Essence Instance Service API
API for managing Essence Platform instances (Global, Sovereign, Organization). Multi-instance architecture with federation support. ## Architecture - **Global Instance**: Central instance for cross-organization features - **Sovereign Instance**: Self-hosted instances with data sovereignty - **Organization Instance**: Dedicated instances for enterprise customers ## Features - Instance lifecycle management (creation, configuration, monitoring) - Federation between instances with trust relationships - User management with multi-instance support - Message queuing and synchronization
Generated from the Instance service's code at build time (api-specs/generated/Instance/Essence.Core.Instance.Api.json) and drift-checked in CI. It describes what the code registers, which is not the same as what any one deployment has routed.
AdminOrganizations
/api/v1/admin/organizationsCreates a non-dedicated (shared-instance) organisation registry entry and publishes the standard `OrganizationCreatedEvent` bootstrap fan-out (Vault default vault, Billing B2B trial, TenantConfiguration defaults, Compliance profile, ModuleRegistry base modules). The caller-supplied Essence.Core.Instance.Api.Controllers.AdminCreateOrganizationRequest.OrgAdminUserId becomes the organisation's default-vault owner and B2B trial subscriber — grant it the `org-admin` role afterwards via `POST /api/v1/admin/users/{idOrEmail}/roles` to complete the "seed an org-admin member" fixture (the RBAC role and the event-driven bootstrap are separate concerns; this endpoint does not duplicate the role-grant surface that already exists).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
AdminCreateOrganizationRequestasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetailsProblemDetailsProblemDetailsCertificates
/api/v1/Certificates/expiringRetrieves certificates that are expiring within a specified number of days.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
daysUntilExpiration | query | integer (int32) | no | Number of days until expiration (default: 30) |
Request body
No request body.
Responses
CertificateDto[]ProblemDetails/api/v1/Certificates/issueIssues a new certificate (intermediate or leaf).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
IssueCertificateRequestasapplication/*+json,application/json,text/json
Responses
IssueCertificateResponseProblemDetailsProblemDetails/api/v1/Certificates/{thumbprint}Retrieves a certificate by thumbprint.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
thumbprint | path | string | yes | Certificate thumbprint |
Request body
No request body.
Responses
CertificateDtoProblemDetailsProblemDetails/api/v1/Certificates/{thumbprint}/revokeRevokes a certificate.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
thumbprint | path | string | yes | Certificate thumbprint |
Request body
Not marked as required in the document.
RevokeCertificateRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsProblemDetailsCommercial
/api/v1/commercial/countriesLists all supported countries from the reference data table. Used by the instance creation wizard for country selection.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
/api/v1/commercial/invoicesLists all invoices for the specified organization.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | query | string (uuid) | no | — |
Request body
No request body.
Responses
ProblemDetails/api/v1/commercial/licensesLists all module licenses for the specified organization.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | query | string (uuid) | no | — |
Request body
No request body.
Responses
ProblemDetails/api/v1/commercial/partnersLists all active partners from the Partner Portal Service. Available to any authenticated user (needed during instance creation wizard).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
ProblemDetails/api/v1/commercial/pricing-plansLists all active pricing plans from the Billing Service. Available to any authenticated user (needed during instance creation wizard).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
ProblemDetails/api/v1/commercial/pricing-plans/{id}Updates a pricing plan (Admin only) — e.g. the Free plan's storage quota / base price. Proxies to the Billing service PUT endpoint. Fields omitted from the body are left unchanged; a supplied `features` map replaces the plan's features wholesale.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
UpdatePricingPlanRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/commercial/subscriptionsLists all subscriptions for the specified organization.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | query | string (uuid) | no | — |
Request body
No request body.
Responses
ProblemDetails/api/v1/commercial/usageRetrieves usage breakdown for a given billing period.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
period | query | string | no | — |
subscriptionId | query | string (uuid) | no | — |
Request body
No request body.
Responses
ProblemDetailsCompliance
/api/v1/compliance/assessmentsAuthentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
/api/v1/compliance/assessments/{id}Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProblemDetails/api/v1/compliance/audit-logOne filtered, paged slice of the platform audit log, from the Compliance service that owns it.
Every filter below used to be accepted and then dropped: the call downstream took only `page` and `pageSize`, so an investigator who narrowed by actor, action or date got the unfiltered first page back and no indication of it. On an evidential surface that turns "no results" into a statement about the log rather than about the query. The owning service does not expose a parameter for every filter this console offers. Those are named back in `unsupportedFilters` so the surface can say which part of the question went unasked, instead of presenting an unfiltered page as a filtered one.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
startDate | query | string (date-time) | no | — |
endDate | query | string (date-time) | no | — |
actor | query | string | no | — |
actionType | query | string | no | — |
resourceType | query | string | no | — |
service | query | string | no | — |
organizationId | query | string | no | — |
search | query | string | no | — |
page | query | integer (int32) | no | — |
pageSize | query | integer (int32) | no | — |
Request body
No request body.
Responses
/api/v1/compliance/evidenceCollected compliance evidence, optionally scoped to a single assessment.
This endpoint returned 501 until the owning service had a read it could use. The earlier note here said the Compliance service exposed no evidence endpoint, which was wrong - EvidenceController existed and served /api/v1/Evidence, and a grep for the word "evidence" in its route attributes could not find it because the routes are [controller]-derived. The conclusion held for a different reason: the only read was GET /api/v1/Evidence/control/{controlId}, and this endpoint is asked for evidence by ASSESSMENT or for everything, so there was no control id to scope to. Worse, that per-control route had no MediatR handler at all, so it would have thrown had anything called it. Both are now fixed: the owning service has the handler and a paged GET /api/v1/Evidence that accepts an assessment or instance scope, resolving an assessment to its regulation's controls on its own side. An unreachable owner is still reported as unavailable, never as an empty list. "No evidence has been recorded" is a claim an auditor could rely on, and this endpoint is only in a position to make it when the owning service actually said so.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
assessmentId | query | string (uuid) | no | — |
page | query | integer (int32) | no | — |
pageSize | query | integer (int32) | no | — |
Request body
No request body.
Responses
/api/v1/compliance/overviewReturns a placeholder compliance overview. Real scores will be projected from the EPIC 12 assessment repository once it lands.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
CredentialLockdown
/api/v1/credential-lockdown/compromisedFlags a presented physical credential compromised (report stolen), locking it down and notifying the relying parties it was presented to.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
FlagPresentedCredentialCompromisedCommandasapplication/*+json,application/json,text/json
Responses
CredentialLockdownResponseProblemDetailsProblemDetailsCrossBorder
/api/v1/cross-border/driving-entitlementReads the caller's held driving entitlement for cross-border presentation. Returns `{ data: null }` when the holder has no licence on file (a normal state, not an error).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
userId | query | string (uuid) | no | Optional holder id supplied by the SPA; when present it MUST match the caller's own subject (a mismatch is refused as `403`). The authoritative owner is always the JWT subject. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/cross-border/driving-entitlementRegisters or replaces the caller's held driving entitlement from their wallet. The owner is always the caller's subject — any `userId` in the body is ignored.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RegisterDrivingEntitlementRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/cross-border/returning-national/intakeOpens the caller's <b>inbound returning-national intake</b> — Step 1 of the `returning-expat-domestic-identity-reestablishment` journey. Captures the foreign credential references, resolves the corridor's residency / adequacy / lawful-basis decision, and previews the foreign-to-domestic assurance credit under the origin jurisdiction's acceptance policy. The returned `intakeId` is the handle Steps 2 (EPIC 9 bootstrap) and 3 (EPIC 2 vault reconciliation) key on, so the credentials are never re-entered. The response is the DTO <b>bare</b> — no `{ data: … }` envelope. The returning-national client unwraps `response.data` (the HTTP body) directly, unlike the cross-border engine client above which unwraps `data.data`. A corridor with no lawful basis is <b>refused</b> (409) and nothing is persisted — a blocked adequacy posture cannot be walked past into the downstream steps.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
OpenReturningNationalIntakeRequestasapplication/*+json,application/json,text/json
Responses
ReturningNationalIntakeDtoProblemDetailsProblemDetailsProblemDetailsCrossRegionRollouts
/api/v1/global-instances/rolloutsLists the most recent rolling releases, newest first.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
limit | query | integer (int32) | no | How many to return (1..100, default 20). |
Request body
No request body.
Responses
CrossRegionRolloutDto[]/api/v1/global-instances/rolloutsOpens and starts a rolling release across the given regions, in order.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
StartCrossRegionRolloutRequestasapplication/*+json,application/json,text/json
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetailsProblemDetails/api/v1/global-instances/rollouts/{rolloutId}Reads one rolling release.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
CrossRegionRolloutDtoProblemDetails/api/v1/global-instances/rollouts/{rolloutId}/abandonAbandons a live rollout, rolling back to its from-version.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
RolloutReasonRequestasapplication/*+json,application/json,text/json
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetailsProblemDetails/api/v1/global-instances/rollouts/{rolloutId}/haltHalts an in-progress rollout by hand.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
RolloutReasonRequestasapplication/*+json,application/json,text/json
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetailsProblemDetails/api/v1/global-instances/rollouts/{rolloutId}/regions/{region}/outcomeReports a region's post-roll health outcome — the automatic guard. Healthy rolls the region; unhealthy halts the rollout into `RolloutHaltedAuto`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
region | path | string | yes | — |
Request body
Not marked as required in the document.
RolloutRegionOutcomeRequestasapplication/*+json,application/json,text/json
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetailsProblemDetails/api/v1/global-instances/rollouts/{rolloutId}/resumeResumes a halted rollout (auto or manual).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetails/api/v1/instances/global/rolloutsLists the most recent rolling releases, newest first.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
limit | query | integer (int32) | no | How many to return (1..100, default 20). |
Request body
No request body.
Responses
CrossRegionRolloutDto[]/api/v1/instances/global/rolloutsOpens and starts a rolling release across the given regions, in order.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
StartCrossRegionRolloutRequestasapplication/*+json,application/json,text/json
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetailsProblemDetails/api/v1/instances/global/rollouts/{rolloutId}Reads one rolling release.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
CrossRegionRolloutDtoProblemDetails/api/v1/instances/global/rollouts/{rolloutId}/abandonAbandons a live rollout, rolling back to its from-version.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
RolloutReasonRequestasapplication/*+json,application/json,text/json
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetailsProblemDetails/api/v1/instances/global/rollouts/{rolloutId}/haltHalts an in-progress rollout by hand.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
RolloutReasonRequestasapplication/*+json,application/json,text/json
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetailsProblemDetails/api/v1/instances/global/rollouts/{rolloutId}/regions/{region}/outcomeReports a region's post-roll health outcome — the automatic guard. Healthy rolls the region; unhealthy halts the rollout into `RolloutHaltedAuto`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
region | path | string | yes | — |
Request body
Not marked as required in the document.
RolloutRegionOutcomeRequestasapplication/*+json,application/json,text/json
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetailsProblemDetails/api/v1/instances/global/rollouts/{rolloutId}/resumeResumes a halted rollout (auto or manual).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
rolloutId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
CrossRegionRolloutDtoProblemDetailsProblemDetailsDedicatedMaterialisations
/api/v1/instances/materialisationsThe environments waiting to be built, oldest first.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
DedicatedMaterialisationQueueItem[]/api/v1/instances/materialisations/{requestId}/completeReport the environment you built. This is what makes the instance Active.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
requestId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
CompleteMaterialisationRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/instances/materialisations/{requestId}/failReport that the environment cannot be built.
The queue needs an exit that is not success. Without one an unbuildable environment — no capacity in the region until Q4, a platform not yet onboarded — sits Awaiting forever: the customer waits on a build that will never happen, and the operator has nowhere to put what they learned. <b>This does NOT cancel the organisation's subscription.</b> The instance and its saga are marked Failed with `rollbackSuccessful: false` — the platform's existing vocabulary for "an operator must reconcile the orphaned resources" — and the exposure is logged with the artifact ids. Auto-cancelling would be a commercial decision this endpoint has no standing to make: "no capacity until Q4" may be a customer who is happy to wait.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
requestId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
FailMaterialisationRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsDeveloperIds
/api/v1/developer-idsLists all developer IDs, optionally filtered by status.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
status | query | string | no | Optional status filter (active, suspended, revoked). |
Request body
No request body.
