huggingbay-xyz Publishers API

openapi: 3.2.0
info:
  title: Hugging Bay Public Publishers API
  version: 0.2.0
  summary: AI artifact discovery, provenance, hosted/external state, and mirror demand APIs.
  x-agent-quickstart: '## Connect your agent

    One live call; public reads need no key:


    ```sh

    curl -fsS ''https://huggingbay.xyz/api/mcp'' -H ''Content-Type: application/json'' -d ''{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_artifacts","arguments":{"q":"Qwen2.5 0.5B GGUF","limit":5}}}''

    ```


    Hosted MCP: Streamable HTTP `https://huggingbay.xyz/api/mcp`. No key for reads. Inspect tools/list.

    Claude Code: `claude mcp add --transport http hugging-bay https://huggingbay.xyz/api/mcp`

    Codex CLI: `codex mcp add hugging-bay --url https://huggingbay.xyz/api/mcp`. Public reads need no OAuth login.

    Cursor: add {"mcpServers":{"hugging-bay":{"url":"https://huggingbay.xyz/api/mcp"}}} to .cursor/mcp.json.

    ChatGPT: On ChatGPT web, open Plugins → + → Add custom MCP server. Name it hugging-bay, paste this remote MCP URL, choose no authentication, and review the search and fetch tools for public catalog reads. Availability depends on your account and workspace permissions. This custom connection is separate from the private bundled plugin; public-directory approval remains separate. URL: https://huggingbay.xyz/chatgpt/mcp

    Stdio (Node.js 18+): `npx -y hugging-bay-mcp@0.1.13`; list tools.

    On 2026-10-29 the official MCP Registry listed io.github.barneywohl/hugging-bay 0.1.13 as active and latest.

    The call returns a live catalog row. Read its file and license details before downloading.

    Fit is an estimate. A hash checks bytes; it does not prove a run, safety or license permission.'
  description: 'Agents can request models, features, tools and builds, get an id, check the status of each request, and read a public changelog of what shipped. Missing a model, file, tool or feature? Ask with request_feature (MCP) or POST https://huggingbay.xyz/api/v1/requests. No account. You get an id and can check its status. What shipped: https://huggingbay.xyz/changelog Start at /api/index.json for bounded open-model and dataset discovery, license and provenance metadata, hosted-file evidence, MCP profiles and explicit execution boundaries. Catalog inclusion is not proof of byte availability, runtime readiness or quality. Authenticated operations require the documented scopes; discovery never grants authority to execute them.


    **Data freshness.** `degraded` means a fresh complete read was unavailable; `stale` means earlier snapshot data is being shown. Neither flag grants download or execution permission. See `x-data-freshness`.


