Runtime API Template Summary
This generated API block is a template for the Cessy Runtime REST surface. Real app endpoint names and schemas are generated from that app’s published DomainConfig, with shared platform endpoints for safe agent discovery, channels, and user channel views.
For a specific app, fetch:
Add ?workspaceId=<workspace-id> with normal Runtime bearer authentication to
inspect that unpublished Workspace runtime source. Production OpenAPI remains
public metadata.
Use the generated app contract as the source of truth for commands, projections, safe agent metadata, channel interaction, batch execution, event import, projection rebuild, auth, request bodies, and response envelopes. Agent catalog reads use normal Runtime authentication; channel and user-channel-view calls require a delegated user bearer token. A Workspace catalog can contain preview-only agents, while new DMs still resolve their target from the published app configuration.
Default projection reads mask secret-bearing fields recursively. Numeric
maxTokens, maxInputTokens and maxOutputTokens remain numbers when finite
and non-negative. Named credential-slot references in fields ending in
credentialSlot, credentialSlotRef or credentialSlotName remain readable
as null or 1–128-character identifiers beginning with an ASCII letter and
containing only letters, digits, _, . and -. Snake-case spellings follow
the same rules. Additional secret markers in a field name still cause masking;
credential objects, passwords, keys and bearer tokens remain protected. Store
only slot names in these reference fields, never credential values.
Malformed command payloads return HTTP 400 validation errors before resource-state loading or execution. Valid payloads still pass command authorization against the declared resource state. A preflight validation failure has no command commit; do not treat a redaction placeholder from a read as valid write input.