> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.cessy.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.cessy.ai/_mcp/server.

# Runtime API Template Summary

> Summary shown before the generated Runtime API template reference.

This generated API block is a template for the Cessy Runtime REST surface. Real app endpoint names and schemas are generated from that app's published DomainConfig, with shared platform endpoints for safe agent discovery, channels, and user channel views.

For a specific app, fetch:

```text
/api/rest/<tenant-id>/<app-id>/openapi
```

Add `?workspaceId=<workspace-id>` with normal Runtime bearer authentication to
inspect that unpublished Workspace runtime source. Production OpenAPI remains
public metadata.

Use the generated app contract as the source of truth for commands, projections,
safe agent metadata, channel interaction, batch execution, event import,
projection rebuild, auth, request bodies, and response envelopes. Agent catalog
reads use normal Runtime authentication; channel and user-channel-view calls
require a delegated user bearer token. A Workspace catalog can contain
preview-only agents, while new DMs still resolve their target from the
published app configuration.

Default projection reads mask secret-bearing fields recursively. Numeric
`maxTokens`, `maxInputTokens` and `maxOutputTokens` remain numbers when finite
and non-negative. Named credential-slot references in fields ending in
`credentialSlot`, `credentialSlotRef` or `credentialSlotName` remain readable
as `null` or 1–128-character identifiers beginning with an ASCII letter and
containing only letters, digits, `_`, `.` and `-`. Snake-case spellings follow
the same rules. Additional secret markers in a field name still cause masking;
credential objects, passwords, keys and bearer tokens remain protected. Store
only slot names in these reference fields, never credential values.

Malformed command payloads return HTTP 400 validation errors before
resource-state loading or execution. Valid payloads still pass command
authorization against the declared resource state. A preflight validation
failure has no command commit; do not treat a redaction placeholder from a read
as valid write input.