Every API here is available over the APIs.io API and to AI agents over MCP.
openapi: 3.2.0
info:
title: Hugging Bay Public Sandbox API
version: 0.2.0
summary: AI artifact discovery, provenance, hosted/external state, and mirror demand APIs.
x-agent-quickstart: '## Connect your agent
One live call; public reads need no key:
```sh
curl -fsS ''https://huggingbay.xyz/api/mcp'' -H ''Content-Type: application/json'' -d ''{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_artifacts","arguments":{"q":"Qwen2.5 0.5B GGUF","limit":5}}}''
```
Hosted MCP: Streamable HTTP `https://huggingbay.xyz/api/mcp`. No key for reads. Inspect tools/list.
Claude Code: `claude mcp add --transport http hugging-bay https://huggingbay.xyz/api/mcp`
Codex CLI: `codex mcp add hugging-bay --url https://huggingbay.xyz/api/mcp`. Public reads need no OAuth login.
Cursor: add {"mcpServers":{"hugging-bay":{"url":"https://huggingbay.xyz/api/mcp"}}} to .cursor/mcp.json.
ChatGPT: On ChatGPT web, open Plugins → + → Add custom MCP server. Name it hugging-bay, paste this remote MCP URL, choose no authentication, and review the search and fetch tools for public catalog reads. Availability depends on your account and workspace permissions. This custom connection is separate from the private bundled plugin; public-directory approval remains separate. URL: https://huggingbay.xyz/chatgpt/mcp
Stdio (Node.js 18+): `npx -y hugging-bay-mcp@0.1.13`; list tools.
On 2026-10-29 the official MCP Registry listed io.github.barneywohl/hugging-bay 0.1.13 as active and latest.
The call returns a live catalog row. Read its file and license details before downloading.
Fit is an estimate. A hash checks bytes; it does not prove a run, safety or license permission.'
description: 'Agents can request models, features, tools and builds, get an id, check the status of each request, and read a public changelog of what shipped. Missing a model, file, tool or feature? Ask with request_feature (MCP) or POST https://huggingbay.xyz/api/v1/requests. No account. You get an id and can check its status. What shipped: https://huggingbay.xyz/changelog Start at /api/index.json for bounded open-model and dataset discovery, license and provenance metadata, hosted-file evidence, MCP profiles and explicit execution boundaries. Catalog inclusion is not proof of byte availability, runtime readiness or quality. Authenticated operations require the documented scopes; discovery never grants authority to execute them.
**Data freshness.** `degraded` means a fresh complete read was unavailable; `stale` means earlier snapshot data is being shown. Neither flag grants download or execution permission. See `x-data-freshness`.
**Private notifications.** The site''s `/v1/notify/*` browser/email routes are listed under `x-private-routes`, including their paused and one-click behavior.'
x-changelog:
- version: 0.2.0
date: '2026-10-16'
changes:
- 'Identified the Round 9 path addition: POST /api/events/a2hs (createA2hsEvent), the aggregate home-screen tip counter added on 2026-10-15. Its schema requires event, surface and platform plus the same-origin CSRF header; it stores no visitor identifiers.'
- Clarified IP and route-group read budgets, uncached RateLimit headers, and the separate live database concurrency admission limits under x-rate-limit.admission. Capacity 503s do not imply a fixed requests-per-second throttle.
- /api/programs is not served on huggingbay.xyz or run.huggingbay.xyz. Read hosted Bay Run Pins at https://run.huggingbay.xyz/v1/pins; the separate browser model manifest is https://huggingbay.xyz/run/api/programs.
- version: 0.2.0
date: '2026-10-12'
changes:
- Hosted-file JSONL routes and their latest-data alias return JSON errors instead of zero-byte successful downloads when no rows are available; nonempty dumps retain their row format and continuation links.
- Unknown agent-request ids return request_not_found, including malformed ids. /changelog/ redirects to /changelog, which shares agent-request shipping entries with /api/v1/changelog; /what-changed remains the separate serve-decision feed.
- OpenAPI contract version follows this changelog instead of the MCP package version. Data freshness flags and private browser notification routes are documented separately from public SDK operations.
- version: 0.2.0
date: '2026-09-21'
changes:
- 'Consolidated developer reference: the authentication policy, the rate-limit policy (x-rate-limit), the error taxonomy (x-error-taxonomy), this changelog (x-changelog) and a loud deprecated-alias map (x-deprecated-aliases) are now carried in this one document, so openapi.json is the single source instead of the scattered install/PyPI/blackboard/SKILL surfaces.'
