <code>200</code> | Hash-verified immutable PNG logo | <code>image/png</code>: <code>string</code> |
| <code>404</code> | No current verified host brand owns this exact logo hash | No response body declared |

**<code>200</code> response headers**

| Header | Required | Type | Description and constraints |
| --- | --- | --- | --- |
| <code>ETag</code> | Yes | <code>string</code> | — |
| <code>Cache-Control</code> | Yes | Constant <code>no-store</code> | — |
| <code>X-Content-Type-Options</code> | Yes | Constant <code>nosniff</code> | — |
| <code>Cross-Origin-Resource-Policy</code> | Yes | Constant <code>same-origin</code> | — |

**<code>200</code> <code>image/png</code> body**

<code>string</code> — Format: <code>binary</code>