API reference
Every route, generated from the source.
This reference is generated from the same API definitions the servers run. It cannot describe a route that does not exist, or miss one that does — there is no hand-written copy of it to fall behind.
1518 operations · 8 services
How to read it
- Everything is authorized the same way.
- Each operation names the permission the decision point is asked about, so you can see which grant a call needs before you write it rather than after it returns 403.
- A refusal explains itself.
- Errors are RFC 9457 problem documents carrying the reason and the policy that produced it. A 403 tells you which policy said no.
- Identifiers are URNs.
- One grammar for every resource in every pillar — `prx:tenant:pillar:site:type:id`. The same string identifies a table, a camera and a server.
- Long work returns an operation.
- Anything that cannot finish inside a request returns an operation URN to poll rather than holding the connection open.
The services
- ProjectX IdentityProjectX ID: the directory and its attribute schema, credentials and sessions, agent identities under delegation, bulk operations, and SCIM in both directions. The pillar every other pillar asks who somebody is, which is why it is published rather than treated as internal plumbing.282 operations
- ProjectX PolicyThe decision point and what feeds it: Authorize, Simulate, WhoCan and WhatCan, the tenancy hierarchy, roles, grants and policy packs. Every other service in the platform is a client of the four decision endpoints, and a customer auditing us is entitled to read the shape of the questions we ask about them.57 operations
- ProjectX Control PlaneCatalog, audit, metering and billing, operations, events and webhooks, and cross-pillar correlation.283 operations
- ProjectX DataThe lakehouse: catalogs, namespaces, Iceberg tables, snapshots and time travel, and queries. Queries come in two shapes and both put entitlements in the plan. A structured query describes what is wanted against one table and the platform writes the SQL. Submitted SQL is written by the caller and rewritten before it runs: every table it names is authorized separately and replaced by a relation that already carries that table's row filter and column masks, so row filters and column masks are in the query that runs rather than applied to its results. A query whose rewrite cannot be shown to have guarded every table it reads is refused rather than run. Also here: views as stored query intents over one base table, file sets and buckets as governed objects, retention policies with legal hold, tenant encryption keys with BYOK, storage tiering, and table maintenance. A view is read through its base table's query path, so a view cannot show rows or columns the base table's policy withholds.317 operations
- ProjectX Cloud PlaneThe ProjectX catalog of machine classes and regions, the substrate registry, the credential vault, and the VPS lifecycle. Customers order ProjectX machine classes in ProjectX regions; which upstream provider serves a given order is ProjectX’s commercial structure and appears on no customer-facing response (ADR-009). The `/v1/cloud/providers` and `/v1/cloud/regions` routes describe the upstream mapping and are staff-only. Substrate records state ownership and operator separately, and the difference is commercial as well as technical: on a substrate the customer owns, no infrastructure margin is metered.322 operations
- ProjectX VideoThe video plane: sites, zones and cameras, stream ingest, natural-language search over what was seen, and clip playback. Search is a sentence rather than a filter expression, and what comes back says why each result matched and what the caller was not permitted to see — a shortened timeline that does not say it was shortened reads as 'there is no footage of that'. Playback is a short-lived signed URL against the data plane; no endpoint here returns footage.111 operations
- ProjectX Ops IntelligenceThe ask plane: one question, answered across the data, video, identity and cloud pillars at once. An answer arrives with the plan that produced it, the query sent to each pillar, the permission each pillar applied and the sources read, because a correlated number nobody can trace is a number nobody will act on. Every leg is planned by its own pillar, as the asking principal, before any leg runs. Legs the caller's entitlements do not reach are dropped at plan time and named in `excluded`, so two people asking the same question get different answers and both are told why theirs is shaped the way it is.42 operations
- ProjectX OperatorStaff-only, cross-tenant: the staff directory, break-glass impersonation, tenant lifecycle, cross-tenant audit search and the operations browser. Published rather than kept internal because a customer is entitled to know what the console we run their platform from can do.104 operations