Anteproof Me API

openapi: 3.2.0
info:
  title: Anteproof Me API
  description: 'Read-only access to the Anteproof forecast archive: live forecasts, question detail, and the full calibration/launch-gate audit trail. Anteproof is a product of Recoilix LLC.'
  version: 0.1.0
tags:
- name: Me
paths:
  /v1/me:
    get:
      summary: Me
      description: 'The signed-in account. First call for a user creates it and starts

        the reverse trial; the response says what the account can do now.'
      operationId: me_v1_me_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Me V1 Me Get
      security:
      - clerkSessionBearer: []
      tags:
      - Me
  /v1/me/watchlist:
    get:
      summary: Watchlist
      operationId: watchlist_v1_me_watchlist_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Watchlist V1 Me Watchlist Get
      security:
      - clerkSessionBearer: []
      tags:
      - Me
    post:
      summary: Watch
      operationId: watch_v1_me_watchlist_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WatchBody'
        required: true
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Watch V1 Me Watchlist Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - clerkSessionBearer: []
      tags:
      - Me
  /v1/me/watchlist/import:
    post:
      summary: Import Watchlist
      description: 'Load a whole dependency tree at once: the body is a CycloneDX JSON

        or SPDX JSON document (up to 5 MB). Every component with a

        pkg:npm, pkg:pypi, pkg:cargo or pkg:github purl is normalised and

        matched against the archive''s entities; matches are added to the

        watchlist up to the plan''s cap, and the ones that did not fit are

        reported as over_cap rather than refused, so a Free account still

        gets its three and sees what Pro would unlock. Supported names

        with no entity yet are remembered per account (watchlist_pending)

        and listed under unmatched. With ?dry_run=true nothing is written.

        A document that cannot be read is a 400 with the reason; the whole

        import either applies or does not.'
      operationId: import_watchlist_v1_me_watchlist_import_post
      parameters:
      - name: dry_run
        in: query
        required: false
        schema:
          type: boolean
          default: false
          title: Dry Run
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Import Watchlist V1 Me Watchlist Import Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - clerkSessionBearer: []
      tags:
      - Me
  /v1/me/watchlist/pending:
    get:
      summary: Watchlist Pending
      description: 'Packages from this account''s SBOM imports that had no entity in

        the archive at the time. They are the demand signal the universe

        seeder reads; once an entity exists the row keeps its id (shown

        with ?include_resolved=true) and the next import watches it.'
      operationId: watchlist_pending_v1_me_watchlist_pending_get
      parameters:
      - name: include_resolved
        in: query
        required: false
        schema:
          type: boolean
          default: false
          title: Include Resolved
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Watchlist Pending V1 Me Watchlist Pending Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - clerkSessionBearer: []
      tags:
      - Me
    delete:
      summary: Clear Pending
      description: Delete every name on this account's pending list, resolved or not. Watchlist entries are untouched.
      operationId: clear_pending_v1_me_watchlist_pending_delete
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Clear Pending V1 Me Watchlist Pending Delete
      security:
      - clerkSessionBearer: []
      tags:
      - Me
  /v1/me/watchlist/pending/{pending_id}:
    delete:
      summary: Delete Pending
      description: 'Delete one name from this account''s pending list (resolved or not). Another account''s row, or an id

        that is not there, answers removed: false, the same answer either way.'
      operationId: delete_pending_v1_me_watchlist_pending__pending_id__delete
      parameters:
      - name: pending_id
        in: path
        required: true
        schema:
          type: integer
          title: Pending Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Delete Pending V1 Me Watchlist Pending  Pending Id  Delete
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - clerkSessionBearer: []
      tags:
      - Me
  /v1/me/watchlist/{entity_id}:
    delete:
      summary: Unwatch
      operationId: unwatch_v1_me_watchlist__entity_id__delete
      parameters:
      - name: entity_id
        in: path
        required: true
        schema:
          type: integer
          title: Entity Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Unwatch V1 Me Watchlist  Entity Id  Delete
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - clerkSessionBearer: []
      tags:
      - Me
  /v1/me/api-keys:
    get:
      summary: Api Keys
      operationId: api_keys_v1_me_api_keys_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Api Keys V1 Me Api Keys Get
      security:
      - clerkSessionBearer: []
      tags:
      - Me
    post:
      summary: Create Api Key
      description: The one response that ever contains the key itself.
      operationId: create_api_key_v1_me_api_keys_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/KeyBody'
        required: true
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Create Api Key V1 Me Api Keys Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - clerkSessionBearer: []
      tags:
      - Me
  /v1/me/api-keys/{key_id}:
    delete:
      summary: Revoke Api Key
      operationId: revoke_api_key_v1_me_api_keys__key_id__delete
      parameters:
      - name: key_id
        in: path
        required: true
        schema:
          type: integer
          title: Key Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Revoke Api Key V1 Me Api Keys  Key Id  Delete
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - clerkSessionBearer: []
      tags:
      - Me
  /v1/me/alerts:
    get:
      summary: Get Alerts
      description: 'This account''s alert rules (Pro only). The defaults exist from