- Published a pointer to the observed remote MCP tools/list contract (x-mcp) so an agent can discover the model-discovery and download tools, not only the fixed Bay Run demo Pins.
- version: 0.2.0
date: '2026-09-20'
changes:
- 'General API error envelope: { error, code, status, message, requestId, next:{action,href} }; notification routes have separate documented shapes. nextAction and docsRef remain as deprecated aliases.'
- recorded-vs-alias markers (x-primary, x-primary-path, x-aliases) and near-synonym disambiguation (x-route-family, x-use-when) on every duplicated route.
- 'Runnable examples: request parameter examples, a JSON response example and an x-codeSamples curl recipe on the core operations.'
- 'Edge validation: malformed numeric query parameters are rejected with 400 invalid_query before reaching the database.'
- version: 0.2.0
date: '2026-09-19'
changes:
- 'Developer on-ramp: /quickstart (get a key, first call, serve a model), the rendered reference at /docs/api (Redoc over this spec), self-serve reader tokens, and an llms.txt mirror of the same steps.'
servers:
- url: https://huggingbay.xyz
tags:
- name: Sandbox
paths:
/api/sandbox/verify:
post:
operationId: verifySandboxRepresentation
tags:
- Sandbox
summary: Queue a bounded hosted-representation load smoke, or return an existing fresh…
description: 'Only public, fully hosted, immutable, allowlisted representations are admitted. The response never includes raw model output and this endpoint never writes catalog verification state directly.
**Inputs.** No path or query fields are required. The request body schema lists accepted fields and required values.
**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.
**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.
**Rate limits.** Write and protocol operations can have separate route-specific limits. Read Retry-After and retry_after_s when present; do not infer a write allowance from the public read budget.
**Example setup.** This example is not executed by documentation checks. Review the operation and obtain any required user consent before sending it.'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- artifactId
properties:
artifactId:
type: string
suiteId:
type: string
enum:
- representation-load-smoke
additionalProperties: false
responses:
'200':
description: Fresh cached receipt or an honest refusal/oversize response.
content:
application/json:
schema:
$ref: '#/components/schemas/SandboxJobResponse'
headers:
X-HB-Backoff:
description: Optional v1 backoff contract marker; rollout defaults off.
schema:
type: string
X-HB-Admission:
description: Optional open, busy or limited; a process-local observation, not a reservation.
schema:
type: string
X-HB-Capacity:
description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
schema:
type: string
'202':
description: A new or deduplicated sandbox job is queued.
content:
application/json:
schema:
$ref: '#/components/schemas/SandboxJobResponse'
headers:
X-HB-Backoff:
description: Optional v1 backoff contract marker; rollout defaults off.
schema:
type: string
X-HB-Admission:
description: Optional open, busy or limited; a process-local observation, not a reservation.
schema:
type: string
X-HB-Capacity:
description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
schema:
type: string
'429':
description: Per-requester sandbox admission limit reached; honor Retry-After.
content:
application/json:
schema:
$ref: '#/components/schemas/SandboxRefusalResponse'
headers:
X-HB-Backoff:
description: Optional v1 backoff contract marker; rollout defaults off.
schema:
type: string
X-HB-Admission:
description: Optional open, busy or limited; a process-local observation, not a reservation.
schema:
type: string
X-HB-Capacity:
description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
schema:
type: string
'503':
description: Sandbox persistence is unavailable; no job was created.
content:
application/json:
schema:
$ref: '#/components/schemas/SandboxStatusResponse'
headers:
X-HB-Backoff:
description: Optional v1 backoff contract marker; rollout defaults off.
schema:
type: string
X-HB-Admission:
description: Optional open, busy or limited; a process-local observation, not a reservation.
schema:
type: string
X-HB-Capacity:
description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
schema:
type: string
x-idempotency-key:
supported: false
behavior: This endpoint does not implement Idempotency-Key; the header is ignored. Do not assume that retrying a write is safe.
x-request-example:
method: POST
url: https://huggingbay.xyz/api/sandbox/verify
headers:
Content-Type: application/json
body:
artifactId: hf-model-sentence-transformers-all-minilm-l6-v2
parameters: []
prerequisites:
- This example is not executed by documentation checks. Review the operation and obtain any required user consent before sending it.
verification: Request template. Not a captured live response.
curl: 'curl -sS -X POST ''https://huggingbay.xyz/api/sandbox/verify'' -H ''Content-Type: application/json'' --data-raw ''{"artifactId":"hf-model-sentence-transformers-all-minilm-l6-v2"}'''
x-codeSamples:
- lang: Shell
label: curl request
source: 'curl -sS -X POST ''https://huggingbay.xyz/api/sandbox/verify'' -H ''Content-Type: application/json'' --data-raw ''{"artifactId":"hf-model-sentence-transformers-all-minilm-l6-v2"}'''
x-rate-limit:
policy: '#/x-rate-limit'
summary: Write and protocol operations can have separate route-specific limits. Read Retry-After and retry_after_s when present; do not infer a write allowance from the public read budget.
