robosystems-ai Graph QL API

openapi: 3.2.0
info:
  title: RoboSystems GraphQL API
  description: 'The REST and GraphQL API for RoboSystems — an open-source, AI-native platform for accounting, financial reporting and investment management. It powers RoboLedger and RoboInvestor.


    ## Two surfaces


    **Platform** — `/v1/…` — graphs, queries, schema, documents, search, memory, connections, billing and access. Reads are REST `GET`s; every write is a named operation at `/operations/{name}` returning an `OperationEnvelope`, accepting an `Idempotency-Key`, and streaming progress at `/v1/operations/{id}/stream`.

    → API reference


    **Extensions** — `/extensions/…` — RoboLedger and RoboInvestor, scoped by `graph_id` in the URL. Reads are GraphQL at `POST /extensions/{graph_id}/graphql` and change nothing; writes are named operations at `/extensions/{domain}/{graph_id}/operations/{name}`; analytical views read the materialized graph.

    → Extensions reference · every GraphQL query


    ## Authenticating


    `X-API-Key: rfs…` on REST, GraphQL and per-graph MCP. Browser sessions use JWTs from `POST /v1/auth/login`. The graph-agnostic MCP endpoint `/v1/mcp` takes OAuth 2.1 bearer tokens only.


    ## Connecting an AI client


    Every graph is an MCP server at `POST /v1/graphs/{graph_id}/mcp`, and `POST /v1/mcp` serves OAuth clients that pick their graph at consent.

    → MCP guide


    ## Clients


    `robosystems-client` for Python, `@robosystems/client` for TypeScript.

    → Guides · Technical docs'
  version: 1.20.6
tags:
- name: Graph QL
  description: 🧩 GraphQL endpoint - Unified GraphQL endpoint for extensions read queries
paths:
  /extensions/{graph_id}/graphql:
    get:
      tags:
      - Graph QL
      summary: GraphQL explorer (development only)
      operationId: handle_http_get_extensions__graph_id__graphql_get
      security:
      - APIKeyHeader: []
      - BearerAuth: []
      parameters:
      - name: graph_id
        in: path
        required: true
        schema:
          type: string
          pattern: ^(kg[a-f0-9]{16,}(?:_[a-zA-Z0-9]{1,20})?|sec(?:_[a-zA-Z0-9]{1,20})?|library)$
          title: Graph Id
      responses:
        '200':
          description: The GraphiQL integrated development environment.
          content:
            application/json:
              schema: {}
        '404':
          description: Not found if GraphiQL or query via GET are not enabled.
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '401':
          description: Unauthorized — credentials presented but invalid
        '403':
          description: Forbidden — caller cannot access this graph
        '429':
          description: Rate limit exceeded
      description: 'Serves the in-browser GraphiQL explorer on deployments that enable it, which is development only — it is not mounted on the hosted API. Run queries with `POST` to the same URL.


        Queries are scoped by the URL: `graph_id` is a path parameter and never a query argument, so a document cannot name a graph that disagrees with the path it was sent to. Reads hit the operational (OLTP) extensions database, so they reflect the books as they stand now; the analytical projection is Cypher at `POST /v1/graphs/{graph_id}/query/cypher`.


        The schema is composed per deployment: ledger fields require RoboLedger and investor fields require RoboInvestor, and a disabled domain is absent from introspection rather than failing at runtime. Every field carries a description, so introspection is the authoritative, deployment-specific reference.


        **Auth**: pass `X-API-Key` (or a JWT `Authorization: Bearer` header). Unauthenticated introspection queries are deliberately allowed for SDK codegen; data queries require credentials and raise `UNAUTHENTICATED`.


        **Error codes**: `LEDGER_NOT_INITIALIZED`, `INVESTOR_NOT_INITIALIZED`, and `UNAUTHENTICATED` surface in the GraphQL `errors[].extensions.code` field. GraphQL reports errors with HTTP 200 and a populated `errors[]`, so check that array rather than the status code.'
    post:
      tags:
      - Graph QL
      summary: Run a GraphQL query
      operationId: handle_http_post_extensions__graph_id__graphql_post
      security:
      - APIKeyHeader: []
      - BearerAuth: []
      parameters:
      - name: graph_id
        in: path
        required: true
        schema:
          type: string
          pattern: ^(kg[a-f0-9]{16,}(?:_[a-zA-Z0-9]{1,20})?|sec(?:_[a-zA-Z0-9]{1,20})?|library)$
          title: Graph Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '401':
          description: Unauthorized — credentials presented but invalid
        '403':
          description: Forbidden — caller cannot access this graph
        '429':
          description: Rate limit exceeded
      description: 'The typed read surface for a graph''s extensions data — RoboLedger and RoboInvestor records as they stand right now. Writes are not here: they are the named operations at `POST /extensions/{domain}/{graph_id}/operations/{name}`.


        Send a standard GraphQL POST body: a `query` document, with optional `variables` and `operationName`.


        Queries are scoped by the URL: `graph_id` is a path parameter and never a query argument, so a document cannot name a graph that disagrees with the path it was sent to. Reads hit the operational (OLTP) extensions database, so they reflect the books as they stand now; the analytical projection is Cypher at `POST /v1/graphs/{graph_id}/query/cypher`.


        The schema is composed per deployment: ledger fields require RoboLedger and investor fields require RoboInvestor, and a disabled domain is absent from introspection rather than failing at runtime. Every field carries a description, so introspection is the authoritative, deployment-specific reference.


        **Auth**: pass `X-API-Key` (or a JWT `Authorization: Bearer` header). Unauthenticated introspection queries are deliberately allowed for SDK codegen; data queries require credentials and raise `UNAUTHENTICATED`.


        **Error codes**: `LEDGER_NOT_INITIALIZED`, `INVESTOR_NOT_INITIALIZED`, and `UNAUTHENTICATED` surface in the GraphQL `errors[].extensions.code` field. GraphQL reports errors with HTTP 200 and a populated `errors[]`, so check that array rather than the status code.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - query
              properties:
                query:
                  type: string
                  description: The GraphQL document to execute.
                variables:
                  type: object
                  additionalProperties: true
                  description: Values for the document's variables.
                operationName:
                  type: string
                  description: Which operation to run, when the document declares more than one.
            examples:
              fiscal_calendar:
                summary: What is blocking the close
                value:
                  query: '{ fiscalCalendar { closedThrough closeTarget closeableNow blockers } }'
              paginated_with_variables:
                summary: A filtered, paginated list
                value:
                  query: 'query Agents($type: String, $limit: Int) { agents(agentType: $type, limit: $limit) { id name } }'
                  variables:
                    type: customer
                    limit: 10
              introspect:
                summary: Discover this deployment's fields
                value:
                  query: '{ __schema { queryType { fields { name description } } } }'
components:
  schemas:
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
  securitySchemes:
    APIKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key for authentication
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT bearer token