Skip to main content

REST & OpenAPI

Every node serves a broad REST route tree covering identity, portal, messaging, functions, lineage, service groups, and the edge fleet, with an administrative sub-tree spanning catalog, clean rooms, ETL, federation, secrets, storage, and streams. In front of it sits one request gateway, a routing dispatcher and a middleware pipeline: authentication, admission, web-application firewalling, rate limiting, host/IP filtering, CORS, circuit breaking, and threat-level enforcement.

Direction: inbound. System9 is the server. Status: Live, with named gaps.

One deny-by-default front door​

The value is that there is one API surface per node: every console, script, SDK, and Edge Agent authenticates and authorizes the same way, through one deny-by-default gate, before anything reaches a backend service. No backend service is exposed to an external network in its own right. A client on the outside has exactly one address to reach and one gate to pass.

Status and named gaps​

The node's API is one of the platform's genuinely deep surfaces, and deny-by-default on the versioned API path is in place. The bounds to respect:

  • Some permission keys gate routes no caller can reach: an authorization surface still under audit.
  • GraphQL ships but is off by default. The schema, resolvers, mutations, auth extension, and query cost analyzer are all built, but the endpoint is mounted only when enabled in configuration. A deployment that has not enabled it exposes no GraphQL surface at all, so check the setting before pointing a client at it.
  • Server-sent event streams are live on several surfaces (the agent-tool server, the orchestration run-event stream, chat and coding surfaces); WebSocket servers are live for real-time intelligence and the edge agent's operational channel.

A served, browsable API reference​

The node now serves its own OpenAPI document and an interactive reference:

  • OpenAPI document: GET /api/public/v1/openapi.json
  • Interactive reference (Swagger UI): GET /api/public/v1/docs

See Public API reference for what the served document covers and how to read its per-operation status.

Concrete routes are now publishable: here is why that is safe

An earlier revision of this page declined to publish concrete API paths while the path surface settled. That stance has been formally reversed: the node now serves a curated, deny-by-default OpenAPI document, so naming its routes no longer risks exposing an internal surface.

The curation is deny-by-default in the strict sense: an operation is served only if it carries at least one tag and every tag it carries is on an explicit allowlist. An operation with no tag, or with any tag outside the allowlist, is never served, so operator-only and internal families are excluded structurally, not by remembering to redact them. Internal program identifiers do not appear on any served path.

Other query protocols on the same cell​

Beyond REST and the SQL wire, a cell also serves a native RESP2/RESP3 (Redis-compatible) protocol for the data-structure engine, a Gremlin graph traversal surface, and the platform's own SQL/KQL/PromQL query surfaces. Each resolves through the same governed plan. See Interoperability for the full list and direction of every protocol.