x-error-contract:
note: API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.
responses:
'429':
description: Per-requester sandbox admission limit reached; honor Retry-After.
mediaTypes:
- application/json
schemas:
application/json:
$ref: '#/components/schemas/SandboxRefusalResponse'
'503':
description: Sandbox persistence is unavailable; no job was created.
mediaTypes:
- application/json
schemas:
application/json:
$ref: '#/components/schemas/SandboxStatusResponse'
/api/sandbox/jobs/{id}:
get:
operationId: getSandboxJob
tags:
- Sandbox
summary: Read a public sandbox job projection by its unguessable id
parameters:
- name: id
in: path
required: true
schema:
type: string
responses:
'200':
description: Status, bounded receipt projection, or honest refusal reason without raw output.
content:
application/json:
schema:
$ref: '#/components/schemas/SandboxJobResponse'
headers:
RateLimit-Limit:
$ref: '#/components/headers/RateLimit-Limit'
RateLimit-Remaining:
$ref: '#/components/headers/RateLimit-Remaining'
RateLimit-Reset:
$ref: '#/components/headers/RateLimit-Reset'
X-HB-Backoff:
description: Optional v1 backoff contract marker; rollout defaults off.
schema:
type: string
X-HB-Admission:
description: Optional open, busy or limited; a process-local observation, not a reservation.
schema:
type: string
X-HB-Capacity:
description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
schema:
type: string
'404':
description: Job not found.
headers:
RateLimit-Limit:
$ref: '#/components/headers/RateLimit-Limit'
RateLimit-Remaining:
$ref: '#/components/headers/RateLimit-Remaining'
RateLimit-Reset:
$ref: '#/components/headers/RateLimit-Reset'
X-HB-Backoff:
description: Optional v1 backoff contract marker; rollout defaults off.
schema:
type: string
X-HB-Admission:
description: Optional open, busy or limited; a process-local observation, not a reservation.
schema:
type: string
X-HB-Capacity:
description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'503':
description: Sandbox persistence is unavailable.
headers:
RateLimit-Limit:
$ref: '#/components/headers/RateLimit-Limit'
RateLimit-Remaining:
$ref: '#/components/headers/RateLimit-Remaining'
RateLimit-Reset:
$ref: '#/components/headers/RateLimit-Reset'
X-HB-Backoff:
description: Optional v1 backoff contract marker; rollout defaults off.
schema:
type: string
X-HB-Admission:
description: Optional open, busy or limited; a process-local observation, not a reservation.
schema:
type: string
X-HB-Capacity:
description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
x-request-example:
method: GET
url: https://huggingbay.xyz/api/sandbox/jobs/example
headers: {}
parameters:
- name: id
in: path
value: example
prerequisites:
- Use an identifier returned by the matching list, search or create operation. Sample identifiers are not a promise that a record exists.
verification: Request template. Not a captured live response.
curl: curl -sS 'https://huggingbay.xyz/api/sandbox/jobs/example'
x-codeSamples:
- lang: Shell
label: curl request
source: curl -sS 'https://huggingbay.xyz/api/sandbox/jobs/example'
x-rate-limit:
policy: '#/x-rate-limit'
summary: Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.
x-error-contract:
schema: '#/components/schemas/ErrorEnvelope'
note: API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.
responses:
'404':
description: Job not found.
mediaTypes:
- application/json
schemas:
application/json:
$ref: '#/components/schemas/ErrorEnvelope'
'503':
description: Sandbox persistence is unavailable.
mediaTypes:
- application/json
schemas:
application/json:
$ref: '#/components/schemas/ErrorEnvelope'
description: 'Read a public sandbox job projection by its unguessable id.
**Inputs.** Path, query and header fields are listed below. No request body is required.
**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.
**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.
**Rate limits.** Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.
**Example setup.** Use an identifier returned by the matching list, search or create operation. Sample identifiers are not a promise that a record exists.'