Responses
ProblemDetails/api/v1/developer-idsCreates a new developer ID.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateDeveloperIdRequestasapplication/*+json,application/json,text/json
Responses
DeveloperIdEntryProblemDetails/api/v1/developer-ids/{id}Retrieves a single developer ID by its unique identifier.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The developer ID identifier. |
Request body
No request body.
Responses
DeveloperIdEntryProblemDetails/api/v1/developer-ids/{id}/revokeRevokes a developer ID permanently.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The developer ID identifier. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/developer-ids/{id}/suspendSuspends a developer ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The developer ID identifier. |
Request body
Not marked as required in the document.
SuspendDeveloperIdRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsDiscovery
/api/v1/discovery/.well-known/instanceRFC 8615 well-known metadata document for this instance. Returns the API surface, supported versions, instance type, and federation trust roots so external clients (and federated peers) can perform instance discovery without authentication.
This endpoint is intentionally Microsoft.AspNetCore.Authorization.AllowAnonymousAttribute because well-known discovery documents are part of RFC 8615 and must be reachable before authentication credentials are established. The document contains only public, non-PII metadata: instance ID, instance type, supported API versions, and the federation trust roots an external party would need to validate signed envelopes.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
InstanceDiscoveryDocument/api/v1/discovery/healthRouting health (EPIC 3 api-contracts §Discovery, `AllowAnonymous`): can discovery route a newcomer to a sovereign right now? `200` when at least one sovereign is `Active`, `503` when none is, with the same body either way (#10344).
Microsoft.AspNetCore.Authorization.AllowAnonymousAttribute — routing happens before authentication, like `GET /discovery/instances`, and this endpoint uses exactly that list's predicate (`OnlyHealthy` ⇒ `InstanceStatus.Active`). It returns two counts and a word, both counts derivable from that public list, so it is not an inventory or liveness oracle: no instance id, name, status or probe result is exposed. Per-instance health is `GET /discovery/health/{instanceId}`, which stays caller-scoped.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
RoutingHealthDtoRoutingHealthDto/api/v1/discovery/health/{instanceId}Performs a comprehensive health check on a specific instance. Validates database connectivity, cache availability, and dependent services. Results are cached for 30 seconds to reduce health check overhead.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | path | string | yes | The unique identifier of the instance to check. |
Request body
No request body.
Responses
HealthStatusProblemDetailsProblemDetails/api/v1/discovery/home-realmHome-realm discovery broker (EPIC 9 FR-09.032 / EPIC 3 FR-03.058). Resolves a sign-in address's <b>domain</b> to the authoritative home realm from the Global Registry and returns where the broker should redirect to complete authentication (the completing sovereign's OIDC authorize endpoint) plus an opaque short-TTL realm descriptor.
Microsoft.AspNetCore.Authorization.AllowAnonymousAttribute — discovery runs BEFORE authentication, so the answer must not be a statement about a person. It is keyed on the DOMAIN only, never the local-part (#8633). Keyed on the whole address it was an account-existence oracle in the one attribute that matters most on this platform: an anonymous caller could hash a candidate address, post it, and be told which sovereign holds that named individual's vault — residency class for a named person, to an unauthenticated stranger. Hashing did not help, because the attacker chooses the input. An unknown domain, a domain whose users span regions, and a request with no domain are one answer: the default-region realm, indistinguishable from a real default-region domain (NFR-09.020). No per-account branch is taken, in body or in timing, because no per-account state is consulted. Where the realm is therefore not disclosed the sign-in surface presents every configured IdP rather than a region-filtered subset (FR-09.036), so the user is not stranded at a door they cannot open.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
HomeRealmDiscoveryRequestasapplication/*+json,application/json,text/json
Responses
HomeRealmDiscoveryResponse/api/v1/discovery/instancesAvailable SOVEREIGN instances for the pre-auth Register / sign-in surface: every sovereign currently in `Active` status. Lets the frontend instance selector scope itself to the sovereigns that are actually served instead of shipping a hardcoded list. <b>Global is deliberately NOT returned.</b> No vault data is ever global, so GLOBAL is not a jurisdiction a vault can live in and must not be offered as one. This endpoint answers "where may my vault live?", and Global is the router, not an answer to that question.
Microsoft.AspNetCore.Authorization.AllowAnonymousAttribute — instance choice happens BEFORE authentication. The response is public routing metadata ONLY (opaque id, jurisdiction code, display name); it never exposes health, status, compliance, data-residency, validator, or CDN detail — those stay on the admin-gated instance-management endpoints. Availability = `InstanceStatus.Active`, reusing the exact predicate the admin sovereign list applies for `onlyHealthy` (so an instance that is not serving is never advertised). Global was previously included on the grounds that "the SPA is served FROM the Global instance, so if this endpoint is reachable, Global is by definition available". That is true about AVAILABILITY and irrelevant to the question asked: reachability of the front door is not a licence to place a vault behind it.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
PublicInstanceListResponse/api/v1/discovery/latencyMeasures the round-trip network latency to a specific instance endpoint. Used for routing decisions and performance monitoring. Probes the instance's liveness path with a 5-second timeout, where the liveness probe resolver says that instance is probed (#16678).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
endpoint | query | string | no | The HTTP/HTTPS endpoint URL to measure latency. |
Request body
No request body.
Responses
LatencyMeasurementResultProblemDetails/api/v1/discovery/optimalResolves the optimal instance for a client from its GeoIP position — the contract binding of the FR-03.024b resolution also served by M:Essence.Core.Instance.Api.Controllers.DiscoveryController.ResolveSovereign(System.String,System.Nullable{System.Int32},System.Threading.CancellationToken).
The authoritative contract (api-contracts.md §1 Discovery) specifies `POST /api/v1/discovery/optimal` ("GeoIP optimal instance"); the implementation had only ever exposed this capability as `GET /api/v1/discovery/sovereign` (debt-2026-08-13-039). Both bindings resolve through the same `ISovereignFallbackRouter`, so they cannot diverge: the POST carries the GeoIP inputs in a body (the shape the contract was written against and the natural carrier for a lookup result), the GET keeps them on the query string for existing callers.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
OptimalInstanceRequestasapplication/*+json,application/json,text/json
Responses
SovereignRouteResultProblemDetailsProblemDetails/api/v1/discovery/org-realmOrg home-realm discovery (EPIC 3 FR-03.059/060). Resolves an org-branded host — the default `{orgid}.{region}.onessence.digital` scheme or a license-gated custom domain — to its Organisation Instance from the Global Registry, and returns where to route/redirect the org sign-in plus a signed realm descriptor. Used by the edge/gateway to route the org host.
Microsoft.AspNetCore.Authorization.AllowAnonymousAttribute — runs before authentication. A host that does not bind to a known org returns `404` uniformly (an unbound / unentitled custom domain and a disabled org are indistinguishable — FR-03.060), so it is not an entitlement/config oracle.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
OrgRealmDiscoveryRequestasapplication/*+json,application/json,text/json
Responses
HomeRealmDiscoveryResponseProblemDetails/api/v1/discovery/org-realm/organizationResolves an org sign-in host to the organisation behind it, for FIRST-PARTY SERVICES ONLY (#4788).
<b>Why this is not on M:Essence.Core.Instance.Api.Controllers.DiscoveryController.DiscoverOrgRealm(Essence.Core.Instance.Application.DTOs.OrgRealmDiscoveryRequest,Essence.Core.Instance.Application.Registry.IOrgRealmResolver,Essence.Core.Instance.Application.Registry.IRealmRedirectSigner,System.Threading.CancellationToken).</b> The anonymous realm-discovery response deliberately carries no organisation id. That omission IS the protection: adding it would hand any visitor a host→organisation directory, harvestable by pointing the endpoint at every domain somebody is merely curious about. A caller that legitimately needs the id — the org portal, resolving which organisation's branding to serve a sign-in page — is a service, not a browser, so it asks here instead, under Essence.Core.Instance.Api.Authorization.Policies.PolicyNames.InstanceServiceAccount. <b>Bare `[Authorize]` would not have been enough.</b> The class-level attribute admits any authenticated principal, which includes every end-user bearer token on the platform — so the directory would have been open to any signed-in user rather than to nobody. The policy narrows it to the service-account and GlobalAdmin roles. <b>Uniform on failure, like its anonymous sibling.</b> An unknown host, a malformed host, a host whose region label disagrees with the instance, and an organisation whose white-label entitlement has lapsed all return `200` with a null id — the resolver's own `Unresolved`, unmodified. A 404 for "no such host" and a 200 for "found" would make this an existence oracle for anything holding a service token; the single shape does not.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
host | query | string | no | The sign-in host, e.g. `meridian.gb.onessence.digital`. |
Request body
No request body.
Responses
OrgHostOrganizationResponse/api/v1/discovery/routeComputes the optimal route between a source instance and a target instance. May return a direct route or a multi-hop route through intermediate instances based on latency.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ComputeRouteRequestasapplication/*+json,application/json,text/json
Responses
RoutingDecisionProblemDetailsProblemDetails/api/v1/discovery/sovereignResolves the sovereign a request should be routed to under the FR-03.024b GeoIP-unresolvable / no-adequate-sovereign fallback rule. The GeoIP country and confidence are supplied as query parameters (produced upstream by the GeoIP2 lookup); omitting countryCode models a GeoIP-unresolvable lookup. When no adequate sovereign can be resolved and the configured fallback mode rejects (or the default sovereign is itself inadequate) the endpoint returns `HTTP 422 no_adequate_sovereign`.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
countryCode | query | string | no | Optional ISO 3166-1 alpha-2 client country from GeoIP2. |
confidence | query | integer (int32) | no | Optional GeoIP country-confidence (0–100); defaults to 0. |
Request body
No request body.
Responses
SovereignRouteResultProblemDetailsProblemDetails/api/v1/discovery/users/{userId}Discovers the optimal instance for a user based on geo-location, health, and routing preferences. Results are cached for 5 minutes to support high throughput (1M queries/second).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
userId | path | string | yes | The unique identifier of the user requesting discovery. |
latitude | query | number (double) | no | Optional client latitude for geo-location based routing. |
longitude | query | number (double) | no | Optional client longitude for geo-location based routing. |
requestedRegion | query | string | no | Optional region hint. A user is always discovered to their home region: neither the home instance nor a fallback is ever taken from another region, whatever is requested (#17922). |
Request body
No request body.
Responses
DiscoveryResultProblemDetailsProblemDetailsDns
/api/v1/dns/zonesLists all DNS zones.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
DnsZoneDto[]/api/v1/dns/zonesCreates a new DNS zone for an instance.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateDnsZoneCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetails/api/v1/dns/zones/by-name/{name}Retrieves a DNS zone by its fully qualified domain name.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
name | path | string | yes | The DNS zone name (FQDN). |
Request body
No request body.
Responses
DnsZoneDtoProblemDetails/api/v1/dns/zones/{id}Retrieves a specific DNS zone by ID, including its records.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The DNS zone ID. |
Request body
No request body.
Responses
DnsZoneDtoProblemDetails/api/v1/dns/zones/{id}/recordsCreates a new DNS record within a zone.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The DNS zone ID to add the record to. |
Request body
Not marked as required in the document.
CreateDnsRecordCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetailsProblemDetails/api/v1/dns/zones/{id}/records/{recordId}Updates an existing DNS record within a zone.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The DNS zone ID containing the record. |
recordId | path | string (uuid) | yes | The DNS record ID to update. |
Request body
Not marked as required in the document.
UpdateDnsRecordCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/dns/zones/{id}/records/{recordId}Deletes a DNS record from a zone.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The DNS zone ID containing the record. |
recordId | path | string (uuid) | yes | The DNS record ID to delete. |
Request body
No request body.
Responses
ProblemDetails/api/v1/dns/zones/{id}/verifyVerifies the health of all DNS records in a zone by querying the DNS provider.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The DNS zone ID to verify. |
Request body
No request body.
Responses
ProblemDetailsDocuments
/api/v1/documentsUploads an encrypted document to a vault. Document content must be encrypted client-side before upload.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
UploadDocumentCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/documents/vault/{vaultId}Lists a bounded, keyset-paginated slice of the documents in a vault (DAT-006). Access is granted only to the vault owner.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
vaultId | path | string (uuid) | yes | The vault ID. |
includeDeleted | query | boolean | no | Whether to include soft-deleted documents (default: false). |
cursor | query | string | no | Opaque continuation cursor from a prior page's NextCursor, or null for the first slice. |
pageSize | query | integer (int32) | no | Requested slice size; clamped to [1, 500] (DAT-006). |
Request body
No request body.
