API

Below: authentication, main endpoints, and request/response body fields. Tool shortlisting for the planner runs on the server (retrieval + scenarios); open Swagger for full schemas.

OpenAPI sources (runtime URL & sync)

After an OpenAPI import, each imported service has a stable OpenAPI integration source record: it stores the document URL, an optional org-level runtime base URL override, and binds catalog tools via source_ref_id. This lets you switch environments (staging → prod) without minting new tool revisions for every endpoint.

Effective URL order: project override → org serverUrlOverride → imported spec details.baseUrl. Org/project PATCH bodies are validated by the shared OutboundUrlPolicy; use publicly resolvable hosts for tests (e.g. https://example.com) or explicitly enabled local targets in self-hosted/dev. If the org override is unchanged, the server skips redundant UPDATE/audit; an empty JSON body on project runtime-config is a no-op without audit.

Sync preview (POST …/sync-preview) only compares the live document to the catalog and returns a diff — it does not mark integration lifecycle as a successful sync. Sync apply (POST …/sync) runs re-import; poll GET …/sync-runs/{runId} for the run record.

Import preserves the source's full components.securitySchemes block (apiKey header/query/cookie, http basic/bearer, oauth2 with every flow, openIdConnect, mutualTLS) — non-secret metadata about how a credential must be presented, never the credential itself. The import response (and the import job's result) and the source DTO return them under securitySchemes, each with a suggestedAuthMode; sync preview adds securitySchemeDrift (added / removed / type_changed). Each operation also keeps its full security block as an OR of ANDs under securityRequirements.