    **Private notifications.** The site''s `/v1/notify/*` browser/email routes are listed under `x-private-routes`, including their paused and one-click behavior.'
  x-changelog:
  - version: 0.2.0
    date: '2026-10-16'
    changes:
    - 'Identified the Round 9 path addition: POST /api/events/a2hs (createA2hsEvent), the aggregate home-screen tip counter added on 2026-10-15. Its schema requires event, surface and platform plus the same-origin CSRF header; it stores no visitor identifiers.'
    - Clarified IP and route-group read budgets, uncached RateLimit headers, and the separate live database concurrency admission limits under x-rate-limit.admission. Capacity 503s do not imply a fixed requests-per-second throttle.
    - /api/programs is not served on huggingbay.xyz or run.huggingbay.xyz. Read hosted Bay Run Pins at https://run.huggingbay.xyz/v1/pins; the separate browser model manifest is https://huggingbay.xyz/run/api/programs.
  - version: 0.2.0
    date: '2026-10-12'
    changes:
    - Hosted-file JSONL routes and their latest-data alias return JSON errors instead of zero-byte successful downloads when no rows are available; nonempty dumps retain their row format and continuation links.
    - Unknown agent-request ids return request_not_found, including malformed ids. /changelog/ redirects to /changelog, which shares agent-request shipping entries with /api/v1/changelog; /what-changed remains the separate serve-decision feed.
    - OpenAPI contract version follows this changelog instead of the MCP package version. Data freshness flags and private browser notification routes are documented separately from public SDK operations.
  - version: 0.2.0
    date: '2026-09-21'
    changes:
    - 'Consolidated developer reference: the authentication policy, the rate-limit policy (x-rate-limit), the error taxonomy (x-error-taxonomy), this changelog (x-changelog) and a loud deprecated-alias map (x-deprecated-aliases) are now carried in this one document, so openapi.json is the single source instead of the scattered install/PyPI/blackboard/SKILL surfaces.'
    - Published a pointer to the observed remote MCP tools/list contract (x-mcp) so an agent can discover the model-discovery and download tools, not only the fixed Bay Run demo Pins.
  - version: 0.2.0
    date: '2026-09-20'
    changes:
    - 'General API error envelope: { error, code, status, message, requestId, next:{action,href} }; notification routes have separate documented shapes. nextAction and docsRef remain as deprecated aliases.'
    - recorded-vs-alias markers (x-primary, x-primary-path, x-aliases) and near-synonym disambiguation (x-route-family, x-use-when) on every duplicated route.
    - 'Runnable examples: request parameter examples, a JSON response example and an x-codeSamples curl recipe on the core operations.'
    - 'Edge validation: malformed numeric query parameters are rejected with 400 invalid_query before reaching the database.'
  - version: 0.2.0
    date: '2026-09-19'
    changes:
    - 'Developer on-ramp: /quickstart (get a key, first call, serve a model), the rendered reference at /docs/api (Redoc over this spec), self-serve reader tokens, and an llms.txt mirror of the same steps.'
servers:
- url: https://huggingbay.xyz
tags:
- name: Publishers
paths:
  /api/artifacts/{id}/preflight:
    get:
      tags:
      - Publishers
      operationId: getArtifactPreflight
      summary: 'Publisher preflight: objective release blockers vs documentation-quality…'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Preflight report
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/RateLimit-Limit'
            RateLimit-Remaining:
              $ref: '#/components/headers/RateLimit-Remaining'
            RateLimit-Reset:
              $ref: '#/components/headers/RateLimit-Reset'
            X-HB-Backoff:
              description: Optional v1 backoff contract marker; rollout defaults off.
              schema:
                type: string
            X-HB-Admission:
              description: Optional open, busy or limited; a process-local observation, not a reservation.
              schema:
                type: string
            X-HB-Capacity:
              description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
              schema:
                type: string
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                description: Preflight report. Fields can vary; no stronger field guarantee is specified for this operation.
        '404':
          description: Not found
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/RateLimit-Limit'
            RateLimit-Remaining:
              $ref: '#/components/headers/RateLimit-Remaining'
            RateLimit-Reset:
              $ref: '#/components/headers/RateLimit-Reset'
            X-HB-Backoff:
              description: Optional v1 backoff contract marker; rollout defaults off.
              schema:
                type: string
            X-HB-Admission:
              description: Optional open, busy or limited; a process-local observation, not a reservation.
              schema:
                type: string
            X-HB-Capacity:
              description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      x-request-example:
        method: GET
        url: https://huggingbay.xyz/api/artifacts/hf-model-sentence-transformers-all-minilm-l6-v2/preflight
        headers: {}
        parameters:
        - name: id
          in: path
          value: hf-model-sentence-transformers-all-minilm-l6-v2
        prerequisites:
        - Use an identifier returned by the matching list, search or create operation. Sample identifiers are not a promise that a record exists.
        verification: Request template. Not a captured live response.
        curl: curl -sS 'https://huggingbay.xyz/api/artifacts/hf-model-sentence-transformers-all-minilm-l6-v2/preflight'
      x-codeSamples:
      - lang: Shell
        label: curl request
        source: curl -sS 'https://huggingbay.xyz/api/artifacts/hf-model-sentence-transformers-all-minilm-l6-v2/preflight'
      x-rate-limit:
        policy: '#/x-rate-limit'
        summary: Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.
      x-error-contract:
        schema: '#/components/schemas/ErrorEnvelope'
        note: API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.
        responses:
          '404':
            description: Not found
            mediaTypes:
            - application/json
            schemas:
              application/json:
                $ref: '#/components/schemas/ErrorEnvelope'
      description: 'Publisher preflight: objective release blockers vs documentation-quality warnings.


