GET /api/org/exports — the org-export ledger read model (0089): newest-first list over the exports the org has created so /settings/export grows its list/archive surface over real history.

Parameters

Responses

Security: bearer

POST /api/org/exports — builds the versioned bundle, streams it into the ObjectStore, and returns the signed download link.

Responses

Security: bearer

PATCH /api/org/exports/{export_id} — archives (or restores) ONE ledger row; a pure read-model toggle over the row, content untouched.

Parameters

Request body

ExportArchiveUpdate

Responses

Security: bearer

POST /api/org/exports/{export_id}/download-link — mints ONE fresh 15-minute signed link for a LEDGERED export (the link is never stored — this is the per-row download affordance the history surface uses).

Parameters

Responses

Security: bearer

GET /api/org/exports/{org_id}/{export_id}/download — streams the stored bundle. Authenticated by the signed link alone (no JWT): an expired or forged token is an unauthorized request, indistinguishable between the two. The org id is IN the path (and inside the signature) so a token authorizes exactly one (org, export, expiry) triple.

Parameters

Responses

GET /api/org/manifest — the org's customization manifest.

Owner/admin gated (policy §5: the manifest is an org-level administrative artifact; technicians and dispatchers have no business reading the full customization inventory, e.g. webhook URLs).

Responses

Security: bearer

`GET /api/v1/orgs/{org_id}/custom-domain` — current state + verification status + provider-plugin availability.

Parameters

Responses

Security: bearer

`POST /api/v1/orgs/{org_id}/custom-domain` — claim a domain.

Parameters

Request body

SetCustomDomainRequest

Responses

Security: bearer

`DELETE /api/v1/orgs/{org_id}/custom-domain` — clear the domain.

Parameters

Responses

Security: bearer

`POST /api/v1/orgs/{org_id}/custom-domain/verify` — run the generic DNS verification (the private build tracker A8 (C)). The TXT token is the authority; the A/CNAME leg is plausibility only.

Parameters

Responses

Security: bearer

GET /api/v1/orgs/{org_id}/quotas — usage beside configured limits.

Informational by construction: a percentage here is a measurement, and nothing in the core reads this endpoint to limit anything. `limits` is a real configuration read — an org that has configured none reports `false`, because a default limit is a fake gate.

Parameters

Responses

Security: bearer

`GET /api/v1/orgs/{org_id}/suspension-status` — the org's notice state.

Parameters

Responses

Security: bearer

`PATCH /api/v1/orgs/{org_id}/suspension-status` — set or clear the flag (`admin:edit`). Idempotent; emits `org.suspension_changed` + an audit row.

Parameters

Request body

SetSuspensionRequest

Responses

Security: bearer

GET /api/v1/orgs/{org_id}/usage — the org's current usage counts.

`refreshed_at` is when the numbers were computed; a consumer that needs fresh numbers reads the row's own timestamp instead of assuming. `unavailable` names every metric this build cannot compute honestly, with the reason — it is a real, renderable list, not a placeholder.

Parameters

Responses

Security: bearer