Responses
VaultDocumentRefCursorResultProblemDetailsProblemDetails/api/v1/documents/vault/{vaultId}/searchSearches for documents by name prefix within a vault, returning a bounded, keyset-paginated slice (DAT-006). Access is granted only to the vault owner.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
vaultId | path | string (uuid) | yes | The vault ID. |
searchTerm | query | string | no | The name prefix to match against document names. |
cursor | query | string | no | Opaque continuation cursor from a prior page's NextCursor, or null for the first slice. |
pageSize | query | integer (int32) | no | Requested slice size; clamped to [1, 500] (DAT-006). |
Request body
No request body.
Responses
VaultDocumentRefCursorResultProblemDetailsProblemDetails/api/v1/documents/{id}Retrieves a document by its unique identifier. Access is granted only to the vault owner.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The document ID. |
Request body
No request body.
Responses
VaultDocumentRefProblemDetailsProblemDetails/api/v1/documents/{id}Updates document name and encrypted metadata.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The document ID. |
Request body
Not marked as required in the document.
UpdateDocumentCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/documents/{id}Deletes a document from a vault (soft delete). Deleted documents can be restored within the retention period.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The document ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsEdgeRoutes
/api/v1/edge/routes/{region}Returns the Traefik dynamic configuration for every verified, entitled custom domain homed in the given region.
<b>Why `[AllowAnonymous]` and a pre-shared secret rather than a JWT (SEC-002).</b> The caller is Traefik's HTTP provider, which can attach static headers to its poll and cannot obtain, cache, or refresh a bearer token. The endpoint is nonetheless NOT public: the table enumerates customers' branded hostnames, so serving it openly would disclose which organisations are on the white-label SKU. It is therefore gated on a pre-shared secret compared in constant time (SEC-005), and the service <b>fails closed in every environment</b> — an unconfigured secret answers 503 rather than serving the table, so a misconfigured box cannot silently publish the customer list. There is no Development exception: the fleet runs as Development (#9480), so one would serve the list anonymously in production (#12083). A wrong or absent secret answers <b>404</b>, not 401: a 401 would confirm the endpoint exists and is worth attacking, and this surface has no legitimate interactive caller to help.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
region | path | string | yes | Region code (e.g. "gb", "de", "ae"). |
Request body
No request body.
Responses
TraefikDynamicConfigurationProblemDetailsGlobalInstances
/api/v1/global-instancesRetrieves the current global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
GlobalInstanceProblemDetails/api/v1/global-instancesCreates a new global instance.
The only action on `POST /instances/global` (#14190). The cross-type facade Essence.Core.Instance.Api.Controllers.InstanceLifecycleController used to declare the same template, which made every create an `AmbiguousMatchException`. This action now returns the facade's response — the Essence.Core.Instance.Application.DTOs.CreateInstanceResponseDto body and a `Location` on the facade's type-agnostic read, `GET /instances/{id}` — which is a superset of the bare `{ id }` this action returned before.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateGlobalInstanceCommandasapplication/*+json,application/json,text/json
Responses
CreateInstanceResponseDtoProblemDetails/api/v1/global-instances/{id}Retrieves a global instance by ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
GlobalInstanceProblemDetails/api/v1/global-instances/{id}Terminates the global instance (irreversible operation).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/global-instances/{id}/configurationUpdates the global instance configuration.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateConfigurationCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/global-instances/{id}/healthUpdates the health status of the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateHealthCheckCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/global-instances/{id}/healthUpdates the health status of the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateHealthCheckCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/global-instances/{id}/maintenance/beginBegins maintenance mode for the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/global-instances/{id}/maintenance/completeCompletes maintenance mode for the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/global-instances/{id}/metadataUpdates the global instance metadata.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateMetadataCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/global-instances/{id}/organization-instancesRetrieves connected organization instance IDs.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The global instance ID. |
Request body
No request body.
Responses
(string (uuid))[]ProblemDetails/api/v1/global-instances/{id}/provisionProvisions the global instance (transitions from Provisioning to Active status).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/global-instances/{id}/resumeResumes the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/global-instances/{id}/sovereign-instancesRetrieves connected sovereign instance IDs.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The global instance ID. |
Request body
No request body.
Responses
(string (uuid))[]ProblemDetails/api/v1/global-instances/{id}/suspendSuspends the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/instances/globalRetrieves the current global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
GlobalInstanceProblemDetails/api/v1/instances/globalCreates a new global instance.
The only action on `POST /instances/global` (#14190). The cross-type facade Essence.Core.Instance.Api.Controllers.InstanceLifecycleController used to declare the same template, which made every create an `AmbiguousMatchException`. This action now returns the facade's response — the Essence.Core.Instance.Application.DTOs.CreateInstanceResponseDto body and a `Location` on the facade's type-agnostic read, `GET /instances/{id}` — which is a superset of the bare `{ id }` this action returned before.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateGlobalInstanceCommandasapplication/*+json,application/json,text/json
Responses
CreateInstanceResponseDtoProblemDetails/api/v1/instances/global/{id}Retrieves a global instance by ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
GlobalInstanceProblemDetails/api/v1/instances/global/{id}Terminates the global instance (irreversible operation).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetails/api/v1/instances/global/{id}/configurationUpdates the global instance configuration.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateConfigurationCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/instances/global/{id}/healthUpdates the health status of the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateHealthCheckCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/instances/global/{id}/healthUpdates the health status of the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateHealthCheckCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/instances/global/{id}/maintenance/beginBegins maintenance mode for the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/instances/global/{id}/maintenance/completeCompletes maintenance mode for the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/instances/global/{id}/metadataUpdates the global instance metadata.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateMetadataCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/instances/global/{id}/organization-instancesRetrieves connected organization instance IDs.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The global instance ID. |
Request body
No request body.
Responses
(string (uuid))[]ProblemDetails/api/v1/instances/global/{id}/provisionProvisions the global instance (transitions from Provisioning to Active status).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/instances/global/{id}/resumeResumes the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/instances/global/{id}/sovereign-instancesRetrieves connected sovereign instance IDs.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The global instance ID. |
Request body
No request body.
Responses
(string (uuid))[]ProblemDetails/api/v1/instances/global/{id}/suspendSuspends the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsImmigrationStatus
/api/v1/cross-border/immigration-statusReads the caller's own transition, with their issued share codes and the checks made against them. Returns `204 No Content` when nothing is linked yet — a normal starting state, not an error, and the signal the surface uses to show the entry screen.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
ImmigrationStatusDtoProblemDetails/api/v1/cross-border/immigration-status/consoleThe verifying organisation's console read: its acceptance policy, every check it has made (each flagged when the subject's status has since moved on), and its outstanding requests.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
ImmigrationVerificationConsoleDtoProblemDetailsProblemDetails/api/v1/cross-border/immigration-status/cutoverStep 3 — the canonical cutover. Retires the BRP, makes the eVisa canonical, supersedes every previously issued code, and writes the audited supersession event through the outbox.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
PerformCutoverRequestasapplication/*+json,application/json,text/json
Responses
ImmigrationStatusDtoProblemDetailsProblemDetailsProblemDetails/api/v1/cross-border/immigration-status/evisaStep 2 seam — records an established eVisa verifiable credential against the caller's linked status. Issuing the credential is EPIC 24 base capability and happens elsewhere.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
EstablishEVisaRequestasapplication/*+json,application/json,text/json
Responses
ImmigrationStatusDtoProblemDetailsProblemDetailsProblemDetails/api/v1/cross-border/immigration-status/linkStep 1 — links an existing BRP-based immigration status. Idempotent: a caller who already has a linked status gets it back rather than a second one.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
LinkImmigrationStatusRequestasapplication/*+json,application/json,text/json
Responses
ImmigrationStatusDtoProblemDetailsProblemDetails/api/v1/cross-border/immigration-status/org-policyReplaces the caller organisation's acceptance policy.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
UpdateVerificationPolicyRequestasapplication/*+json,application/json,text/json
Responses
ImmigrationVerificationPolicyDtoProblemDetailsProblemDetailsProblemDetails/api/v1/cross-border/immigration-status/verification-requestsRaises bulk/invite verification requests — asks several individuals for a share code and starts tracking who has responded.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RaiseVerificationRequestsRequestasapplication/*+json,application/json,text/json
Responses
ImmigrationVerificationRequestDto[]ProblemDetailsProblemDetailsProblemDetails/api/v1/cross-border/immigration-status/verification-requests/{requestId}/withdrawWithdraws one of the caller organisation's outstanding requests.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
requestId | path | string (uuid) | yes | The request to withdraw. |
Request body
No request body.
Responses
ImmigrationVerificationRequestDtoProblemDetailsProblemDetailsProblemDetails/api/v1/cross-border/immigration-status/verifyThe verifier's redemption — enter a share code, get a stamped result. Every redemption resolves against the live status, so a code minted before the migrant's cutover comes back `superseded` rather than clean.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
VerifyShareCodeRequestasapplication/*+json,application/json,text/json
Responses
ImmigrationVerificationDtoProblemDetailsProblemDetailsProblemDetailsProblemDetailsInstanceLifecycle
/api/v1/instancesRetrieves all instances with optional filtering.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceType | query | InstanceType | no | Optional instance type filter. |
status | query | InstanceStatus | no | Optional status filter. |
Request body
No request body.
Responses
InstanceListDto[]/api/v1/instances/hierarchyRetrieves the full instance hierarchy tree (Global -> Sovereign -> Organization).
This endpoint materializes the whole fleet into a single in-memory tree, so it is bounded by Essence.Core.Instance.Application.Configuration.InstanceHierarchyOptions.MaxFleetSize (default 5000 total instances). When the live fleet exceeds that bound the endpoint trips a circuit breaker and returns HTTP 413, directing callers to the paginated instance-listing endpoints (`GET /api/v1/instances`) instead of returning an unbounded tree (debt-2026-06-13-1238).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
unspecified[]ProblemDetails/api/v1/instances/pageRetrieves a bounded, keyset-paginated slice of instances of a single type (DAT-006). Preferred over the unbounded M:Essence.Core.Instance.Api.Controllers.InstanceLifecycleController.GetAllInstances(System.Nullable{Essence.Core.Instance.Domain.Enums.InstanceType},System.Nullable{Essence.Core.Instance.Domain.Enums.InstanceStatus},System.Threading.CancellationToken) for client-facing listing of a fleet that can grow without bound (debt-2026-06-13-1244, debt-2026-06-13-1251).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceType | query | InstanceType | no | The instance type to page over (required). |
status | query | InstanceStatus | no | Optional status filter. |
cursor | query | string | no | Opaque continuation token from a prior response's NextCursor, or null for the first page. |
pageSize | query | integer (int32) | no | Requested slice size (clamped server-side). |
Request body
No request body.
Responses
InstanceListDtoCursorResult/api/v1/instances/region/{region}Retrieves instances in a specific region.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
region | path | string | yes | The region to filter by. |
instanceType | query | InstanceType | no | Optional instance type filter. |
status | query | InstanceStatus | no | Optional status filter. |
Request body
No request body.
Responses
InstanceListDto[]ProblemDetails/api/v1/instances/region/{region}/pageRetrieves a bounded, keyset-paginated slice of instances of a single type within a region (DAT-006). The region-filtered counterpart of `GET /instances/page`; the bounded hot-path replacement for the unbounded `GET /instances/region/{region}` on region-scoped fleets that can grow without bound (debt-2026-06-21-1062). Paginate each type separately — a single keyset cursor cannot span the three aggregate tables.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
region | path | string | yes | The region to filter by (case-insensitive, required). |
instanceType | query | InstanceType | no | The instance type to page over (required). |
status | query | InstanceStatus | no | Optional status filter. |
cursor | query | string | no | Opaque continuation token from a prior response's NextCursor, or null for the first page. |
pageSize | query | integer (int32) | no | Requested slice size (clamped server-side). |
Request body
No request body.
