← Back to architecture

HTTP API

front↔back contract · surface map
API surfaces

Internal /api/v1 — our shells (Web App, Admin Panel).
External /public/v1 — a curated slice of the same engine (Public API).
The concrete contract — in the owner's tests.html.

Resource family Tier Owner
session · users · api-keys · invites · messenger-link · password · audit /api/v1 Auth / Security
conversations · messages (SSE) · chat-models /api/v1 Query Engine
agents · agent-runs /api/v1 Agent Engine
retrieval: vector · lexical · graph · sql · hybrid /api/v1 Knowledge Store
KS-admin: sources · reindex · re-embed · backup · restore /api/v1 Knowledge Store
sources · connectors · sync-runs · test-connection /api/v1 Harvester
ai: providers · models · assignments · tools · discovery /api/v1 AI Foundation
inbox · feed · unread (personal) /api/v1 Notifications
config: platform-settings · ai-prompt · usage/budgets · channels /api/v1 Admin Panel · facade
slack: events (webhook) · admin/slack /api/v1 Slack
telegram: webhook · admin/telegram /api/v1 Telegram
admin/mattermost (no webhook — dial-out listener) /api/v1 Mattermost
search · ask v2 /public/v1 Public API
search_knowledge (JSON-RPC, streamable HTTP) /mcp MCP
events: stream (SSE · push nudges) /api/v1 this layer · Live updates
health · version infra layer · backend/api/

Admin Panel and Web App are facades: they hold no domain resources of their own, bringing owners' contracts together under a role. The Admin row is about the /admin/* config surface, not ownership.

Common rules

Workzone Design

The layer's own mechanics: the platform push channel that keeps live boards fresh, and the conformance suite enforcing the rules above — error shape, UTC, pagination and rate limit checked parametrically across all routers, not by a copy in each module.