        **Inputs.** Path, query and header fields are listed below. No request body is required.


        **Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.


        **Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.


        **Rate limits.** Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.


        **Example setup.** Use an identifier returned by the matching list, search or create operation. Sample identifiers are not a promise that a record exists.'
components:
  headers:
    RateLimit-Reset:
      description: Seconds until this client's window resets; omitted on public cacheable responses.
      schema:
        type: integer
        minimum: 0
    RateLimit-Remaining:
      description: Requests remaining in this client's window; omitted on public cacheable responses.
      schema:
        type: integer
        minimum: 0
    RateLimit-Limit:
      description: Per-client request budget; omitted on public cacheable responses.
      schema:
        type: integer
        minimum: 0
  schemas:
    ErrorEnvelope:
      type: object
      description: 'General API JSON errors, HTTP 410 Gone tombstones, MCP JSON-RPC error.data, and MCP tools/call failures (`result.isError:true` structuredContent) use this envelope; notification confirmation/unsubscribe errors have separate shapes, and paused subscribe/lookup responses use next:null. Fields: `code` (stable snake_case), `message` (plain words: what happened), `next` ({ label, action, command, href }: the single next step — `command` is a literal runnable shell line), `request_id`, and `retry_after_s` in the body on retryable 429 and 503 errors (not on 410). `error`, `status`, `requestId`, `retryAfterSeconds`, `cause` and `hint` are additive legacy twins kept for older clients. `nextAction` and `docsRef` are DEPRECATED aliases that only the /api/agents/* and /api/recommend-specialist lanes still emit; read `next` instead.'
      required:
      - code
      - message
      - next
      - request_id
      properties:
        code:
          type: string
          description: Stable machine-readable error code (see x-error-taxonomy).
        message:
          type: string
          description: What happened, in plain words.
        next:
          type: object
          required:
          - label
          - action
          - command
          - href
          description: The single next step. `label` is plain words; `action` is one of retry | fix_identifier | get_key | wait | contact; `command` is a literal runnable shell line (no editing required); `href` is the docs or recovery URL. `step` is the finer-grained legacy recovery verb.
          properties:
            label:
              type: string
            action:
              type: string
              enum:
              - retry
              - fix_identifier
              - get_key
              - wait
              - contact
            command:
              type: string
            href:
              type: string
            step:
              type: string
              enum:
              - search_catalog
              - fix_identifier
              - list_tasks
              - fix_query
              - fix_hardware_param
              - fix_request
              - fix_arguments
              - authenticate
              - use_authorized_credential
              - use_allowed_method
              - retry_after
              - retry_later
              - read_body_then_retry
              - reduce_request_size
              - read_api_index
              - list_tools
              - request_mirror
              - open_finder
              - read_docs
              - relax_constraints
            retryAfterSeconds:
              type: integer
              minimum: 1
            dropped:
              type: string
          additionalProperties: true
        request_id:
          type:
          - string
          - 'null'
          description: req_… — quote it when you report a problem. Same id as the X-Request-Id header (prefixed).
        retry_after_s:
          type: integer
          minimum: 1
          description: 'Present on retryable 429 and 503 errors: wait this many seconds, then retry. Mirrors the Retry-After header for header-blind clients.'
        error:
          type: string
          deprecated: true
          description: DEPRECATED legacy twin of `code`; read `code`. Kept for one release.
        status:
          anyOf:
          - type: integer
            minimum: 400
            maximum: 599
          - enum:
            - identity-unavailable
            - unavailable
            - not-served
        requestId:
          type:
          - string
          - 'null'
          deprecated: true
          description: DEPRECATED legacy twin of `request_id` (unprefixed); read `request_id`. Kept for one release.
        retryable:
          type: boolean
        retryAfterSeconds:
          type: integer
          minimum: 1
          deprecated: true
