Governance — APIs

Generated from the architecture model

This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.

ApprovalPolicyService

REST (public endpoints need a scope; every call carries trusted tenant and project scope)

Method	Path	Operation	Scope	Side effects	Idempotency	Gateway	Summary
GET	/factory/approval-rules	ListApprovalRules	factory.policies.read	read	natural	GW-03	Rules per scope and action class with roles
POST	/factory/projects/{projectId}/approval-rules/validate	ValidateProjectApprovalRules	factory.policies.write	sandbox	natural	GW-03	Validate project rules against tenant rules (tighten only).
GET	/factory/approvals/{approvalId}/routing	GetApprovalRouting	factory.approvals.read	read	natural	GW-03	Who may decide a request

gRPC (code-first, internal)

gRPC service	Method	Streaming	Visibility	Side effects	Summary
ApprovalPolicy	Route	none	internal	read	Resolve the rule
ApprovalPolicy	ValidateDecision	none	internal	read	Validate that a decider is eligible now

AuditService

REST (public endpoints need a scope; every call carries trusted tenant and project scope)

Method	Path	Operation	Scope	Side effects	Idempotency	Gateway	Summary
GET	/factory/audit	SearchAudit	factory.audit.read	read	natural	GW-03	Evidence by scope, kind, actor, run and time; verifiable chain positions.
POST	/factory/projects/{projectId}/audit/export	ExportAudit	factory.audit.export	external	key-header	GW-03	Export a project's evidence in open formats with chain proofs (D31
GET	/factory/classifications	ListClassifications	factory.audit.read	read	natural	GW-03	Classification labels and redaction rules per resource type.
PUT	/factory/classifications/{resourceType}	SetClassification	factory.audit.admin	production	natural	GW-03	Set the data class
GET	/factory/findings	ListFindings	factory.audit.read	read	natural	GW-03	Open and resolved findings by severity and category.
POST	/factory/findings/{findingId}/resolve	ResolveFinding	factory.audit.admin	shared-write	natural	GW-03	Resolve or accept the risk of a finding with a reason (evidence).

gRPC (code-first, internal)

gRPC service	Method	Streaming	Visibility	Side effects	Summary
Audit	Record	none	internal	shared-write	Append evidence directly (for commands that are not events).
Audit	Classify	none	internal	read	Resolve the data class
Audit	Redact	none	internal	shared-write	Apply redaction rules of a class to a content reference and return the redacted artifact reference.

GovernanceHost

REST (public endpoints need a scope; every call carries trusted tenant and project scope)

Method	Path	Operation	Scope	Side effects	Idempotency	Gateway	Summary
GET	/governance/health	GovernanceHealth	factory.health.read	read	natural	GW-01	Liveness, readiness and dependency health (governance store, immutable audit store, Key Vault, identity platform).
GET	/governance/meta/revisions	GovernanceRevisions	factory.meta.read	read	natural	GW-03	Active policy and approval-rule revisions per scope and the audit hash-chain head; used by operators and the Studio about page.

PolicyEngineService

REST (public endpoints need a scope; every call carries trusted tenant and project scope)

Method	Path	Operation	Scope	Side effects	Idempotency	Gateway	Summary
GET	/factory/policies	ListPolicyBundles	factory.policies.read	read	natural	GW-03	Active and retired bundles per scope with revisions
GET	/factory/policies/{revision}	GetPolicyBundle	factory.policies.read	read	natural	GW-03	The rules of a revision (typed view of the YAML).
POST	/factory/projects/{projectId}/policy/validate	ValidateProjectPolicy	factory.policies.write	sandbox	natural	GW-03	Validate a project override against the tenant bundle: every rule must tighten, never loosen (D18).
POST	/factory/policies/simulate	SimulatePolicy	factory.policies.write	sandbox	natural	GW-03	What-if evaluation of a candidate bundle against recorded decisions of a period (sandbox; later-stage depth).
GET	/factory/runs/{runId}/policy-decisions	ListRunDecisions	factory.runs.read	read	natural	GW-03	Decisions recorded for a run with effects

gRPC (code-first, internal)

gRPC service	Method	Streaming	Visibility	Side effects	Summary
Policy	Decide	none	internal	read	Evaluate subject
Policy	GetActiveRevision	none	internal	read	The revision a new run must pin for its scope.
Policy	ValidateTightening	none	internal	read	Check that a candidate bundle only tightens its parent; used at publication of policy assets.

SecretBrokerService

REST (public endpoints need a scope; every call carries trusted tenant and project scope)

Method	Path	Operation	Scope	Side effects	Idempotency	Gateway	Summary
GET	/factory/secret-references	ListSecretReferences	factory.secrets.admin	read	natural	GW-03	References with kind
POST	/factory/secret-references	RegisterSecretReference	factory.secrets.admin	production	key-header	GW-03	Register a reference to a vault secret or an exchangeable identity with owner
POST	/factory/secret-references/{referenceId}/rotate	RotateSecret	factory.secrets.admin	production	key-header	GW-03	Record a rotation to a new vault version and revoke live issuances of the old one.
POST	/factory/secret-references/{referenceId}/revoke	RevokeSecretReference	factory.secrets.admin	production	natural	GW-03	Revoke a reference and every live issuance.
GET	/factory/runs/{runId}/issuances	ListRunIssuances	factory.runs.read	read	natural	GW-03	Credential issuances made for a run (metadata only).

gRPC (code-first, internal)

gRPC service	Method	Streaming	Visibility	Side effects	Summary
SecretBroker	Issue	none	internal	shared-write	Issue a short-lived scoped credential for a subject and purpose after a policy decision; delivered once over the authenticated channel.
SecretBroker	Revoke	none	internal	shared-write	Revoke an issuance (lease ended
SecretBroker	Verify	none	internal	external	Verify that a reference resolves and the credential works (read-only probe) without issuing it to the caller.