philidor-io Methodology API

openapi: 3.2.0
info:
  title: Philidor Io Methodology API
  version: 1.2.0
  description: 'Operations tagged Methodology across 2 of this provider''s published API definitions: philidor-openapi.json, philidor-io-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.philidor.io
  description: Production
- url: http://localhost:3003
  description: Local
tags:
- name: Methodology
paths:
  /v1/methodology:
    get:
      tags:
      - Methodology
      summary: Per-category scoring methodology + version registry
      description: Public registry of methodology versions (effective windows, changelogs, and dated corrections) plus the per-category dimension weight vectors in force. At most one version is in force at any instant, and current_version is null if the registry has a gap. The weight vectors are not versioned, so scores written under a superseded version cannot be reconstructed from this endpoint; each version reports this as `reconstructible`.
      responses:
        '200':
          description: Methodology registry
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MethodologyResponse'
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
        '429':
          description: Rate limit exceeded; retry after Retry-After seconds
          headers:
            Retry-After:
              $ref: '#/components/headers/Retry-After'
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
      - {}
      - ApiKeyAuth: []
      operationId: getV1Methodology
      parameters:
      - name: X-Request-Id
        in: header
        required: false
        schema:
          type: string
          pattern: ^[A-Za-z0-9_-]{1,64}$
        description: Optional correlation id, echoed unchanged when valid; otherwise a UUID is generated.
    servers:
    - url: https://api.philidor.io
      description: Production
    - url: http://localhost:3003
      description: Local
  /v1/methodology/vault:
    get:
      tags:
      - Methodology
      summary: Vault composite scoring methodology — the four risk vectors
      description: 'The published vault score is a weighted composite of four risk vectors: Asset (30%), Platform (30%), Control (20%) and History (20%). This endpoint publishes those weights, what each vector measures, the registered methodology version and its provenance hash, the penalty-only History overlay targeting 25% sensitivity around a neutral History score of 10 (applied to the unrounded composite, then rounded once), and the post-composite caps that can lower the resulting score. Weights come from the same frozen constant the scoring engine aggregates, so this cannot drift from what actually ran.'
      responses:
        '200':
          description: Vault composite methodology
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VaultMethodologyResponse'
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
        '429':
          description: Rate limit exceeded; retry after Retry-After seconds
          headers:
            Retry-After:
              $ref: '#/components/headers/Retry-After'
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
      - {}
      - ApiKeyAuth: []
      operationId: getV1MethodologyVault
      parameters:
      - name: X-Request-Id
        in: header
        required: false
        schema:
          type: string
          pattern: ^[A-Za-z0-9_-]{1,64}$
        description: Optional correlation id, echoed unchanged when valid; otherwise a UUID is generated.
    servers:
    - url: https://api.philidor.io
      description: Production
    - url: http://localhost:3003
      description: Local
components:
  schemas:
    MethodologyResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            versions:
              type: array
              items:
                $ref: '#/components/schemas/MethodologyVersionEntry'
            current_version:
              type:
              - string
              - 'null'
            categories:
              type: array
              items:
                type: string
            dimensions:
              type: array
              items:
                type: string
            weights_by_category:
              type: object
              additionalProperties:
                type: object
                additionalProperties:
                  type: number
          required:
          - versions
          - current_version
          - categories
          - dimensions
          - weights_by_category
      required:
      - data
    VaultMethodologyResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            version:
              type: number
              example: 3
            methodology_hash:
              type: string
              description: Hash written into every score run, tying a published score to this exact rubric.
            vectors:
              type: array
              items:
                type: object
                properties:
                  key:
                    type: string
                    example: history
                  name:
                    type: string
                    example: History
                  weight:
                    type: number
                    example: 0.2
                  measures:
                    type: string
                required:
                - key
                - name
                - weight
                - measures
            history_penalty_overlay:
              type: object
              properties:
                target_history_weight:
                  type: number
                base_history_weight:
                  type: number
                neutral_history_score:
                  type: number
                formula:
                  type: string
                applied_before:
                  type: string
              required:
              - target_history_weight
              - base_history_weight
              - neutral_history_score
              - formula
              - applied_before
            post_composite_caps:
              type: array
              items:
                type: object
                properties:
                  key:
                    type: string
                  cap:
                    type:
                    - number
                    - 'null'
                    description: Ceiling imposed on the composite. Null when the ceiling is carried on the triggering record rather than fixed.