/api/sandbox/status:
get:
operationId: getSandboxStatus
tags:
- Sandbox
summary: Read actual sandbox queue depth, running count, backend activity, and today's…
responses:
'200':
description: Current sandbox status; unavailable fields remain null rather than fabricated.
content:
application/json:
schema:
$ref: '#/components/schemas/SandboxStatusResponse'
headers:
RateLimit-Limit:
$ref: '#/components/headers/RateLimit-Limit'
RateLimit-Remaining:
$ref: '#/components/headers/RateLimit-Remaining'
RateLimit-Reset:
$ref: '#/components/headers/RateLimit-Reset'
X-HB-Backoff:
description: Optional v1 backoff contract marker; rollout defaults off.
schema:
type: string
X-HB-Admission:
description: Optional open, busy or limited; a process-local observation, not a reservation.
schema:
type: string
X-HB-Capacity:
description: Optional process-local heavy/bytes active, limit and remaining counts plus observed epoch seconds. Cached observations may be old.
schema:
type: string
parameters:
- $ref: '#/components/parameters/PublicNoteCompatibility'
x-request-example:
method: GET
url: https://huggingbay.xyz/api/sandbox/status
headers: {}
parameters: []
prerequisites: []
verification: Request template. Not a captured live response.
curl: curl -sS 'https://huggingbay.xyz/api/sandbox/status'
x-codeSamples:
- lang: Shell
label: curl request
source: curl -sS 'https://huggingbay.xyz/api/sandbox/status'
x-rate-limit:
policy: '#/x-rate-limit'
summary: Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.
x-error-contract:
schema: '#/components/schemas/ErrorEnvelope'
note: API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.
description: 'Read actual sandbox queue depth, running count, backend activity, and today''s pass/fail counts.
**Inputs.** Path, query and header fields are listed below. No request body is required.
**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.
**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.
**Rate limits.** Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.'
components:
schemas:
ErrorEnvelope:
type: object
description: 'General API JSON errors, HTTP 410 Gone tombstones, MCP JSON-RPC error.data, and MCP tools/call failures (`result.isError:true` structuredContent) use this envelope; notification confirmation/unsubscribe errors have separate shapes, and paused subscribe/lookup responses use next:null. Fields: `code` (stable snake_case), `message` (plain words: what happened), `next` ({ label, action, command, href }: the single next step — `command` is a literal runnable shell line), `request_id`, and `retry_after_s` in the body on retryable 429 and 503 errors (not on 410). `error`, `status`, `requestId`, `retryAfterSeconds`, `cause` and `hint` are additive legacy twins kept for older clients. `nextAction` and `docsRef` are DEPRECATED aliases that only the /api/agents/* and /api/recommend-specialist lanes still emit; read `next` instead.'
required:
- code
- message
- next
- request_id
properties:
code:
type: string
description: Stable machine-readable error code (see x-error-taxonomy).
message:
type: string
description: What happened, in plain words.
next:
type: object
required:
- label
- action
- command
- href
description: The single next step. `label` is plain words; `action` is one of retry | fix_identifier | get_key | wait | contact; `command` is a literal runnable shell line (no editing required); `href` is the docs or recovery URL. `step` is the finer-grained legacy recovery verb.
properties:
label:
type: string
action:
type: string
enum:
- retry
- fix_identifier
- get_key
- wait
- contact
command:
type: string
href:
type: string
step:
type: string
enum:
- search_catalog
- fix_identifier
- list_tasks
- fix_query
- fix_hardware_param
- fix_request
- fix_arguments
- authenticate
- use_authorized_credential
- use_allowed_method
- retry_after
- retry_later
- read_body_then_retry
- reduce_request_size
- read_api_index
- list_tools
- request_mirror
- open_finder
- read_docs
- relax_constraints
retryAfterSeconds:
type: integer
minimum: 1
dropped:
type: string
additionalProperties: true
request_id:
type:
- string
- 'null'
description: req_… — quote it when you report a problem. Same id as the X-Request-Id header (prefixed).
retry_after_s:
type: integer
minimum: 1
description: 'Present on retryable 429 and 503 errors: wait this many seconds, then retry. Mirrors the Retry-After header for header-blind clients.'
error:
type: string
deprecated: true
description: DEPRECATED legacy twin of `code`; read `code`. Kept for one release.
status:
anyOf:
- type: integer
minimum: 400
maximum: 599
- enum:
- identity-unavailable
- unavailable
- not-served
requestId:
type:
- string
- 'null'
deprecated: true
description: DEPRECATED legacy twin of `request_id` (unprefixed); read `request_id`. Kept for one release.
retryable:
type: boolean
retryAfterSeconds:
type: integer
minimum: 1
deprecated: true
description: DEPRECATED legacy twin of `retry_after_s`; read `retry_after_s`. Kept for one release.
hint:
type: string
cause:
type: string
reason_code:
type: string
description: The lane-specific code a guided code (file_withheld, ...) replaced.
