Archstone Listings API

openapi: 3.2.0
info:
  title: Archstone — public API surface Listings API
  version: 2.32.1
  description: 'The public, unauthenticated surface of the Archstone console: discovering what a deployment can do, and verifying an OpenAPI document for free. Every operator-, collector-, and platform-scoped route is deliberately absent from this document — and so is the demo tourism search: its contract lives with the demo Worker in a separate repository this document does not control.'
servers:
- url: https://console.archstone.dev
  description: The hosted Archstone console and its control-plane API.
security: []
tags:
- name: Listings
paths:
  /api/v1/listings:
    get:
      operationId: listPublicListings
      summary: Every publicly listed hosted endpoint
      tags:
      - Listings
      security: []
      responses:
        '200':
          description: Every visible listing (approved, or approved and under escalation re-review), minimal fields only.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PublicListing'
              example:
              - slug: acme-weather
                displayName: Acme Weather
                description: Forecasts and current conditions for any city.
                website: https://acme.example.com
                logoRef: data:image/png;base64,iVBORw0KGgo=
                accessMode: public
                capabilities:
                - name: get_forecast
                  effect: read
        '404':
          description: This deployment does not carry multi-tenant hosting (self-hosted).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundRefusal'
        '429':
          description: This remote address has read too many times in the current window.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RateLimitedRefusal'
  /api/v1/listings/{slug}:
    get:
      operationId: getPublicListing
      summary: One publicly listed hosted endpoint, by slug
      tags:
      - Listings
      security: []
      parameters:
      - name: slug
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The listing's public fields.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicListing'
              example:
                slug: acme-weather
                displayName: Acme Weather
                description: Forecasts and current conditions for any city.
                website: https://acme.example.com
                logoRef: data:image/png;base64,iVBORw0KGgo=
                accessMode: public
                capabilities:
                - name: get_forecast
                  effect: read
        '404':
          description: 'Not found — indistinguishable across every cause: self-hosted (no multi-tenant), no such slug, delisted, withdrawn, declined, or a suspended/removed deployment. An unauthenticated caller must not learn which reason applied.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundRefusal'
        '429':
          description: This remote address has read too many times in the current window.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RateLimitedRefusal'
components:
  schemas:
    NotFoundRefusal:
      type: object
      required:
      - error
      additionalProperties: false
      properties:
        error:
          type: string
          enum:
          - not_found
    PublicListingCapability:
      type: object
      required:
      - name
      - effect
      additionalProperties: false
      properties:
        name:
          type: string
        effect:
          type: string
    RateLimitedRefusal:
      type: object
      required:
      - error
      - retryAfterMinutes
      additionalProperties: false
      properties:
        error:
          type: string
          enum:
          - rate_limited
        retryAfterMinutes:
          type: integer
    PublicListing:
      description: The public field allow-list for a listed hosted endpoint (AC-7). `capabilities` is always the LIVE published capability list, never the last-approved snapshot — a re-review in progress (an escalation) is visible only as its effect on this array, never as a status field. No tenant id, deployment id, requested_* field, decision reason, timestamp, or escalation field is ever present.
      type: object
      required:
      - slug
      - displayName
      - description
      - website
      - logoRef
      - accessMode
      - capabilities
      additionalProperties: false
      properties:
        slug:
          type: string
        displayName:
          type: string
        description:
          type: string
        website:
          type:
          - string
          - 'null'
        logoRef:
          type:
          - string
          - 'null'
          description: A `data:` URI (base64), or null when the listing carries no logo.
        accessMode:
          type: string
          enum:
          - public
          - oauth
        capabilities:
          type: array
          items:
            $ref: '#/components/schemas/PublicListingCapability'