          description: DEPRECATED legacy twin of `retry_after_s`; read `retry_after_s`. Kept for one release.
        hint:
          type: string
        cause:
          type: string
        reason_code:
          type: string
          description: The lane-specific code a guided code (file_withheld, ...) replaced.
        field:
          type: string
        allowed: {}
        nextAction:
          type: object
          deprecated: true
          description: 'DEPRECATED alias of `next`: { method, endpoint }. Read `next.href` instead.'
        docsRef:
          type: string
          deprecated: true
          description: DEPRECATED alias of `next.href` pointing at the OpenAPI operation.
      additionalProperties: true
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Hugging Bay bearer token for account, publisher, or authorized operator endpoints. Public discovery endpoints do not require a token. Get a reader token self-serve (no prior auth, no signup): POST /api/account/reader-token, then send it as Authorization: Bearer <token>. Full walkthrough at /quickstart#get-a-key.'
x-hugging-bay-route-recovery:
  /api/search:
    requestedPath: /api/search
    method: GET
    behavior: internal_alias
    aliasOf: /api/artifacts
    url: https://huggingbay.xyz/api/search?q=<query>&limit=20
    canonicalUrl: https://huggingbay.xyz/api/artifacts?summary=1&q=<query>&limit=20
    responseSchema: ArtifactPage
    defaults:
      summary: '1'
      limit: 20
    note: Returns bounded public artifact summaries; it never exposes private rows.
  /api/finder:
    requestedPath: /api/finder
    method: GET
    behavior: internal_alias
    aliasOf: /api/agents/find-model
    url: https://huggingbay.xyz/api/finder?task=<task>&limit=3
    canonicalUrl: https://huggingbay.xyz/api/agents/find-model?task=<task>&limit=3
    responseSchema: FindModelResponse
    note: Uses the bounded task-and-constraints finder; provide task (or q) before acting on a candidate.
  /api/downloads/{artifactId}:
    requestedPath: /api/downloads/{artifactId}
    method: GET
    behavior: internal_alias
    aliasOf: /api/artifacts/{artifactId}/download-plan
    url: https://huggingbay.xyz/api/downloads/{artifactId}
    canonicalUrl: https://huggingbay.xyz/api/artifacts/{artifactId}/download-plan
    responseSchema: ArtifactDownloadPlan
    servesBytes: false
    nextRequest:
      method: GET
      url: https://huggingbay.xyz/api/downloads/{artifactId}/{path}
      note: Use an exact hosted file path returned by the plan; never infer a filename or availability.
x-agent-reads:
  summary: User fetchers and OAI-SearchBot may read find, plan and search APIs. Bulk crawlers use public metadata. Private/export/byte routes stay excluded. Authentication, byte guards and rate limits apply.
  userFetchers:
  - ChatGPT-User
  - Claude-User
  - Perplexity-User
  - Google-Agent
  - Google-GeminiNotebook
  - MistralAI-User
  searchCrawlers:
  - OAI-SearchBot
  readEndpoints:
  - https://huggingbay.xyz/api/agents/find-model
  - https://huggingbay.xyz/api/agents/find-runnable
  - https://huggingbay.xyz/api/agents/deployment-plan
  - https://huggingbay.xyz/api/v1/search
  - https://huggingbay.xyz/api/search
  - https://huggingbay.xyz/api/search/semantic
  robots: https://huggingbay.xyz/robots.txt
  authorization: A user-agent string is not authentication or proof of user consent.
x-data-freshness:
  degraded: The current read could not supply a complete fresh response. Any included rows are a fallback or partial view; an empty degraded response does not establish that no records exist.
  stale: Included data comes from an earlier snapshot, rather than a fresh check. Read asOf, snapshotAt, generatedAt or the endpoint's documented refresh timestamp when present; do not assume generatedAt alone is the time the underlying data was checked.
  acquisition: These flags describe data freshness, not permission to download or execute. Download links still depend on the live file checks.
x-private-routes:
  scope: Private browser and email-provider integration; these routes are not public SDK operations and do not require a reader token. Browser JSON POSTs enforce the configured same-origin policy.
  paused: Subscribe and lookup return 503 notify_paused with retryable:false, next:null and no Retry-After or retry_after_s. Do not automatically retry. Transient notify_unavailable responses carry retry_after_s and Retry-After.
  routes:
  - path: /v1/notify/subscribe
    methods:
    - POST
    description: Same-origin JSON email/topic submission. Success is 200 with pending or confirmed state; no email-send claim while paused.
    private: true
  - path: /v1/notify/lookup
    methods:
    - POST
    description: Same-origin JSON lookup for the typed email/topic; 200 returns onList, topic and status. Stores nothing.
    private: true
  - path: /v1/notify/confirm
    methods:
    - POST
    description: Same-origin JSON body containing a signed confirmation token; GET is not supported. Confirmation errors use their own code-only shape.
