philidor-io System API

openapi: 3.2.0
info:
  title: Philidor Io System API
  version: 1.2.0
  description: 'Operations tagged System across 2 of this provider''s published API definitions: philidor-openapi.json, philidor-io-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.philidor.io
  description: Production
- url: http://localhost:3003
  description: Local
tags:
- name: System
paths:
  /v1/health:
    get:
      tags:
      - System
      summary: Health check
      responses:
        '200':
          description: Health status
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HealthResponse'
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
        '429':
          description: Rate limit exceeded; retry after Retry-After seconds
          headers:
            Retry-After:
              $ref: '#/components/headers/Retry-After'
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
      - {}
      - ApiKeyAuth: []
      operationId: getV1Health
      parameters:
      - name: X-Request-Id
        in: header
        required: false
        schema:
          type: string
          pattern: ^[A-Za-z0-9_-]{1,64}$
        description: Optional correlation id, echoed unchanged when valid; otherwise a UUID is generated.
    servers:
    - url: https://api.philidor.io
      description: Production
    - url: http://localhost:3003
      description: Local
  /v1/status:
    get:
      tags:
      - System
      summary: Platform status
      responses:
        '200':
          description: Current platform status and rolling uptime percentages.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusResponse'
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
        '429':
          description: Rate limit exceeded; retry after Retry-After seconds
          headers:
            Retry-After:
              $ref: '#/components/headers/Retry-After'
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
      - {}
      - ApiKeyAuth: []
      operationId: getV1Status
      parameters:
      - name: X-Request-Id
        in: header
        required: false
        schema:
          type: string
          pattern: ^[A-Za-z0-9_-]{1,64}$
        description: Optional correlation id, echoed unchanged when valid; otherwise a UUID is generated.
    servers:
    - url: https://api.philidor.io
      description: Production
    - url: http://localhost:3003
      description: Local
components:
  headers:
    Retry-After:
      description: Seconds to wait before retrying (429, 503, 504).
      schema:
        type: integer
        minimum: 0
    X-RateLimit-Limit:
      description: Requests allowed in the active window for this caller.
      schema:
        type: integer
    X-RateLimit-Reset:
      description: Unix timestamp (seconds) when the window resets.
      schema:
        type: integer
    X-RateLimit-Remaining:
      description: Requests remaining in the active window.
      schema:
        type: integer
    X-Request-Id:
      description: Correlation id for the request. A valid inbound X-Request-Id (1-64 word characters or dashes) is echoed; otherwise one is generated. Quote it when reporting a failure.
      schema:
        type: string
  schemas:
    StatusResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            status:
              $ref: '#/components/schemas/PlatformStatus'
            rollup:
              allOf:
              - $ref: '#/components/schemas/PlatformStatus'
              - description: The worst status across every component row, including the event stream, webhooks and data freshness.
            last_checked_at:
              type:
              - string
              - 'null'
              format: date-time
              description: Timestamp of the latest SLA heartbeat, or null when no heartbeat exists.
            uptime:
              type: object
              properties:
                24h:
                  type: number
                  minimum: 0
                  maximum: 100
                  description: Rolling 24-hour uptime percentage when enough heartbeat history exists.
                30d:
                  type: number
                  minimum: 0
                  maximum: 100
                  description: Rolling 30-day uptime percentage when enough heartbeat history exists.
                90d:
                  type: number
                  minimum: 0
                  maximum: 100
                  description: Rolling 90-day uptime percentage when enough heartbeat history exists.
              description: Rolling uptime percentages computed with the same MUP interval math used for SLA reports. Keys are omitted when the window does not have enough history.
            components:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    description: api (loopback heartbeat), reachability (off-box probe), errors (5xx rate over 15 min), events_stream, webhooks, data_freshness.
                  status:
                    $ref: '#/components/schemas/PlatformStatus'
                  detail:
                    type: string
                  checked_at:
                    type:
                    - string
                    - 'null'
                    format: date-time
                required:
                - name
                - status
                - detail
                - checked_at
              description: Per-component health. `status` rolls up the first three rows; `rollup` rolls up all of them.
            signals:
              type: object
              properties:
                error_rate_15m:
                  type: number
                  minimum: 0
                  maximum: 1
                requests_15m:
                  type: integer
                  minimum: 0
                external_down_samples:
                  type: integer
                  minimum: 0
              required:
              - error_rate_15m
              - requests_15m
              - external_down_samples
              description: The raw inputs behind the component rows.
          required:
          - status
          - rollup
          - last_checked_at
          - uptime
          - components
          - signals
      required:
      - data
    PlatformStatus:
      type: string
      enum:
      - operational
      - degraded
      - down
      description: 'Platform health: the worst of the api (loopback heartbeat), reachability (off-box probe) and errors (5xx rate) components. Delivery-surface rows do not move this field; see `rollup`.'