Responses
InstanceListDtoCursorResultProblemDetails/api/v1/instances/searchSearches instances of every type (Global, Sovereign, Organization) and returns a bounded, cursor-paginated slice (DAT-006). This is the cross-type counterpart to M:Essence.Core.Instance.Api.Controllers.InstanceLifecycleController.GetInstancesPage(Essence.Core.Instance.Domain.Enums.InstanceType,System.Nullable{Essence.Core.Instance.Domain.Enums.InstanceStatus},System.String,System.Int32,System.Threading.CancellationToken) (which pages a single required type): the admin "Instance Management" fleet view needs all types at once, filtered by an optional free-text name query, instanceType, and status. Distinct route segment `search` so the request no longer falls through to M:Essence.Core.Instance.Api.Controllers.InstanceLifecycleController.GetInstanceById(System.Guid,System.Threading.CancellationToken)'s `{id:guid}` template and 400s on a non-GUID segment (debt-2026-06-28-087).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceType | query | InstanceType | no | Optional instance type filter. |
status | query | InstanceStatus | no | Optional status filter. |
query | query | string | no | Optional case-insensitive substring matched against the instance name. |
cursor | query | string | no | Opaque continuation token from a prior response's NextCursor, or null for the first page. |
pageSize | query | integer (int32) | no | Requested slice size (clamped server-side to 1..500, default 50). |
Request body
No request body.
Responses
InstanceListDtoCursorResultProblemDetails/api/v1/instances/type/{type}Retrieves instances of one type (EPIC 3 api-contracts §Instance, `GET /instances/type/{type}`, #10344). The type-keyed sibling of `GET /instances/region/{region}`, with the same policy, shape and (unbounded) listing; `GET /instances/page?instanceType=` is the keyset-paginated form (DAT-006).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
type | path | InstanceType | yes | The instance type: `Global`, `Sovereign` or `Organization`. |
status | query | InstanceStatus | no | Optional status filter. |
Request body
No request body.
Responses
InstanceListDto[]ProblemDetails/api/v1/instances/{id}Retrieves a specific instance by ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
unspecifiedProblemDetails/api/v1/instances/{id}/activateActivates an instance by setting its status to Active.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
unspecifiedProblemDetails/api/v1/instances/{id}/healthUpdates the health status of an instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateInstanceHealthCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/instances/{id}/suspendSuspends an instance with an optional reason.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
SuspendInstanceRequestasapplication/*+json,application/json,text/json
Responses
unspecifiedProblemDetails/api/v1/instances/{id}/terminateTerminates an instance (soft delete).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
TerminateInstanceRequestasapplication/*+json,application/json,text/json
Responses
unspecifiedProblemDetailsProblemDetailsInstanceRegistry
/api/v1/registryRetrieves the global instance registry.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
InstanceRegistryProblemDetails/api/v1/registry/instancesRegisters a new instance in the registry.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RegisterInstanceCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetails/api/v1/registry/instances/by-type/{instanceType}Retrieves instances by type.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceType | path | InstanceType | yes | The instance type filter. |
Request body
No request body.
Responses
InstanceRegistryEntry[]ProblemDetails/api/v1/registry/instances/countRetrieves the total count of registered instances.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
integer (int32)/api/v1/registry/instances/{instanceId}Retrieves a specific instance entry from the registry.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | path | string (uuid) | yes | The instance ID. |
Request body
No request body.
Responses
InstanceRegistryEntryProblemDetails/api/v1/registry/instances/{instanceId}Unregisters an instance from the registry.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | path | string (uuid) | yes | The instance ID to unregister. |
Request body
No request body.
Responses
ProblemDetails/api/v1/registry/instances/{instanceId}/endpointUpdates the endpoint URL for an instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | path | string (uuid) | yes | The instance ID. |
Request body
Not marked as required in the document.
UpdateInstanceEndpointCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/registry/instances/{instanceId}/registeredChecks if an instance is registered.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | path | string (uuid) | yes | The instance ID to check. |
Request body
No request body.
Responses
booleanInternalMessaging
/api/internal/messagesReceives a cross-instance message from another instance. Message is authenticated via mTLS through Istio service mesh. Payloads are bounded to 1 MB per NFR-03.022 (enforced at the Essence.Core.Instance.Domain.Entities.CrossInstanceMessage aggregate boundary); over-size payloads are rejected with HTTP 413.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
Not marked as required in the document.
ReceiveMessageRequestasapplication/*+json,application/json,text/json
Responses
ReceiveMessageResponseProblemDetailsProblemDetails/api/internal/messages/circuit-breakerGets the current circuit breaker states for all target instances. Useful for monitoring fault isolation and identifying unhealthy target instances.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
CircuitBreakerStatesResponseProblemDetails/api/internal/messages/healthGets the health status of the messaging subsystem. Includes circuit breaker states, queue depth, and recent delivery statistics.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
MessagingHealthResponse/api/internal/messages/retry-failedRetries all failed messages currently in the queue. Processes messages with exponential backoff and respects circuit breaker states.
SEC-002/SEC-004 (debt-2026-06-29-325): the retry loop is an expensive, self-targeted operation, so it is gated to a platform operator (Essence.Core.Instance.Api.Authorization.Policies.PolicyNames.GlobalAdmin) — mirroring M:Essence.Core.Instance.Api.Controllers.InternalMessagingController.SendMessage(Essence.Core.Instance.Api.Controllers.SendMessageRequest,System.Threading.CancellationToken) — rather than any InstanceServiceAccount identity, and is bound by the "essence-strict" per-subject rate limit (10/min) so it cannot be invoked in a tight loop to amplify load against the local mesh.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
RetryFailedMessagesResponse/api/internal/messages/sendSends a cross-instance message to another instance (admin/testing endpoint). Encrypts payload client-side before transmission through Istio service mesh with mTLS.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
Not marked as required in the document.
SendMessageRequestasapplication/*+json,application/json,text/json
Responses
SendMessageResponseSendMessageResponseProblemDetailsProblemDetails/api/internal/messages/statisticsGets comprehensive messaging statistics for monitoring and diagnostics. Statistics are aggregated over a rolling 5-minute window.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
targetInstanceId | query | string | no | Optional target instance ID to filter statistics. |
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
MessagingStatistics/api/internal/messages/{messageId}/statusGets the delivery status of a previously sent cross-instance message. Provides real-time tracking of message delivery progress through the routing infrastructure.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
messageId | path | string | yes | The unique identifier of the message to track. |
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
MessageStatusResponseProblemDetailsProblemDetails/api/v1/internal/messagesReceives a cross-instance message from another instance. Message is authenticated via mTLS through Istio service mesh. Payloads are bounded to 1 MB per NFR-03.022 (enforced at the Essence.Core.Instance.Domain.Entities.CrossInstanceMessage aggregate boundary); over-size payloads are rejected with HTTP 413.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
Not marked as required in the document.
ReceiveMessageRequestasapplication/*+json,application/json,text/json
Responses
ReceiveMessageResponseProblemDetailsProblemDetails/api/v1/internal/messages/circuit-breakerGets the current circuit breaker states for all target instances. Useful for monitoring fault isolation and identifying unhealthy target instances.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
CircuitBreakerStatesResponseProblemDetails/api/v1/internal/messages/healthGets the health status of the messaging subsystem. Includes circuit breaker states, queue depth, and recent delivery statistics.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
MessagingHealthResponse/api/v1/internal/messages/retry-failedRetries all failed messages currently in the queue. Processes messages with exponential backoff and respects circuit breaker states.
SEC-002/SEC-004 (debt-2026-06-29-325): the retry loop is an expensive, self-targeted operation, so it is gated to a platform operator (Essence.Core.Instance.Api.Authorization.Policies.PolicyNames.GlobalAdmin) — mirroring M:Essence.Core.Instance.Api.Controllers.InternalMessagingController.SendMessage(Essence.Core.Instance.Api.Controllers.SendMessageRequest,System.Threading.CancellationToken) — rather than any InstanceServiceAccount identity, and is bound by the "essence-strict" per-subject rate limit (10/min) so it cannot be invoked in a tight loop to amplify load against the local mesh.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
RetryFailedMessagesResponse/api/v1/internal/messages/sendSends a cross-instance message to another instance (admin/testing endpoint). Encrypts payload client-side before transmission through Istio service mesh with mTLS.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Api-Version | header | string | no | — |
Request body
Not marked as required in the document.
SendMessageRequestasapplication/*+json,application/json,text/json
Responses
SendMessageResponseSendMessageResponseProblemDetailsProblemDetails/api/v1/internal/messages/statisticsGets comprehensive messaging statistics for monitoring and diagnostics. Statistics are aggregated over a rolling 5-minute window.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
targetInstanceId | query | string | no | Optional target instance ID to filter statistics. |
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
MessagingStatistics/api/v1/internal/messages/{messageId}/statusGets the delivery status of a previously sent cross-instance message. Provides real-time tracking of message delivery progress through the routing infrastructure.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
messageId | path | string | yes | The unique identifier of the message to track. |
X-Api-Version | header | string | no | — |
Request body
No request body.
Responses
MessageStatusResponseProblemDetailsProblemDetailsJointVentures
/api/v1/joint-venturesEvery joint venture the caller's organisation is a party to — the ones it proposed and the ones awaiting its answer.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
JointVentureDto[]ProblemDetails/api/v1/joint-venturesProposes a joint venture to a counterpart parent. The agreement is recorded and is NOT binding until the counterpart approves it; nothing is provisioned here.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ProposeJointVentureRequestasapplication/*+json,application/json,text/json
Responses
JointVentureDtoProblemDetailsProblemDetailsProblemDetails/api/v1/joint-ventures/acting-organisationThe organisation the caller acts for, as this service resolves it from their token.
The co-provisioning surface needs its own parent's organisation id to build the agreement — the billing split and the approval quorum are both keyed by it. It cannot read the claim itself (the SPA holds no decoded token, deliberately), and it must not invent or guess one: a fabricated sponsor id would key a quorum to an organisation that does not exist, and the resulting agreement would look complete and bind nobody. So the server says who the caller is, and a surface that cannot get an answer says so rather than rendering a blank parent.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
ActingOrganizationDtoProblemDetails/api/v1/joint-ventures/{jointVentureId}Reads one agreement. Refused to any caller that is not a party to it.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
jointVentureId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
JointVentureDtoProblemDetailsProblemDetails/api/v1/joint-ventures/{jointVentureId}/approveThe counterpart parent accepts co-ownership on these terms. Refused for the proposing parent, under every custody model.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
jointVentureId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
JointVentureDtoProblemDetailsProblemDetailsProblemDetails/api/v1/joint-ventures/{jointVentureId}/declineThe counterpart parent refuses the terms, and says why.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
jointVentureId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
DeclineJointVentureRequestasapplication/*+json,application/json,text/json
Responses
JointVentureDtoProblemDetailsProblemDetailsProblemDetails/api/v1/joint-ventures/{jointVentureId}/withdrawThe proposing parent withdraws before the counterpart has responded.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
jointVentureId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
JointVentureDtoProblemDetailsProblemDetailsMessages
/api/v1/messagesSends an encrypted message to another user (same or different instance). Message subject and body must be encrypted client-side before sending.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
SendMessageCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetailsProblemDetails/api/v1/messages/inboxRetrieves the authenticated user's inbox messages with optional filtering and pagination.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
includeRead | query | boolean | no | Whether to include read messages (default: true). |
skip | query | integer (int32) | no | Number of messages to skip for pagination (default: 0). |
take | query | integer (int32) | no | Number of messages to retrieve (default: 50, max: 100). |
Request body
No request body.
Responses
UserMessage[]ProblemDetails/api/v1/messages/inbox/unread-countRetrieves the count of unread messages for the authenticated user. Useful for notification badges and inbox summaries.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
integer (int32)ProblemDetails/api/v1/messages/sentRetrieves the authenticated user's sent messages with pagination.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
skip | query | integer (int32) | no | Number of messages to skip for pagination (default: 0). |
take | query | integer (int32) | no | Number of messages to retrieve (default: 50, max: 100). |
Request body
No request body.
Responses
UserMessage[]ProblemDetails/api/v1/messages/{id}Retrieves a single message by its unique identifier. Access is granted only to the sender or recipient of the message.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The message ID. |
Request body
No request body.
Responses
UserMessageProblemDetailsProblemDetailsProblemDetails/api/v1/messages/{id}/readMarks a message as read by the authenticated recipient. Updates the message status and records the read timestamp. Idempotent: safe to call multiple times.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The message ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetailsMonitoring
/api/v1/monitoring/alertsRetrieves alerts filtered by status.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
status | query | string | no | Alert status filter (active, acknowledged, resolved, suppressed). |
Request body
No request body.
Responses
/api/v1/monitoring/alerts/{id}/{action}Performs an action on an alert (acknowledge, resolve, suppress).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The alert ID. |
action | path | string | yes | The action to perform (acknowledge, resolve, suppress). |
Request body
Not marked as required in the document.
AlertActionRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/monitoring/dashboardRetrieves the monitoring dashboard data including instance health, metrics, alerts, and connectivity.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
/api/v1/monitoring/healthRetrieves health status for all registered instances.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
/api/v1/monitoring/incidentsRetrieves incidents filtered by status.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
status | query | string | no | Incident status filter (open, investigating, root-cause, resolved). |
Request body
No request body.
Responses
/api/v1/monitoring/incidents/{id}/{action}Performs an action on an incident (investigate, root-cause, resolve).
NOT WIRED, and reported as such. The incident BOARD reads from the Security service, which owns the incident aggregate (Essence.Core.Instance.Application.Services.Monitoring.IIncidentQueryService); this endpoint used to validate the id against the six invented seed incidents and then write a status into Essence.Core.Instance.Application.Services.IMonitoringActionStateStore.IncidentStatusOverrides — a dictionary that has no reader anywhere in the platform. So a real incident id 404'd, and a seed id (which no longer appears on the board at all) answered `{ success: true, status: "resolved" }` while changing nothing an operator or auditor would ever see again. A 200 that reports a lifecycle transition which did not happen is the worst available answer on an incident surface: it is the response an operator relies on to believe an incident is being handled. 501 says the console cannot yet drive the lifecycle, which is true, and leaves the Security service's own record uncontradicted. Wiring it (debt-2026-08-13-007) means calling the owner's `PUT /api/v1/incidents/{id}`, whose verbs are `StartInvestigation` / `Contain` / `Resolve`. Two mismatches must be settled first, and neither is a decision this endpoint can take on its own: `Resolve` REQUIRES a root cause that the admin console never collects, and the console's `root-cause` verb corresponds to no owner action (while the owner's `Contain` has no console button).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The incident ID. |
action | path | string | yes | The action to perform (investigate, contain, resolve). |
Request body
Not marked as required in the document.
IncidentActionRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetails/api/v1/monitoring/license-statusRetrieves the current air-gapped offline-license status (FR-03.034a / D-61, debt-2026-05-31-081, uxf-2026-05-31-085). Drives the platform admin-console "prominent warning" banner — audience Sovereign/Platform Admin — surfacing the grace/expired state that fails closed for NEW provisioning while existing workloads continue. This is a cheap read of the validator's cached status (refreshed by the periodic `AirGappedLicenseValidationHostedService` tick), not a re-verification of the signed license artifact. Reports `NotApplicable` (`shouldWarn: false`) for a connected, non-air-gapped deployment.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
/api/v1/monitoring/metricsRetrieves metric data points for the specified time range and metric type.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
startDate | query | string (date-time) | no | Start date for the metric range. |
endDate | query | string (date-time) | no | End date for the metric range. |
metric | query | string | no | Metric name (e.g., cpu, memory, requests, latency). |
type | query | string | no | Metric aggregation type (e.g., instance, service). |
Request body
No request body.
Responses
/api/v1/monitoring/self-healthThe monitoring stack's health as reported by Prometheus and Alertmanager themselves.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
/api/v1/monitoring/servicesPer-service golden signals — error rate, request rate, p50/p95/p99 latency and 30-day scrape uptime — measured from Prometheus.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
/api/v1/monitoring/slasRetrieves SLA entries for all monitored services.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
Organization
/api/v1/organization/modulesdeprecated<b>DEPRECATED — EPIC 26 owns per-organisation module assignment.</b> Use `GET /api/v1/orgs/{orgId}/modules` (and `…/modules/catalogue`) on the Module Registry instead. See Essence.Core.Instance.Api.Controllers.OrganizationModuleOwnership for the ruling, its evidence and what to do if you are reviving this tier. Lists all available modules and their enabled/disabled state. Reads from the `InstanceModuleAssignment` table, falls back to static data if empty. Still functional: deprecated is not retired, deliberately (#10521).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | query | string (uuid) | no | — |
Request body
No request body.
Responses
/api/v1/organization/modules/{moduleId}deprecated<b>DEPRECATED — EPIC 26 owns per-organisation module assignment.</b> Use `POST /api/v1/orgs/{orgId}/modules/{moduleId}/activate` and `…/deactivate` on the Module Registry instead. See Essence.Core.Instance.Api.Controllers.OrganizationModuleOwnership for the ruling, its evidence and what to do if you are reviving this tier. Enables or disables a module. Updates `InstanceModuleAssignment` if found, otherwise falls back to in-memory. Still functional: deprecated is not retired, deliberately (#10521).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
moduleId | path | string | yes | — |
instanceId | query | string (uuid) | no | — |
Request body
Not marked as required in the document.
UpdateModuleRequestasapplication/*+json,application/json,text/json
Responses
ModuleEntryProblemDetails/api/v1/organization/securityRetrieves the security settings for the caller's instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | query | string (uuid) | no | — |
Request body
No request body.
Responses
SecuritySettings/api/v1/organization/securityUpdates the security settings for the caller's instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | query | string (uuid) | no | — |
Request body
Not marked as required in the document.
SecuritySettingsasapplication/*+json,application/json,text/json
Responses
SecuritySettingsProblemDetails/api/v1/organization/settingsRetrieves the organization settings for the caller's instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | query | string (uuid) | no | — |
Request body
No request body.
Responses
OrgSettings/api/v1/organization/settingsUpdates the organization settings for the caller's instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | query | string (uuid) | no | — |
Request body
Not marked as required in the document.
OrgSettingsasapplication/*+json,application/json,text/json
Responses
OrgSettingsProblemDetailsOrganizationInstances
/api/v1/instances/organizationLists organization instances with optional filtering by sovereign instance or region. When sovereignInstanceId is provided, returns organization instances connected to that sovereign. Otherwise, returns all organization instances.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
sovereignInstanceId | query | string (uuid) | no | Optional sovereign instance ID to filter by. |
region | query | string | no | Optional region filter. |
page | query | integer (int32) | no | Page number (1-based, defaults to 1). Applies to the unfiltered admin path. |
pageSize | query | integer (int32) | no | Items per page (defaults to 50, capped at 100). |
Request body
No request body.
Responses
OrganizationInstanceDto[]ProblemDetails/api/v1/instances/organizationCreates a new organization instance within the multi-instance hierarchy.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateOrganizationInstanceCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetailsProblemDetails/api/v1/instances/organization/{id}Retrieves a specific organization instance by ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The organization instance ID. |
Request body
No request body.
Responses
OrganizationInstanceDtoProblemDetails/api/v1/instances/organization/{id}/bootstrap-packageRetrieves the bootstrap package for a <b>self-hosted</b> organisation instance (Phase 4.4) — the runbook, prerequisites, and `docker-compose.org-instance.yml` environment template the organisation needs to stand its own instance up. Self-hosted is the one tenancy where Essence builds nothing. Without this the customer has a registry row and no way to use it. <b>The package carries no credential</b>, by construction — see Essence.Core.Instance.Domain.Services.SelfHostedBootstrapPackageBuilder. That is what makes it safe to serve to the organisation's administrator before the claim: credential issuance stays claim-gated (Phase 1 A3), and the runbook's own step 8 is "complete your claim".
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
SelfHostedBootstrapPackageProblemDetailsProblemDetails/api/v1/instances/organization/{id}/custom-domainReads the current custom-domain binding, including the DNS challenge still to be published (EPIC 3 FR-03.060).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The organisation instance id. |
Request body
No request body.
Responses
CustomDomainBindingDtoProblemDetails/api/v1/instances/organization/{id}/custom-domainClaims a custom login domain and issues its DNS-ownership challenge (EPIC 3 FR-03.060). The binding does <b>not</b> resolve until M:Essence.Core.Instance.Api.Controllers.OrganizationInstancesController.VerifyCustomDomain(System.Guid,System.Threading.CancellationToken) succeeds — the response carries the exact TXT record name and value the organisation must publish.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The organisation instance id. |
Request body
Not marked as required in the document.
BindCustomDomainRequestasapplication/*+json,application/json,text/json
Responses
CustomDomainBindingDtoProblemDetailsProblemDetailsProblemDetails/api/v1/instances/organization/{id}/custom-domainRemoves the custom-domain binding, verified or not (EPIC 3 FR-03.060).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The organisation instance id. |
Request body
No request body.
Responses
CustomDomainBindingDtoProblemDetails/api/v1/instances/organization/{id}/custom-domain/verifyRe-checks the published DNS TXT record and, on success, brings the custom domain live (EPIC 3 FR-03.060).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The organisation instance id. |
Request body
No request body.
Responses
CustomDomainBindingDtoProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/instances/organization/{id}/provisioning-statusRetrieves the provisioning status for an organization instance. Returns a sanitised Essence.Core.Instance.Application.DTOs.ProvisioningStatusDto — SubscriptionId, LicenseId, InvoiceId, raw step JSON, and error stack frames are NOT returned (STRIDE info-disclosure mitigation, debt-2026-05-17-086).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProvisioningStatusDtoProblemDetails/api/v1/instances/organization/{id}/retry-provisioningRe-drives a failed organization-instance provisioning — the S-03.03 retry affordance (reqf-2026-06-14-265 / reqf-2026-06-20-239) the organization dashboard invokes when Essence.Core.Instance.Application.DTOs.ProvisioningStatusDto.IsRetryable is true. Eligibility is re-evaluated server-side (a cleanly rolled-back Transient/Dependency failure); the read-model flag is advisory only. On success a fresh provisioning job is enqueued onto the same background pipeline the initial create used.
<b>The onboarding provisioner may call it</b> (Essence.Core.Instance.Api.Authorization.OrgProvisionerRetryableAttribute, #22452) to re-drive a rolled-back instance it created rather than create a second one, and only it may name the founding administrator in the body (#22453). <b>A platform operator may force it</b> (`{"force":true,"reason":"…"}`) for a cleanly rolled-back failure whose category is not retryable, once its cause is fixed — the recovery for organisations stranded by a failure that was classed Permanent. Recorded on the workflow.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
RetryProvisioningRequestasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetailsOrgResidency
/api/v1/organizations/{organizationId}/residency/evidenceReads the organisation's own residency evidence package — its status plus the full relocation-notice and acknowledgement history. This is the artefact Essence.Core.Instance.Contracts.DTOs.OrgResidencyStatusDto.EvidencePackageUrl points at, and it is readable by the same org administrator that can read the status (unlike the operator-scoped S-03.01 export).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
OrgResidencyEvidencePackageDtoProblemDetailsProblemDetails/api/v1/organizations/{organizationId}/residency/noticesReads the organisation's pre-cutover relocation notices, newest-first, each with the organisation's recorded response.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ProblemDetails/api/v1/organizations/{organizationId}/residency/notices/{noticeId}/acknowledgeRecords the organisation's response to a pre-cutover relocation notice — an acknowledgement or an objection with its reason.
Recording an objection does not itself halt the cutover: whether an organisation's approval is binding, or whether notification plus an audited operator override suffices, is the open product decision (Tension T1). The write exists so that whichever way that lands, the organisation's position is attributable and captured before the effective date. A notice may be answered once — a replacement would overwrite that evidence.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | path | string (uuid) | yes | — |
noticeId | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
AcknowledgeRelocationNoticeBodyasapplication/*+json,application/json,text/json
Responses
OrgResidencyRelocationNoticeDtoProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/organizations/{organizationId}/residency/statusReads the organisation's current residency status — region, when it took effect, the legal basis it is held on, a link to the organisation's own evidence package, and the pending pre-cutover relocation notice when one is in flight.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
OrgResidencyStatusDtoProblemDetailsProblemDetailsRegistration
/api/v1/registrationLists registration requests with optional filtering.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
targetInstanceId | query | string (uuid) | no | Optional target instance ID filter. |
status | query | string | no | Optional status filter (Pending, Approved, Completed, Rejected, Revoked, Expired). |
requestingInstanceId | query | string (uuid) | no | Optional requesting instance ID filter. |
Request body
No request body.
Responses
RegistrationRequestDto[]/api/v1/registration/organization-to-sovereignSubmits an organization-to-sovereign registration request. An organization instance requests to register with a sovereign instance.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateRegistrationRequestCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetails/api/v1/registration/requestsLists registration requests with optional filtering.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
targetInstanceId | query | string (uuid) | no | Optional target instance ID filter. |
status | query | string | no | Optional status filter (Pending, Approved, Completed, Rejected, Revoked, Expired). |
requestingInstanceId | query | string (uuid) | no | Optional requesting instance ID filter. |
Request body
No request body.