field:
type: string
allowed: {}
nextAction:
type: object
deprecated: true
description: 'DEPRECATED alias of `next`: { method, endpoint }. Read `next.href` instead.'
docsRef:
type: string
deprecated: true
description: DEPRECATED alias of `next.href` pointing at the OpenAPI operation.
additionalProperties: true
SandboxJobResponse:
type: object
required:
- schemaVersion
- id
- status
properties:
schemaVersion:
const: hugging-bay.sandbox-job.v1
id:
type: string
status:
type: string
receiptId:
type: string
verdict:
enum:
- pass
- fail
passRate:
type: number
minimum: 0
maximum: 1
cached:
type: boolean
refusalReason:
type: string
additionalProperties: true
SandboxStatusResponse:
type: object
required:
- schemaVersion
- available
properties:
schemaVersion:
const: hugging-bay.sandbox-status.v1
available:
type: boolean
queueDepth:
type:
- integer
- 'null'
running:
type:
- integer
- 'null'
maxConcurrency:
type: integer
additionalProperties: true
SandboxRefusalResponse:
type: object
required:
- schemaVersion
- status
- refusalReason
properties:
schemaVersion:
type: string
status:
type: string
refusalReason:
type: string
retryAfterSeconds:
type: integer
additionalProperties: true
headers:
RateLimit-Reset:
description: Seconds until this client's window resets; omitted on public cacheable responses.
schema:
type: integer
minimum: 0
RateLimit-Remaining:
description: Requests remaining in this client's window; omitted on public cacheable responses.
schema:
type: integer
minimum: 0
RateLimit-Limit:
description: Per-client request budget; omitted on public cacheable responses.
schema:
type: integer
minimum: 0
parameters:
PublicNoteCompatibility:
name: compat
in: query
required: false
deprecated: true
description: Deprecated legacy response block opt-in for one release only.
schema:
type: string
enum:
- containment
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: 'Hugging Bay bearer token for account, publisher, or authorized operator endpoints. Public discovery endpoints do not require a token. Get a reader token self-serve (no prior auth, no signup): POST /api/account/reader-token, then send it as Authorization: Bearer <token>. Full walkthrough at /quickstart#get-a-key.'
x-hugging-bay-route-recovery:
/api/search:
requestedPath: /api/search
method: GET
behavior: internal_alias
aliasOf: /api/artifacts
url: https://huggingbay.xyz/api/search?q=<query>&limit=20
canonicalUrl: https://huggingbay.xyz/api/artifacts?summary=1&q=<query>&limit=20
responseSchema: ArtifactPage
defaults:
summary: '1'
limit: 20
note: Returns bounded public artifact summaries; it never exposes private rows.
/api/finder:
requestedPath: /api/finder
method: GET
behavior: internal_alias
aliasOf: /api/agents/find-model
url: https://huggingbay.xyz/api/finder?task=<task>&limit=3
canonicalUrl: https://huggingbay.xyz/api/agents/find-model?task=<task>&limit=3
responseSchema: FindModelResponse
note: Uses the bounded task-and-constraints finder; provide task (or q) before acting on a candidate.
/api/downloads/{artifactId}:
requestedPath: /api/downloads/{artifactId}
method: GET
behavior: internal_alias
aliasOf: /api/artifacts/{artifactId}/download-plan
url: https://huggingbay.xyz/api/downloads/{artifactId}
canonicalUrl: https://huggingbay.xyz/api/artifacts/{artifactId}/download-plan
responseSchema: ArtifactDownloadPlan
servesBytes: false
nextRequest:
method: GET
url: https://huggingbay.xyz/api/downloads/{artifactId}/{path}
note: Use an exact hosted file path returned by the plan; never infer a filename or availability.
x-agent-reads:
summary: User fetchers and OAI-SearchBot may read find, plan and search APIs. Bulk crawlers use public metadata. Private/export/byte routes stay excluded. Authentication, byte guards and rate limits apply.
userFetchers:
- ChatGPT-User
- Claude-User
- Perplexity-User
- Google-Agent
- Google-GeminiNotebook
- MistralAI-User
searchCrawlers:
- OAI-SearchBot
readEndpoints:
- https://huggingbay.xyz/api/agents/find-model
- https://huggingbay.xyz/api/agents/find-runnable
- https://huggingbay.xyz/api/agents/deployment-plan
- https://huggingbay.xyz/api/v1/search
- https://huggingbay.xyz/api/search
# --- truncated at 32 KB (54 KB total) ---
# Full source: https://artifacts.apis.io/huggingbay-xyz/openapi/huggingbay-xyz-sandbox-api-openapi.yml