    ErrorEnvelope:
      description: Error body. `legacy_code` is present for one compatibility release when an older endpoint previously emitted a lowercase route-specific code.
      type: object
      required:
      - error
      properties:
        error:
          type: object
          required:
          - code
          - message
          - request_id
          properties:
            code:
              type: string
              pattern: ^[A-Z][A-Z0-9_]*$
              example: NOT_FOUND
            message:
              type: string
              example: Vault not found
            request_id:
              type: string
              description: Correlation id, also in the X-Request-Id header.
            legacy_code:
              type: string
              description: Previous lowercase code during the one-release migration window.
            pricing_url:
              type: string
              description: Present on a tier gate. Same URL as refusal.upgrade_url.
            refusal:
              description: Present on 401/403 for a gated data family (PHI-312). Same object as one row of GET /v1/access/families. x402_price is null until pay-per-request is live.
              type: object
              required:
              - restricted_fields
              - family
              - required_plan
              - upgrade_url
              - x402_price
              properties:
                restricted_fields:
                  type: array
                  items:
                    type: string
                family:
                  type: string
                required_plan:
                  type:
                  - string
                  - 'null'
                  enum:
                  - Free
                  - Analyst
                  - Pro
                  - Data
                  - Decisioning
                  - Embedded
                  - null
                upgrade_url:
                  type: string
                  example: https://philidor.io/pricing
                x402_price:
                  type: 'null'
          additionalProperties: true
    HealthResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            status:
              type: string
            version:
              type: string
            vaultCount:
              type: number
            lastSync:
              type:
              - string
              - 'null'
            timestamp:
              type: string
            lastScoreRun:
              type:
              - object
              - 'null'
              properties:
                completedAt:
                  type:
                  - string
                  - 'null'
                failSafeMode:
                  type:
                  - string
                  - 'null'
              required:
              - completedAt
              - failSafeMode
            assetRegistryCoverage:
              type:
              - object
              - 'null'
              properties:
                totalExposures:
                  type: number
                withAssetVersion:
                  type: number
                coveragePercent:
                  type: number
              required:
              - totalExposures
              - withAssetVersion
              - coveragePercent
            assetIdentityCoverage:
              type:
              - object
              - 'null'
              properties:
                identityBasis:
                  type: string
                  enum:
                  - chain_and_address
                  description: Identity model. `assetRegistryCoverage` is address-only and credits one address deployed on several chains as covered when any single chain carries an approved version; this counter keys on (chain, address) and does not.
                totalIdentities:
                  type: number
                withApprovedVersion:
                  type: number
                coveragePercent:
                  type: number
                byChain:
                  type: array
                  items:
                    type: object
                    properties:
                      chainId:
                        type: number
                      totalIdentities:
                        type: number
                      withApprovedVersion:
                        type: number
                      coveragePercent:
                        type: number
                    required:
                    - chainId
                    - totalIdentities
                    - withApprovedVersion
                    - coveragePercent
                  description: Per-chain rows, worst coverage first, so a low-coverage chain cannot be averaged away by the aggregate.
                computedAt:
                  type:
                  - string
                  - 'null'
                  description: When the measurement was taken. Computed by a worker once per cycle, not per request, so a value here can be minutes old.
              required:
              - identityBasis
              - totalIdentities
              - withApprovedVersion
              - coveragePercent
              - byChain
              - computedAt
            assetRegistryQueueBacklog:
              type:
              - number
              - 'null'
            evidenceSigner:
              type: object
              properties:
                status:
                  type: string
                  enum:
                  - ready
                  - missing_config
                  - unhealthy
                  - unregistered
                keyId:
                  type:
                  - string
                  - 'null'
                signerAddress:
                  type:
                  - string
                  - 'null'
              required:
              - status
              - keyId
              - signerAddress
          required:
          - status
          - version
          - vaultCount
          - lastSync
          - timestamp
          - lastScoreRun
          - assetRegistryCoverage
          - assetIdentityCoverage
          - assetRegistryQueueBacklog
          - evidenceSigner
      required:
      - data
  securitySchemes:
    IndexTokenAuth:
      type: http
      scheme: bearer
      description: Separate index preview/client token. Commercial API keys do not unlock private index routes.
    ApiKeyAuth:
      type: http
      scheme: bearer
      description: 'Philidor API key (`Authorization: Bearer pk_live_...`). Optional on public endpoints, where it raises rate limits and unlocks tiered capabilities. The administrative surfaces additionally require operator-set metadata.admin_surface=true; mutations require metadata.admin_role=admin_editor or admin_operator under the same write-role enforcement as admin sessions. A plan tier alone never grants administrative access.'
    AdminCookieAuth:
      type: apiKey
      in: cookie
      name: philidor_admin_session
      description: Administrative session. Additionally IP-allowlisted.
    DashboardCookieAuth:
      type: apiKey
      in: cookie
      name: philidor_dashboard_session
      description: Dashboard session cookie (httpOnly).
x-refined-from:
- philidor-openapi.json
- philidor-io-openapi.json