What we can hand your engineers today.
Three of the six things on this page exist and we will send them on request. The other three do not exist yet, and they are marked as such rather than linked to a page that will not load.
The inventory, with its gaps.
Ask on the call and we will send whatever in the first three rows is relevant to your integration.
SCROLL SIDEWAYS FOR THE REST OF EACH ROW
| RESOURCE | WHAT IT IS | AVAILABILITY |
|---|---|---|
| OpenAPI surface | Every service publishes its own OpenAPI document, generated from the schemas the routes actually validate against — not written by hand beside them. | PUBLISHED TO CUSTOMERS ON REQUEST |
| Event contracts | Every domain event has a JSON Schema in one shared contracts library, which is what makes a non-Python consumer possible at all. | PUBLISHED TO CUSTOMERS ON REQUEST |
| Architecture decisions | The decisions that are load-bearing — tenancy, the outbox, money, signing keys — are written down as records with their consequences, including the irreversible ones. | INTERNAL, SHARED UNDER NDA |
| Public developer portal | A self-serve portal with browsable reference, sandbox keys and code samples. | NOT PUBLISHED YET |
| Status page | Live component status and a public incident history. | NOT PUBLISHED YET |
| Changelog | What shipped, when, and what it changed for you. | NOT PUBLISHED YET |
Every route declares the permission it needs.
Authentication is a bearer token signed by one service and verified everywhere else through JWKS. Authorisation is a named permission with a scope, declared on the route itself, and applied inside the query rather than after it.
The organisation comes from the token, not from a parameter you can change. There is no request shape that lets a caller name somebody else’s organisation.
How scopes narrow a query# request
Authorization: Bearer <jwt, verified via JWKS>
// 200
{
"items": [ … ],
"scope_applied": "LOCATION",
"organization_id": "from the token, never from the query"
}NOTE401 for a missing or unverifiable token, 403 for a token that verifies but does not carry the permission. The two are never collapsed into one another.
Status and incidents.
There is no public status page yet, so there is no link to one here. These are the commitments that will sit behind it when there is.
STATUS PAGE
[STATUS PAGE URL]
UPTIME COMMITMENT
[UPTIME COMMITMENT]
DATA REGION
[DATA REGION]
SUPPORT HOURS
[SUPPORT HOURS]
Security disclosures: [SECURITY DISCLOSURE EMAIL]
Send your integration engineer, not a procurement form.
Tell us what you need to integrate with and we will send the relevant OpenAPI document and event schemas before the call, so the call is about the hard part.