Responses
RegistrationRequestDto[]/api/v1/registration/requests/{id}Retrieves a specific registration request by ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The registration request ID. |
Request body
No request body.
Responses
RegistrationRequestDtoProblemDetails/api/v1/registration/requests/{id}/approveApproves a pending registration request. Generates an HMAC-SHA256 approval token for the requesting instance to complete registration.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The registration request ID to approve. |
Request body
Not marked as required in the document.
ApproveRegistrationRequestBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/registration/requests/{id}/completeCompletes a registration by validating the approval token. The requesting instance uses the token received during approval to finalize registration.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The registration request ID to complete. |
Request body
Not marked as required in the document.
CompleteRegistrationRequestBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/registration/requests/{id}/rejectRejects a pending registration request.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The registration request ID to reject. |
Request body
Not marked as required in the document.
RejectRegistrationRequestBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/registration/requests/{id}/revokeRevokes a previously approved or completed registration.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The registration request ID to revoke. |
Request body
Not marked as required in the document.
RevokeRegistrationRequestBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/registration/sovereign-to-globalSubmits a sovereign-to-global registration request. A sovereign instance requests to register with the global instance.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateRegistrationRequestCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetails/api/v1/registration/{id}Retrieves a specific registration request by ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The registration request ID. |
Request body
No request body.
Responses
RegistrationRequestDtoProblemDetails/api/v1/registration/{id}/approveApproves a pending registration request. Generates an HMAC-SHA256 approval token for the requesting instance to complete registration.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The registration request ID to approve. |
Request body
Not marked as required in the document.
ApproveRegistrationRequestBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/registration/{id}/completeCompletes a registration by validating the approval token. The requesting instance uses the token received during approval to finalize registration.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The registration request ID to complete. |
Request body
Not marked as required in the document.
CompleteRegistrationRequestBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/registration/{id}/rejectRejects a pending registration request.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The registration request ID to reject. |
Request body
Not marked as required in the document.
RejectRegistrationRequestBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsRegistry
/api/v1/instances/registry/reassignUPDATE: re-point the user's mapping at the Sovereign serving the new region (re-home).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ReassignRegistryRequestasapplication/*+json,application/json,text/json
Responses
/api/v1/instances/registry/{userId}Where does this user's data live? Returns the home instance mapping, or 404 if unmapped.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
userId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
/api/v1/instances/registry/{userId}DELETE: drop the user's mapping once their data has been erased from the Sovereign.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
userId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
RenunciationTeardown
/api/v1/cross-border/renunciation/casesOpens (or rejoins) the caller's renunciation teardown — the irreversible confirm behind the front door's review screen.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
OpenRenunciationTeardownRequestasapplication/*+json,application/json,text/json
Responses
RenunciationTeardownCaseDtoProblemDetailsProblemDetails/api/v1/cross-border/renunciation/cases/currentReads the caller's live teardown for a jurisdiction. Returns `{ data: null }` when none is in flight — a normal state, not an error.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
jurisdiction | query | string | no | — |
Request body
No request body.
Responses
RenunciationTeardownCaseDtoProblemDetailsProblemDetails/api/v1/cross-border/renunciation/cases/{caseId}Reads one of the caller's teardown cases.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
caseId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
RenunciationTeardownCaseDtoProblemDetailsProblemDetails/api/v1/cross-border/renunciation/cases/{caseId}/abandonAbandons a teardown. Returns the timeline unchanged when something irreversible has already happened — there is nothing to abandon back to once a credential has been surrendered.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
caseId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
RenunciationTeardownCaseDtoProblemDetailsProblemDetails/api/v1/cross-border/renunciation/cases/{caseId}/completeIssues the teardown receipt. Returns the timeline unchanged (status still `InProgress`/`Blocked`, `receiptDigest` null) when a step is outstanding, so the caller can see exactly what is holding it up.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
caseId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
RenunciationTeardownCaseDtoProblemDetailsProblemDetails/api/v1/cross-border/renunciation/templateReads a jurisdiction's teardown template.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
jurisdiction | query | string | no | — |
Request body
No request body.
Responses
RenunciationTeardownTemplateDtoProblemDetailsProblemDetailsResidency
/api/v1/residency/adequacy-matrix/corridors/inadequateFR-03.029a matrix-maintenance write — the adequacy-decision authority flips a corridor to <b>inadequate</b>. Triggers enforcement: still-valid approvals over the corridor are auto-expired (system-initiated `Expired`, reason `adequacy-matrix-revoked`) and any in-flight transfer is halted at its next checkpoint (reason `matrix-change`), so a stale approval can never re-authorise a transfer the matrix no longer permits.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RevokeCorridorAdequacyBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetails/api/v1/residency/approvalsS-03.02 (read) — cross-border approval queue. Returns pending / active / expiring approval requests with their resolved adequacy-matrix outcome and decision metadata.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
status | query | string | no | — |
cursor | query | string | no | — |
pageSize | query | integer (int32) | no | — |
Request body
No request body.
Responses
/api/v1/residency/approvalsS-03.02 (write) — raises a new pending cross-border approval request (the C-03.02 "Request cross-border approval" affordance). The requesting actor is established server-side from the caller's identity.
SEC-002/SEC-004 (debt-2026-06-28-720): origination is restricted by an explicit role gate — only an admin for the instance (InstanceAdmin) or a cross-instance platform operator may originate a cross-border transfer request. This AND-combines with the controller-level Essence.Core.Instance.Api.Authorization.Policies.PolicyNames.InstanceAdminFor policy. The PascalCase role list it replaces could not match the platform's `platform-admin`, so the platform's own superuser was refused here (#22641). The "essence-strict" per-subject rate limit (10/min) bounds queue-flooding of the approval queue by any single caller.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RequestCrossBorderApprovalBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetails/api/v1/residency/approvals/{id}/approveS-03.02 (write) — approves a pending cross-border transfer request.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
ApprovalDecisionBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetails/api/v1/residency/approvals/{id}/denyS-03.02 (write) — denies a pending cross-border transfer request.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
ApprovalDecisionBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetails/api/v1/residency/approvals/{id}/expireS-03.02 (write) — gracefully expires a previously-approved transfer (no violation).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
ApprovalDecisionBodyasapplication/*+json,application/json,text/json
Responses
ProblemDetails/api/v1/residency/cross-border-verdictS-03.02 (read) — the <b>binding</b> cross-border verdict (FR-03.029a) for a proposed migration corridor. Returns one authoritative Essence.Core.Instance.Contracts.DTOs.CrossBorderVerdictDto (Permitted / Pending / Denied) derived server-side from the adequacy-decision matrix and the recorded approval requests, so the vault-cross-instance-migration pre-flight surface can show and export a decision that gates the transfer instead of a client-side advisory preview (debt-2026-07-03-029). Metadata-only — corridor, legal basis, authority, timestamps.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
source | query | string | no | — |
target | query | string | no | — |
recipient | query | string | no | — |
Request body
No request body.
Responses
CrossBorderVerdictDtoProblemDetails/api/v1/residency/relocation-noticesRaises a pre-cutover residency relocation notice for one organisation — the operator write that opens the organisation-facing half of the residency-migration seam.
Issued when an EPIC 88 `ResidencyMigration` lifecycle operation begins, so the affected organisation learns of the move before it happens and the `ResidencyPositionApproved` gate has attributable notification evidence. The organisation reads the notice, and records its response, through Essence.Core.Instance.Api.Controllers.OrgResidencyController. The effective date must be in the future: a "pre-cutover notice" served on or after the cutover is not a notice, and accepting one would let the gate claim notification evidence it does not have.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
RaiseRelocationNoticeBodyasapplication/*+json,application/json,text/json
Responses
OrgResidencyRelocationNoticeDtoProblemDetails/api/v1/residency/reportS-03.01 — cross-border residency report. Returns a metadata-only projection of cross-border transfer decisions, filterable by date range, sovereign pair, legal basis and outcome status. `format=json` (default) returns a keyset page; `format=csv|pdf` streams the full filtered set as a downloadable evidence artifact.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
from | query | string (date-time) | no | — |
to | query | string (date-time) | no | — |
sourceSovereign | query | string | no | — |
targetSovereign | query | string | no | — |
legalBasis | query | string | no | — |
status | query | string | no | — |
format | query | string | no | — |
cursor | query | string | no | — |
pageSize | query | integer (int32) | no | — |
Request body
No request body.
Responses
ReturningNationalIntakeFacts
/api/v1/instances/returning-national-intakes/{intakeId}/subjects/{userId}Reads the recorded facts of an intake the given subject opened.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
intakeId | path | string (uuid) | yes | — |
userId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ReturningNationalIntakeFactsProblemDetailsSovereignInstanceOperatingTerms
/api/v1/instances/sovereign/{id}/operating-termsReads the instance's operator and service level.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
SovereignInstanceOperatingTermsDtoProblemDetails/api/v1/instances/sovereign/{id}/operating-terms/operatorRecords the instance's operator, or changes it. A change needs a `reason`, and a change of operator clears the service level the previous operator committed to.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
RecordSovereignInstanceOperatorRequestasapplication/*+json,application/json,text/json
Responses
SovereignInstanceOperatingTermsDtoProblemDetailsProblemDetailsProblemDetails/api/v1/instances/sovereign/{id}/operating-terms/service-levelDeclares the current operator's service level for the instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
Not marked as required in the document.
DeclareInstanceServiceLevelRequestasapplication/*+json,application/json,text/json
Responses
SovereignInstanceOperatingTermsDtoProblemDetailsProblemDetailsProblemDetailsSovereignInstances
/api/v1/instances/sovereignRetrieves sovereign instances with optional filtering by region and/or jurisdiction.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
region | query | string | no | Optional sovereign region filter: an ISO 3166-1 alpha-2 code (e.g. GB, DE, AE). A cloud region is refused with 400 (EPIC 107 FR-HMF.010/012). |
jurisdictionCode | query | string | no | Optional jurisdiction code filter (e.g., EU, US, UK). |
onlyHealthy | query | boolean | no | If true, only returns instances with Active status. |
Request body
No request body.
Responses
SovereignInstanceDto[]ValidationProblemDetails/api/v1/instances/sovereignCreates a new sovereign instance with jurisdiction-specific configuration.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateSovereignInstanceCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetails/api/v1/instances/sovereign/{id}Retrieves a specific sovereign instance by ID.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The sovereign instance ID. |
Request body
No request body.
Responses
SovereignInstanceDtoProblemDetails/api/v1/instances/sovereign/{id}/activateActivates a sovereign instance, transitioning it from Provisioning to Active. Idempotent: an already-Active instance returns 200. Activation is guarded on validator registration; supply validator material in the body to bootstrap a single-validator chain when none is registered yet.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The sovereign instance ID. |
Request body
Not marked as required in the document.
ActivateSovereignInstanceCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/instances/sovereign/{id}/organization-instancesLists all organization instances connected to this sovereign instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The sovereign instance ID. |
Request body
No request body.
Responses
OrganizationInstanceDto[]/api/v1/instances/sovereign/{id}/organization-instances/{orgId}Connects an organization instance to this sovereign instance. Establishes a sovereign-to-organization relationship.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The sovereign instance ID. |
orgId | path | string (uuid) | yes | The organization instance ID to connect. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/instances/sovereign/{id}/organization-instances/{orgId}Disconnects an organization instance from this sovereign instance. Removes the sovereign-to-organization relationship.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The sovereign instance ID. |
orgId | path | string (uuid) | yes | The organization instance ID to disconnect. |
Request body
No request body.
Responses
ProblemDetailsProblemDetails/api/v1/instances/sovereign/{id}/regionUpdates the data residency rules for a sovereign instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The sovereign instance ID. |
Request body
Not marked as required in the document.
UpdateSovereignInstanceRegionCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetails/api/v1/instances/sovereign/{id}/validator-registration/retryRetries a failed validator-registration step for an existing sovereign instance. Operators invoke this when the Tier F-6 step 9 registration exhausted its retry budget during initial provisioning and the sovereign is stuck in Essence.Core.Instance.Domain.Enums.InstanceStatus.Provisioning status with `ValidatorRegistered = false`. Reuses the previously-generated Ed25519 keypair so the central validator-set recognises the retry as idempotent.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
ValidatorRegistrationRetryResultProblemDetailsProblemDetailsProblemDetailsSovereignty
/api/v1/sovereignty/cross-boundary-replication/attestRecords a cross-boundary encrypted-backup geo-replication and returns a signed CC-090 key-sovereignty attestation.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
AttestCrossBoundaryReplicationRequestasapplication/*+json,application/json,text/json
Responses
KeySovereigntyAttestationProblemDetailsSponsoredResolutions
/api/v1/instances/sponsored-resolutionsIdempotently resolves a sponsored organisation's identity.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
SponsoredResolutionRequestasapplication/*+json,application/json,text/json
Responses
SponsoredResolutionResponseProblemDetails/api/v1/instances/sponsored-resolutions/by-organization/{organizationId}Resolves the supplier identity an organisation was invited under, for the token authority (EPIC 9) to stamp on that organisation's access tokens.
