API reference

Every HTTP route in the platform API, with who may call it.

Calling the API

All routes are under /v1. Sign-in is by OIDC single sign-on and passkeys; the session is a cookie.
Requests that change something and carry the cookie must send an Origin matching the platform, or get BAD_ORIGIN.
Tenant routes need an x-aspian-tenant header with your organisation’s UUID, and membership of it.
Errors return {"error": "CODE", "message": "…"}. See Errors.

Route	What it does
`GET /v1/auth/sso/login`	Starts single sign-on
`GET /v1/auth/sso/callback`	Completes single sign-on
`POST /v1/auth/logout`	Ends the session
`GET /v1/me`	The signed-in person
`POST /v1/passkeys/registration/options`	Starts registering a passkey
`POST /v1/passkeys/registration/verify`	Finishes registering a passkey

Route	Who	What it does
`POST /v1/plans`	Owner, admin, developer	Create a plan
`GET /v1/plans/{planId}`	Members	Read a plan and its canonical bytes
`POST /v1/plans/{planId}/apply`	Owner, admin, developer	Apply an approved or low-risk plan
`POST /v1/plans/{planId}/approval-requests`	Owner, admin, developer	Ask named approvers to approve
`POST /v1/approval-links/open`	The approver	Open a single-use approval link
`POST /v1/approval-requests/{requestId}/challenge`	The approver	Get a challenge bound to the plan hash
`POST /v1/approval-requests/{requestId}/verify`	The approver	Submit the passkey signature

Route	What it does
`GET /v1/operator/tenants/{tenantId}/incidents`	Incidents an operator’s grant covers
`POST /v1/operator/tenants/{tenantId}/incidents/{incidentId}/acknowledge`	Acknowledge an incident
`POST /v1/operator/tenants/{tenantId}/runbooks/{runbookId}/run`	Run a named runbook the grant allows

Operator routes need an active operator and a current grant for that organisation and runbook.

Route	Who	What it does
`GET /v1/addons`	Members	List add-ons
`POST /v1/addons`	Owner, admin	Request an add-on
`POST /v1/addons/{addonId}/status`	Owner, admin	Change an add-on’s status
`POST /v1/partner/attestations`	A partner, by signature	Submit a signed attestation. Returns 201, or 200 for a duplicate