        the moment an account is first Pro: a crossing rule at 0.35 below on

        the maintenance families, a move rule at 0.15, and a resolution rule.'
      operationId: get_alerts_v1_me_alerts_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Get Alerts V1 Me Alerts Get
      security:
      - clerkSessionBearer: []
      tags:
      - Me
    put:
      summary: Put Alerts
      description: 'Partial update: any of crossing / move / resolution with

        enabled, threshold (0-1, exclusive) and direction (crossing only),

        plus email_enabled for the account as a whole.'
      operationId: put_alerts_v1_me_alerts_put
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AlertsBody'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Put Alerts V1 Me Alerts Put
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - clerkSessionBearer: []
      tags:
      - Me
components:
  schemas:
    WatchBody:
      properties:
        entity_id:
          type: integer
          exclusiveMinimum: 0.0
          title: Entity Id
      type: object
      required:
      - entity_id
      title: WatchBody
    KeyBody:
      properties:
        name:
          type: string
          maxLength: 80
          minLength: 1
          title: Name
          default: default
      type: object
      title: KeyBody
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    RuleUpdate:
      properties:
        enabled:
          anyOf:
          - type: boolean
          - type: 'null'
          title: Enabled
        threshold:
          anyOf:
          - type: number
            exclusiveMaximum: 1.0
            exclusiveMinimum: 0.0
          - type: 'null'
          title: Threshold
        direction:
          anyOf:
          - type: string
            pattern: ^(below|above)$
          - type: 'null'
          title: Direction
      type: object
      title: RuleUpdate
    AlertsBody:
      properties:
        crossing:
          anyOf:
          - $ref: '#/components/schemas/RuleUpdate'
          - type: 'null'
        move:
          anyOf:
          - $ref: '#/components/schemas/RuleUpdate'
          - type: 'null'
        resolution:
          anyOf:
          - $ref: '#/components/schemas/RuleUpdate'
          - type: 'null'
        email_enabled:
          anyOf:
          - type: boolean
          - type: 'null'
          title: Email Enabled
      type: object
      title: AlertsBody
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
  securitySchemes:
    clerkSessionBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'A Clerk session token, sent as `Authorization: Bearer <jwt>`. The signature (RS256, against the configured Clerk JWKS) and the expiry are verified; the issuer and the authorized party are also checked where they are configured. An operation marked with this scheme refuses a request that does not carry a valid session token. An Anteproof API key is not accepted in its place.'
    anteproofApiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'An Anteproof API key (`ap_…`), created at https://anteproof.com/account. On the public operations in this document — the ones that list no security requirement — it may be sent either as `X-API-Key: ap_…` or as `Authorization: Bearer ap_…`. It is OPTIONAL on those: a request without it is served just the same, and a request with a live key is counted against the account''s monthly allowance (the reply then carries X-Api-Calls-Used, X-Api-Calls-Limit and X-Api-Calls-Reset). It is not a session credential: an operation marked `clerkSessionBearer` refuses it with 401, live key or not. An `ap_…` key that is invalid or revoked is refused with 401 on any operation in this document; otherwise the key is optional. Because no operation requires one, no operation in this document lists this scheme. The MCP endpoint at /mcp, which this document does not describe, requires a credential — an API key or an OAuth sign-in — for every call except discovery: a POST whose JSON-RPC messages are all `initialize`, `notifications/initialized`, `ping` or `tools/list` is served without one.'
    stripeWebhookSignature:
      type: apiKey
      in: header
      name: Stripe-Signature
      description: 'Stripe''s webhook signature: `t=<unix>,v1=<hex hmac-sha256 of "<t>.<body>">`, checked against this endpoint''s signing secret with a five-minute tolerance on `t`. A request whose signature does not verify is refused with 401. This operation receives Stripe''s callbacks.'