<b>Not an AC-19 surface.</b> AC-19 stops a SPONSOR learning whether the supplier it invited already existed; this route answers "which identity is THIS organisation", a fact the organisation already knows about itself. It is service-account only, it requires an organisation id as INPUT — which a sponsor is never given, precisely because M:Essence.Core.Instance.Api.Controllers.SponsoredResolutionsController.Resolve(Essence.Core.Instance.Api.Controllers.SponsoredResolutionRequest,System.Threading.CancellationToken) withholds it — and it returns no lifecycle state, no sponsor and no sponsorship count, so it cannot be used to probe either.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
organizationId | path | string (uuid) | yes | — |
Request body
No request body.
Responses
SupplierIdentityKeyResponseSubjectResidency
/api/v1/residency/my/approvalsLists the cross-border approval requests the caller raised for themselves, newest-first, each with its current state (Pending / Approved / Denied / Expired) and, once decided, the deciding authority and reason.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
CrossBorderApprovalDto[]/api/v1/residency/my/approvalsRaises a cross-border approval request for a corridor affecting the caller's OWN data. The request enters the same FR-03.029a approval queue an authority-raised one does, marked `Origin = DataSubject` so the console can tell that a person is waiting on the reply.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
SubjectApprovalRequestBodyasapplication/*+json,application/json,text/json
Responses
CrossBorderApprovalDtoProblemDetails/api/v1/residency/my/approvals/{id}Reads one of the caller's own cross-border approval requests. A request that does not exist and one that belongs to another subject both return 404 — deliberately indistinguishable.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body
No request body.
Responses
CrossBorderApprovalDtoProblemDetailsSupervisedInstances
/api/v1/instances/supervisedLists the supervised instances provisioned under the <b>authenticated</b> guardian — the roster that powers the supervised-accounts console, with each minor's graduation status and a majority-approaching transition flag. The roster is strictly caller-scoped: the guardian is read from the bearer token's subject claim, never from the request, so a guardian can never enumerate another guardian's minors (IDOR) — the same contract the sibling roster `GET /api/v1/family/wards` (`Vault/.../FamilyWardsController`) states, and the same reason `POST /api/v1/consent/guardian-grant` refuses a body-supplied grantor. A guardian who supervises nobody gets `200 []`; an empty roster is not an error (#6442 — a request-supplied guardian id made the no-query-string call bind System.Guid.Empty and the repository's non-empty guard turned it into a 500).
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
majorityApproachingWindowDays | query | integer (int32) | no | Days ahead of a supervision-end date that count as "approaching" (default 90). |
Request body
No request body.
Responses
SupervisedInstanceDto[]ProblemDetails/api/v1/instances/supervisedProvisions a single supervised (minor) instance under a guardian with a durable age-assurance attribute (the wizard's Step-2 seam).
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
ProvisionSupervisedInstanceCommandasapplication/*+json,application/json,text/json
Responses
SupervisedInstanceDtoProblemDetailsProblemDetails/api/v1/instances/supervised/batchBatch-provisions a whole cohort of supervised instances under one guardian with one control template applied across every child, in a single atomic call (debt-2026-07-09-038). Either the whole roster is provisioned or none is.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
BatchProvisionSupervisedInstancesCommandasapplication/*+json,application/json,text/json
Responses
BatchProvisionSupervisedInstancesResultDtoProblemDetailsProblemDetailsUsers
/api/v1/usersLists users with optional status and search filters.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
status | query | string | no | Optional filter by active status ("active" or "inactive"). |
search | query | string | no | Optional search term to match against name or email. |
page | query | integer (int32) | no | Page number (1-based, defaults to 1). |
pageSize | query | integer (int32) | no | Items per page (defaults to 50, capped at 100). |
Request body
No request body.
Responses
unspecifiedProblemDetails/api/v1/usersCreates a new user.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateUserRequestasapplication/*+json,application/json,text/json
Responses
unspecifiedProblemDetailsProblemDetails/api/v1/users/searchSearches for users by email or name within the current instance. Only returns active, email-verified users.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
searchTerm | query | string | no | The search term to match against email, first name, or last name. |
page | query | integer (int32) | no | 1-based page index (defaults to 1). |
pageSize | query | integer (int32) | no | Items per page (defaults to 50, capped server-side at 100). |
Request body
No request body.
Responses
UserSummaryResponse[]ProblemDetailsProblemDetails/api/v1/users/{id}Retrieves a user's profile by their unique identifier. Only returns profiles for active, email-verified users in the same instance.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The user ID. |
Request body
No request body.
Responses
UserSummaryResponseProblemDetailsProblemDetails/api/v1/users/{id}/activateActivates a user account.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The user ID. |
Request body
No request body.
Responses
unspecifiedProblemDetails/api/v1/users/{id}/auditRetrieves audit log entries for a user.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The user ID. |
page | query | integer (int32) | no | Page number (1-based, defaults to 1). |
pageSize | query | integer (int32) | no | Number of items per page (defaults to 20). |
Request body
No request body.
Responses
unspecifiedProblemDetails/api/v1/users/{id}/permissionsRetrieves permissions for a user based on their assigned roles.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The user ID. |
Request body
No request body.
Responses
unspecifiedProblemDetails/api/v1/users/{id}/rolesRetrieves roles assigned to a user.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The user ID. |
Request body
No request body.
Responses
unspecifiedProblemDetails/api/v1/users/{id}/rolesAssigns a role to a user.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The user ID. |
Request body
Not marked as required in the document.
AssignRoleRequestasapplication/*+json,application/json,text/json
Responses
unspecifiedProblemDetailsProblemDetails/api/v1/users/{id}/roles/{roleId}Removes a role from a user.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The user ID. |
roleId | path | string | yes | The role ID to remove. |
Request body
No request body.
Responses
unspecifiedProblemDetailsProblemDetails/api/v1/users/{id}/suspendSuspends a user account.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The user ID. |
Request body
No request body.
Responses
unspecifiedProblemDetailsUserVaultRegistry
/api/v1/registry/users/me/vaultsRetrieves the authenticated caller's vault registry entries — one row per vault they own, across every sovereign region.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
No request body.
Responses
ProblemDetailsVaultRehome
/api/v1/instances/vault-rehomeStarts a vault re-home for the <b>authenticated caller</b> — the INITIATION seam the family-separation-shared-vault-split journey needs (debt-2026-08-12-040). Builds the re-home set for the receiving party and moves the job to `Moving`; the returned status is the same shape `GET /status` subsequently serves, so the surface can render progress immediately without a second round trip. Ownership is taken from the caller's subject claim and never from the request body, so a caller cannot open a re-home job against another person's documents. The optional `clientCorrelationId` is the initiator's own opaque handle (for the family journey, the EPIC 30 `{splitId}:{itemId}` reference); it is echoed on the relay completion event so the initiator advances its record off the real completion. It must not carry PII.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
StartVaultRehomeRequestasapplication/*+json,application/json,text/json
Responses
VaultRehomeStatusDtoProblemDetailsProblemDetails/api/v1/instances/vault-rehome/{id}/documents/{documentId}/retrySafely retries a single failed document within the re-home job. Re-queues ONLY the named failed document — an already-moved document is never re-run. Returns the re-opened status.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The re-home job id. |
documentId | path | string | yes | The opaque id of the failed document to retry. |
Request body
No request body.
Responses
VaultRehomeStatusDtoProblemDetails/api/v1/instances/vault-rehome/{id}/statusGets the sanitised status of a vault re-home job — the "your documents are moving to your own vault" progress + confirmation surface, including the distinct `Partial` terminal state and the per-document breakdown.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The re-home job id. |
Request body
No request body.
Responses
VaultRehomeStatusDtoProblemDetailsVaults
/api/v1/vaultsCreates a new vault for secure data storage.
Authentication:Bearer (the document-wide requirement)
Parameters
Takes no parameters.
Request body
Not marked as required in the document.
CreateVaultCommandasapplication/*+json,application/json,text/json
Responses
string (uuid)ProblemDetailsProblemDetailsProblemDetails/api/v1/vaults/instance/{instanceId}Lists all vaults for a specific instance. Requires InstanceAdmin or GlobalAdmin role.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
instanceId | path | string (uuid) | yes | The instance ID. |
includeArchived | query | boolean | no | Whether to include archived vaults (default: false). |
cursor | query | string | no | Opaque continuation cursor from a prior page's NextCursor, or null for the first slice. |
pageSize | query | integer (int32) | no | Requested slice size; clamped to [1, 500] (DAT-006). |
Request body
No request body.
Responses
VaultProvisioningRecordCursorResultProblemDetailsProblemDetails/api/v1/vaults/owner/{ownerId}Lists all vaults owned by a specific user.
Authorization boundary (debt-2026-06-28-254): the administrator cross-owner enumeration is <b>instance-scoped by design</b> — bounded to the caller's own `InstanceId`, pushed into the SQL predicate below, so cross-instance vault metadata is never loaded. There is no org-membership predicate within an instance, which is why the administrator here is the INSTANCE administrator: a sovereign instance hosts many organisations' members, so an organisation's administrator must not inherit an instance-wide read (#22641; the gate used to name "OrganizationAdmin", a role no token carries). Should organisation administrators need this read, an explicit org-membership predicate must be added to Essence.Core.Instance.Application.Queries.ListVaultsByOwnerQuery first — see the debt for the product decision.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
ownerId | path | string (uuid) | yes | The owner user ID. |
includeArchived | query | boolean | no | Whether to include archived vaults (default: false). |
Request body
No request body.
Responses
VaultProvisioningRecord[]ProblemDetailsProblemDetails/api/v1/vaults/{id}Retrieves a vault by its unique identifier.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The vault ID. |
Request body
No request body.
Responses
VaultProvisioningRecordProblemDetailsProblemDetails/api/v1/vaults/{id}Updates vault name and description.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The vault ID. |
Request body
Not marked as required in the document.
UpdateVaultCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/vaults/{id}/archiveArchives a vault (soft delete). Archived vaults cannot have documents added but existing data is preserved.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The vault ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/vaults/{id}/limitsUpdates vault storage and document limits.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The vault ID. |
Request body
Not marked as required in the document.
UpdateVaultLimitsCommandasapplication/*+json,application/json,text/json
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetails/api/v1/vaults/{id}/restoreRestores an archived vault.
Authentication:Bearer (the document-wide requirement)
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (uuid) | yes | The vault ID. |
Request body
No request body.
Responses
ProblemDetailsProblemDetailsProblemDetailsProblemDetailsSchemas
AcknowledgeRelocationNoticeBody
Request body for an organisation's response to a relocation notice.
| Property | Type | Required | Description |
|---|---|---|---|
comment | string | null | no | The organisation's comment; required when objecting. |
response | string | null | no | "acknowledged" (default when omitted) or "objected". An objection must carry a Essence.Core.Instance.Api.Controllers.OrgResidencyController.AcknowledgeRelocationNoticeBody.Comment. |
ActingOrganizationDto
| Property | Type | Required | Description |
|---|---|---|---|
organizationId | string (uuid) | no | — |
ActivateSovereignInstanceCommand
| Property | Type | Required | Description |
|---|---|---|---|
instanceId | string (uuid) | no | — |
validatorAddress | string | null | no | — |
validatorPublicKeyBase64 | string | null | no | — |
AdminCreateOrganizationRequest
Request body for M:Essence.Core.Instance.Api.Controllers.AdminOrganizationsController.CreateOrganization(Essence.Core.Instance.Api.Controllers.AdminCreateOrganizationRequest,System.Threading.CancellationToken).
| Property | Type | Required | Description |
|---|---|---|---|
adminDisplayName | string | null | no | — |
adminEmail | string | null | no | — |
globalInstanceId | string (uuid) | no | — |
orgAdminUserId | string (uuid) | no | — |
organizationId | string (uuid) | no | — |
organizationName | string | null | no | — |
parentSovereignInstanceId | string (uuid) | no | — |
pricingPlanId | string (uuid) | null | no | — |
region | string | null | no | — |
slug | string | null | no | — |
AgeAssuranceLevel
"SelfDeclared" | "Basic" | "Substantial" | "High" with no declared properties.