                  applies_when:
                    type: string
                required:
                - key
                - cap
                - applies_when
            notes:
              type: object
              properties:
                curator:
                  type: string
                provenance:
                  type: string
              required:
              - curator
              - provenance
          required:
          - version
          - methodology_hash
          - vectors
          - history_penalty_overlay
          - post_composite_caps
          - notes
      required:
      - data
    ErrorEnvelope:
      description: Error body. `legacy_code` is present for one compatibility release when an older endpoint previously emitted a lowercase route-specific code.
      type: object
      required:
      - error
      properties:
        error:
          type: object
          required:
          - code
          - message
          - request_id
          properties:
            code:
              type: string
              pattern: ^[A-Z][A-Z0-9_]*$
              example: NOT_FOUND
            message:
              type: string
              example: Vault not found
            request_id:
              type: string
              description: Correlation id, also in the X-Request-Id header.
            legacy_code:
              type: string
              description: Previous lowercase code during the one-release migration window.
            pricing_url:
              type: string
              description: Present on a tier gate. Same URL as refusal.upgrade_url.
            refusal:
              description: Present on 401/403 for a gated data family (PHI-312). Same object as one row of GET /v1/access/families. x402_price is null until pay-per-request is live.
              type: object
              required:
              - restricted_fields
              - family
              - required_plan
              - upgrade_url
              - x402_price
              properties:
                restricted_fields:
                  type: array
                  items:
                    type: string
                family:
                  type: string
                required_plan:
                  type:
                  - string
                  - 'null'
                  enum:
                  - Free
                  - Analyst
                  - Pro
                  - Data
                  - Decisioning
                  - Embedded
                  - null
                upgrade_url:
                  type: string
                  example: https://philidor.io/pricing
                x402_price:
                  type: 'null'
          additionalProperties: true
    MethodologyCorrection:
      type: object
      properties:
        corrected_at:
          type: string
        field:
          type: string
        note:
          type: string
        author:
          type: string
      required:
      - corrected_at
      - field
      - note
      - author
    MethodologyVersionEntry:
      type: object
      properties:
        version:
          type: string
        effective_from:
          type: string
        effective_to:
          type:
          - string
          - 'null'
        changelog:
          type: string
        approved_by:
          type: string
        status:
          type: string
          enum:
          - in_force
          - scheduled
          - superseded
        reconstructible:
          type: boolean
        corrections:
          type: array
          items:
            $ref: '#/components/schemas/MethodologyCorrection'
      required:
      - version
      - effective_from
      - effective_to
      - changelog
      - approved_by
      - status
      - reconstructible
      - corrections
  headers:
    Retry-After:
      description: Seconds to wait before retrying (429, 503, 504).
      schema:
        type: integer
        minimum: 0
    X-RateLimit-Limit:
      description: Requests allowed in the active window for this caller.
      schema:
        type: integer
    X-RateLimit-Reset:
      description: Unix timestamp (seconds) when the window resets.
      schema:
        type: integer
    X-RateLimit-Remaining:
      description: Requests remaining in the active window.
      schema:
        type: integer
    X-Request-Id:
      description: Correlation id for the request. A valid inbound X-Request-Id (1-64 word characters or dashes) is echoed; otherwise one is generated. Quote it when reporting a failure.
      schema:
        type: string
  securitySchemes:
    IndexTokenAuth:
      type: http
      scheme: bearer
      description: Separate index preview/client token. Commercial API keys do not unlock private index routes.
    ApiKeyAuth:
      type: http
      scheme: bearer
      description: 'Philidor API key (`Authorization: Bearer pk_live_...`). Optional on public endpoints, where it raises rate limits and unlocks tiered capabilities. The administrative surfaces additionally require operator-set metadata.admin_surface=true; mutations require metadata.admin_role=admin_editor or admin_operator under the same write-role enforcement as admin sessions. A plan tier alone never grants administrative access.'
    AdminCookieAuth:
      type: apiKey
      in: cookie
      name: philidor_admin_session
      description: Administrative session. Additionally IP-allowlisted.
    DashboardCookieAuth:
      type: apiKey
      in: cookie
      name: philidor_dashboard_session
      description: Dashboard session cookie (httpOnly).
x-refined-from:
- philidor-openapi.json
- philidor-io-openapi.json