    private: true
  - path: /v1/notify/unsubscribe
    methods:
    - POST
    description: Same-origin JSON body containing a signed unsubscribe token. A configured signed unsubscribe can work while subscriptions are paused; errors use their own code-only shape.
    private: true
  - path: /v1/notify/unsubscribe/{token}
    methods:
    - GET
    - HEAD
    - POST
    description: Email one-click integration. GET/HEAD redirect to the confirmation page without removing anyone; POST accepts the provider's one-click form body and a signed token.
    private: true
x-rate-limit:
  authRequired: false
  publicReadsPerWindow: 300
  crawlerReadsPerWindow: 1200
  windowSeconds: 60
  scope: per client IP and route group; bearer tokens share the IP budget
  onExceeded: HTTP 429 rate_limited with a Retry-After header; the body is the standard ErrorEnvelope with retry_after_s (always in the body on 429/503) and next.action=wait.
  headers: RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset (seconds) appear on uncached responses; public cacheable reads omit them to avoid sharing one client's budget.
  note: Public discovery (search, resolve, artifact reads, download-plan, find-model, MCP tools/list and tools/call) needs no token. A self-serve reader token (POST /api/account/reader-token) is only for account workflows and is rate-limited the same way.
  backoff:
    version: hugging-bay.backoff.v1
    signals:
    - 429 rate_limited
    - 429 public_read_capacity_reserved
    - 503 admission
    retry: GET/HEAD only; at most two retries; wait the largest valid Retry-After (seconds or HTTP-date) or JSON retry_after_s/retryAfterSeconds, plus positive jitter. Stop rather than shorten a delay beyond the local wait budget. Never automatically replay a write.
    success: X-HB-Admission and X-HB-Capacity are process-local, timestamped observations, not reservations. Shared caches may replay them. A success with Retry-After is consumed once; pace the next read, never retry the success.
    headersEnabled: true
  budgetEndpoint: /api/v1/budget
  perTokenApiBudgetEnabled: false
  admission:
    enabled: true
    heavyReadConcurrency: 6
    byteReadConcurrency: 4
    perClientReadConcurrency: 2
    waitMs: 3000
    retryAfterSeconds: 1
  summary: 'Public reads: 300 requests per 60s per client IP and route group; designated crawlers get 1200. Bearer API traffic shares the client IP budget on this instance. GET /api/v1/budget reports limit, remaining, windowSeconds and reset for your token (when per-token budgets are active) or client IP without consuming a unit. Over limit: HTTP 429 rate_limited; wait for Retry-After (retry_after_s in JSON). RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset appear on uncached responses and are omitted on public cacheable reads. Shared database capacity also limits heavy reads to 6 at once, byte reads to 4, and each identified client to 2. Admission waits up to 3000ms, then returns 429 public_read_capacity_reserved for bulk agents/crawlers or 503 admission for other clients with Retry-After: 1. This is a concurrency limit, not a requests-per-second quota. One backoff contract covers 429 rate_limited, 429 public_read_capacity_reserved and 503 admission: wait the largest Retry-After (seconds or HTTP-date) / retry_after_s / retryAfterSeconds plus positive jitter, use at most two read retries, and stop rather than shorten a delay beyond your wait budget. Never automatically replay writes. When enabled, X-HB-Backoff: v1, X-HB-Admission (open/busy/limited) and timestamped X-HB-Capacity appear on successes too; these are process-local observations which caches may replay, not reservations. Consume a success once; Retry-After paces the next read. Bay Run limits are separate.'
  bayRun: 'Bay Run (run.huggingbay.xyz) is a separate service with separate limits: the free key allows a fixed number of tasks a day per key, and its own 429s carry retry_after_s in the same JSON shape. See the Bay Run section of llms.txt.'
x-error-taxonomy:
  envelope: '#/components/schemas/ErrorEnvelope'
  shape: 'code · message · next{label,action,command,href} · request_id · retry_after_s (C18-K3 / L-M2). One shape on every surface: REST, MCP JSON-RPC error.data, and the Bay Run-facing docs here.'
  nextActions:
  - retry
  - fix_identifier
  - get_key
  - wait
  - contact
  retryAfter: retry_after_s is in the BODY on every 429 and 503 (header-blind clients), mirrored by the Retry-After header.
  codes:
  - code: invalid_query
    status: 400
    nextAction: retry
    nextStep: fix_query
    meaning: A query parameter is missing, malformed, or outside its documented enum or numeric range. Carries field and (for enums) allowed. Rejected at the edge before the database.
  - code: missing_task
    status: 400
    nextAction: retry
    nextStep: list_tasks
    meaning: A task-first endpoint (find-model, find-runnable, recommend-specialist) was called without the required task parameter.
  - code: authentication_required
    status: 401
