Keystones
GET / POST / DELETE /api/v1/keystones — mandatory governance rules.
Keystones are MANDATORY policy rules served to every agent on session start. See Concepts → Keystones for what they're for and how scope + weight + trust gating work.
List
Open (no trust gate). The plugin fetches this on every session boot.
Authorization
APIKeyHeader In: header
Query Parameters
C30/D1 opt-in: return {count, items} instead of the bare array. The bare array stays the default until a separate announced deprecation wave.
falseResponse Body
application/json
application/json
application/json
application/json
curl -X GET "https://loading/api/v1/keystones?tenant_id=string"[
{
"id": "string",
"tenant_id": "string",
"fleet_id": "string",
"collection": "string",
"doc_id": "string",
"data": {
"title": "string",
"content": "string",
"weight": 0,
"scope": "string",
"agent_id": "string",
"author_user_id": "string"
},
"created_at": "string",
"updated_at": "string"
}
]{
"detail": "string",
"error": {
"code": "string",
"message": "string",
"details": {}
}
}{
"detail": "string",
"error": {
"code": "string",
"message": "string",
"details": {}
}
}{
"detail": [
{
"loc": [
"string"
],
"msg": "string",
"type": "string",
"input": null,
"ctx": {}
}
]
}Upsert
Trust ≥ 1 for scope=agent targeting the caller's own agent_id; trust ≥ 2 otherwise.
Authorization
APIKeyHeader In: header
Header Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://loading/api/v1/keystones" \ -H "Content-Type: application/json" \ -d '{ "tenant_id": "string", "doc_id": "string", "title": "string", "content": "string", "scope": "tenant", "weight": "low" }'{
"id": "string",
"tenant_id": "string",
"fleet_id": "string",
"collection": "string",
"doc_id": "string",
"data": {
"title": "string",
"content": "string",
"weight": 0,
"scope": "string",
"agent_id": "string",
"author_user_id": "string"
},
"created_at": "string",
"updated_at": "string"
}{
"detail": "string",
"error": {
"code": "string",
"message": "string",
"details": {}
}
}{
"detail": "string",
"error": {
"code": "string",
"message": "string",
"details": {}
}
}{
"detail": [
{
"loc": [
"string"
],
"msg": "string",
"type": "string",
"input": null,
"ctx": {}
}
]
}Delete
Same dynamic trust gating as upsert. The platform fetches the stored row first to read its scope/agent_id before computing the required trust level.
Authorization
APIKeyHeader In: header
Path Parameters
^[a-z0-9][a-z0-9._-]{0,99}$Query Parameters
Header Parameters
Response Body
application/json
application/json
application/json
application/json
curl -X DELETE "https://loading/api/v1/keystones/string?tenant_id=string"{
"deleted": true,
"doc_id": "string"
}{
"detail": "string",
"error": {
"code": "string",
"message": "string",
"details": {}
}
}{
"detail": "string",
"error": {
"code": "string",
"message": "string",
"details": {}
}
}{
"detail": [
{
"loc": [
"string"
],
"msg": "string",
"type": "string",
"input": null,
"ctx": {}
}
]
}