    nextAction: get_key
    nextStep: authenticate
    meaning: The route needs a bearer token. Mint one self-serve at POST /api/account/reader-token; next.command is that exact call.
  - code: forbidden
    status: 403
    nextAction: get_key
    nextStep: use_authorized_credential
    meaning: The caller holds no credential authorized for this route. Carries the required role list.
  - code: unknown_route
    status: 404
    nextAction: retry
    meaning: No such API route (any case). Route names are lowercase; next.command is a working search call.
  - code: artifact_not_found
    status: 404
    nextAction: fix_identifier
    nextStep: search_catalog
    meaning: No public artifact has that id (anonymous caller). next.command searches the catalog for it.
  - code: request_not_found
    status: 404
    nextAction: retry
    nextStep: fix_request
    meaning: No agent request matches this id, or the id does not have the documented req_ plus 24 hexadecimal characters shape. The route exists; this is not unknown_route.
  - code: not_found
    status: 404
    nextAction: fix_identifier
    meaning: No public record matches the identifier (non-artifact records). For anonymous callers this replaces the older conflated not_found_or_not_authorized.
  - code: resource_gone
    status: 410
    nextAction: fix_identifier
    meaning: The route or record was permanently removed or superseded. Do not retry the same identifier; read next for the documented replacement or search path.
  - code: endorsement_badges_removed
    status: 410
    nextAction: retry
    nextStep: read_docs
    meaning: Publisher and artifact endorsement badges were retired permanently. Read the trust methodology for what Hugging Bay still verifies.
  - code: file_withheld
    status: 404
    nextAction: retry
    meaning: The file lane refused bytes because the live file admission or artifact obtain verdict withheld them (410 for withdrawn bytes or reason_code artifact_obtain_not_ready). Files withheld — not faked; next.command reads the download-plan, whose serveExplanation says why. Artifact-verdict denials include downloadable, downloadStatus, reasonCodes, reason, serveEvaluatedAt and serveEvaluationId. reason_code carries the lane code.
  - code: keys_moved
    status: 404
    nextAction: get_key
    meaning: '/api/v1/keys was retired. Keys for this site are reader tokens: next.command is the one POST to /api/account/reader-token.'
  - code: rate_limited
    status: 429
    nextAction: wait
    nextStep: retry_after
    meaning: Too many requests in the current window. Wait retry_after_s seconds (also in Retry-After), then retry. See x-rate-limit.
  - code: service_unavailable
    status: 503
    nextAction: wait
    nextStep: retry_later
    meaning: A bounded authority read failed closed or capacity was saturated. The document is never fabricated; wait retry_after_s seconds (always in the body), then retry.
x-deprecated-aliases:
  policy: Legacy /api/* aliases still answer for older SDK versions but send Deprecation and Sunset response headers plus a Link rel=successor-version to the recorded path. Prefer the recorded path.
  aliases:
  - alias: /api/search
    primary: /api/v1/search
    status: deprecated
    served: still answers, with Deprecation and Sunset response headers and a Link rel=successor-version pointing at the recorded path
  - alias: /api/artifacts
    primary: /api/v1/search
    status: deprecated
    served: still answers, with Deprecation and Sunset response headers and a Link rel=successor-version pointing at the recorded path
  - alias: /api/resolve
    primary: /api/v1/resolve
    status: deprecated
    served: still answers, with Deprecation and Sunset response headers and a Link rel=successor-version pointing at the recorded path
  - alias: /api/trending
    primary: /api/v1/trending
    status: deprecated
    served: still answers, with Deprecation and Sunset response headers and a Link rel=successor-version pointing at the recorded path
  - alias: /api/compare
    primary: /api/v1/compare
    status: deprecated
    served: still answers, with Deprecation and Sunset response headers and a Link rel=successor-version pointing at the recorded path
  - alias: /api/finder
    primary: /api/agents/find-model
    status: deprecated
    served: still answers, with Deprecation and Sunset response headers and a Link rel=successor-version pointing at the recorded path
  - alias: /api/recommend
    primary: /api/recommender
    status: deprecated
    served: still answers, with Deprecation and Sunset response headers and a Link rel=successor-version pointing at the recorded path
  - alias: /api/manifests/{id}
    primary: /api/v1/artifacts/{id}/manifest
    status: deprecated
    served: still answers, with Deprecation and Sunset response headers and a Link rel=successor-version pointing at the recorded path


# --- truncated at 32 KB (41 KB total) ---
# Full source: https://artifacts.apis.io/huggingbay-xyz/openapi/huggingbay-xyz-publishers-api-openapi.yml