AlertActionRequest
The body of a monitoring alert action. Only `suppress` requires it.
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | Why the alert is being muted. |
suppressedUntil | string (date-time) | null | no | When the mute lapses (UTC). Must be in the future. |
ApprovalDecisionBody
Request body for an approve / deny / expire decision (S-03.02 write).
| Property | Type | Required | Description |
|---|---|---|---|
expiresAt | string (date-time) | null | no | Optional approval expiry (approve only); must be in the future. |
mechanism | string | null | no | Legal mechanism name for an approval (SCC/BCR/TIA/Adequacy); defaults to SCC. |
reason | string | null | no | Operator-supplied reason for the decision (required). |
scope | string | null | no | Optional decision scope qualifier (approve only). |
ApproveRegistrationRequestBody
Request body for approving a registration request.
| Property | Type | Required | Description |
|---|---|---|---|
conditions | string | null | no | Gets or sets optional conditions attached to the approval. |
AssignRoleRequest
Request model for assigning a role to a user.
| Property | Type | Required | Description |
|---|---|---|---|
expiresAt | string (date-time) | null | no | Gets or sets the optional expiration date for the role assignment. |
instanceScope | string | null | no | Gets or sets the instance scope for the role. |
roleId | string | null | no | Gets or sets the role ID to assign. |
AssuranceCreditPreviewDto
| Property | Type | Required | Description |
|---|---|---|---|
basisCredentialId | string (uuid) | no | — |
originLoA | string | null | no | — |
originScheme | string | null | no | — |
policyId | string | null | no | — |
provisionalDomesticAssurance | string | null | no | — |
residualCheckDescription | string | null | no | — |
residualCheckRequired | boolean | no | — |
AttestCrossBoundaryReplicationRequest
Request to record + attest a CC-090 cross-boundary encrypted-backup geo-replication.
| Property | Type | Required | Description |
|---|---|---|---|
backupId | string (uuid) | no | Backup whose ciphertext is being replicated. |
encryptionKeyId | string | null | no | Identifier (not material) of the encryption key that stays sovereign. |
instanceId | string (uuid) | no | Sovereign instance the backup belongs to. |
requestedBy | string | null | no | Activating actor; overridden by the authenticated principal when present so the audit trail attributes to the real caller. |
sourceRegion | string | null | no | Sovereign-local source region. |
sovereignKmsRegion | string | null | no | Sovereign KMS region the encryption key never leaves. |
targetRegion | string | null | no | Foreign (out-of-boundary) target region for the ciphertext. |
BatchProvisionSupervisedInstancesCommand
| Property | Type | Required | Description |
|---|---|---|---|
controlTemplateRef | string | null | no | — |
graduationScheduleRef | string | null | no | — |
guardianId | string (uuid) | no | — |
roster | SupervisedInstanceRosterEntry[] | null | no | — |
BatchProvisionSupervisedInstancesResultDto
| Property | Type | Required | Description |
|---|---|---|---|
batchId | string (uuid) | no | — |
controlTemplateRef | string | null | no | — |
instances | SupervisedInstanceDto[] | null | no | — |
provisionedCount | integer (int32) | no | — |
BindCustomDomainRequest
| Property | Type | Required | Description |
|---|---|---|---|
customDomain | string | null | no | — |
CertificateDto
| Property | Type | Required | Description |
|---|---|---|---|
certificateType | CertificateType | yes | — |
expiresAt | string (date-time) | yes | — |
instanceId | string (uuid) | null | no | — |
isExpiringSoon | boolean | no | — |
isHsmBacked | boolean | yes | — |
isValid | boolean | no | — |
issuedAt | string (date-time) | yes | — |
revocationReason | CertificateRevocationReason | no | — |
revokedAt | string (date-time) | null | no | — |
serialNumber | string | null | yes | — |
status | CertificateStatus | yes | — |
subjectName | string | null | yes | — |
thumbprint | string | null | yes | — |
CertificateRevocationReason
"Unspecified" | "KeyCompromise" | "CACompromise" | "AffiliationChanged" | "Superseded" | "CessationOfOperation" | "CertificateHold" | "RemoveFromCRL" | "PrivilegeWithdrawn" | "AACompromise" with no declared properties.
CertificateStatus
"Valid" | "Revoked" | "Expired" | "Pending" with no declared properties.
CertificateType
"Root" | "Intermediate" | "Leaf" with no declared properties.
CircuitBreakerState
Represents the state of a circuit breaker for a specific target instance.
| Property | Type | Required | Description |
|---|---|---|---|
breakDuration | string (date-span) | no | Gets or sets the duration the circuit stays open before transitioning to half-open. |
consecutiveFailureCount | integer (int32) | no | Gets or sets the consecutive failure count. |
failureThreshold | integer (int32) | no | Gets or sets the failure threshold that triggers the circuit to open. |
lastOpenedAt | string (date-time) | null | no | Gets or sets the timestamp when the circuit was last opened (null if never opened). |
state | string | null | no | Gets or sets the current circuit state (Closed, Open, HalfOpen). |
targetInstanceId | string | null | no | Gets or sets the target instance ID. |
CircuitBreakerStatesResponse
Response model for circuit breaker states query.
| Property | Type | Required | Description |
|---|---|---|---|
checkedAt | string (date-time) | no | Gets or sets the timestamp when the states were checked. |
circuitBreakers | map<string, CircuitBreakerState> | null | no | Gets or sets the dictionary of circuit breaker states keyed by target instance ID. |
CompleteMaterialisationRequest
| Property | Type | Required | Description |
|---|---|---|---|
databaseConnectionString | string | null | no | The database the operator actually created. |
endpointUrl | string | null | no | Where the instance is reachable. |
CompleteRegistrationRequestBody
Request body for completing a registration.
| Property | Type | Required | Description |
|---|---|---|---|
approvalToken | string | null | no | Gets or sets the approval token to validate. |
ComplianceStatus
"Compliant" | "NonCompliant" | "UnderReview" | "Exempt" with no declared properties.
ComputeRouteRequest
Request model for computing an optimal route between instances.
| Property | Type | Required | Description |
|---|---|---|---|
sourceInstanceId | string | null | no | Gets or sets the source instance ID. |
targetInstanceId | string | null | no | Gets or sets the target instance ID. |
CreateDeveloperIdRequest
Request payload for creating a developer ID.
| Property | Type | Required | Description |
|---|---|---|---|
displayName | string | null | no | — |
notes | string | null | no | — |
ownerEmail | string | null | no | — |
slug | string | null | no | — |
CreateDnsRecordCommand
| Property | Type | Required | Description |
|---|---|---|---|
healthCheckEnabled | boolean | no | — |
healthCheckEndpoint | string | null | no | — |
name | string | null | no | — |
priority | integer (int32) | null | no | — |
ttl | integer (int32) | no | — |
type | string | null | no | — |
value | string | null | no | — |
weight | integer (int32) | null | no | — |
zoneId | string (uuid) | no | — |
CreateDnsZoneCommand
| Property | Type | Required | Description |
|---|---|---|---|
ownerInstanceId | string (uuid) | no | — |
ownerInstanceType | string | null | no | — |
parentZoneId | string (uuid) | null | no | — |
provider | string | null | no | — |
providerConfiguration | string | null | no | — |
zoneName | string | null | no | — |
zoneType | string | null | no | — |
CreateGlobalInstanceCommand
| Property | Type | Required | Description |
|---|---|---|---|
autoScalingEnabled | boolean | no | — |
availabilityZone | string | null | no | — |
backupEnabled | boolean | no | — |
backupRetentionDays | integer (int32) | no | — |
complianceCertifications | string | null | no | — |
dataCenter | string | null | no | — |
endpointUrl | string | null | no | — |
highAvailabilityEnabled | boolean | no | — |
jurisdiction | string | null | no | — |
maxApiRequestsPerHour | integer (int32) | no | — |
maxConnections | integer (int32) | no | — |
maxStorageGb | integer (int64) | no | — |
monitoringEnabled | boolean | no | — |
name | string | null | no | — |
region | string | null | no | — |
tags | string | null | no | — |
version | string | null | no | — |
CreateInstanceResponseDto
| Property | Type | Required | Description |
|---|---|---|---|
id | string (uuid) | no | — |
location | string | null | no | — |
CreateOrganizationInstanceCommand
| Property | Type | Required | Description |
|---|---|---|---|
adminDisplayName | string | null | no | — |
adminEmail | string | null | no | — |
autoScalingEnabled | boolean | no | — |
availabilityZone | string | null | no | — |
backupEnabled | boolean | no | — |
backupRetentionDays | integer (int32) | no | — |
commercialModel | string | null | no | — |
complianceCertifications | string | null | no | — |
cpuCores | integer (int32) | no | — |
createdByUserId | string (uuid) | no | — |
creatorOrganizationId | string (uuid) | null | no | — |
creatorType | OrganizationCreatorType | no | — |
customDomain | string | null | no | — |
customFieldsEnabled | boolean | no | — |
customWorkflowsEnabled | boolean | no | — |
dataCenter | string | null | no | — |
databaseSku | string | null | no | — |
dealRegistrationId | string | null | no | — |
deploymentModel | InstanceDeploymentModel | no | — |
deploymentRegion | string | null | no | — |
endpointUrl | string | null | no | — |
faviconUrl | string | null | no | — |
founderUserId | string (uuid) | null | no | — |
globalInstanceId | string (uuid) | no | — |
highAvailabilityEnabled | boolean | no | — |
infrastructureProvider | string | null | no | — |
instanceLicenceSubscriptionId | string (uuid) | null | no | — |
instancePricingPlanId | string (uuid) | null | no | — |
instanceSkuCode | string | null | no | — |
integrationsEnabled | boolean | no | — |
isDedicated | boolean | no | — |
isPendingClaim | boolean | no | — |
logoUrl | string | null | no | — |
maxApiRequestsPerHour | integer (int32) | no | — |
maxConnections | integer (int32) | no | — |
maxStorageGb | integer (int32) | no | — |
memoryGb | integer (int32) | no | — |
monitoringEnabled | boolean | no | — |
name | string | null | no | — |
operatorOrganizationId | string (uuid) | null | no | — |
organizationDisplayName | string | null | no | — |
organizationId | string (uuid) | no | — |
organizationName | string | null | no | — |
parentSovereignInstanceId | string (uuid) | no | — |
partnerId | string (uuid) | null | no | — |
pricingPlanId | string (uuid) | null | no | — |
primaryColor | string | null | no | — |
region | string | null | no | — |
requestedModuleIds | string[] | null | no | — |
secondaryColor | string | null | no | — |
serviceEndpointOverrides | map<string, string> | null | no | — |
slug | string | null | no | — |
storageGb | integer (int32) | no | — |
tags | string | null | no | — |
version | string | null | no | — |
whiteLabelEnabled | boolean | no | — |
CreateRegistrationRequestCommand
| Property | Type | Required | Description |
|---|---|---|---|
isDedicated | boolean | null | no | — |
jurisdictionCode | string | null | no | — |
justification | string | null | no | — |
organizationId | string (uuid) | null | no | — |
organizationName | string | null | no | — |
region | string | null | no | — |
requestType | string | null | no | — |
requestedByEmail | string | null | no | — |
requestedByUserId | string (uuid) | no | — |
requestingInstanceId | string (uuid) | no | — |
requestingInstanceName | string | null | no | — |
slug | string | null | no | — |
targetInstanceId | string (uuid) | no | — |
targetInstanceType | string | null | no | — |
CreateSovereignInstanceCommand
| Property | Type | Required | Description |
|---|---|---|---|
allowedStorageRegions | string | null | no | — |
allowedTransferJurisdictions | string | null | no | — |
autoScalingEnabled | boolean | no | — |
availabilityZone | string | null | no | — |
backupEnabled | boolean | no | — |
backupRetentionDays | integer (int32) | no | — |
complianceCertifications | string | null | no | — |
countryCode | string | null | no | — |
dataCenter | string | null | no | — |
edgeCachingEnabled | boolean | no | — |
endpointUrl | string | null | no | — |
globalInstanceId | string (uuid) | no | — |
highAvailabilityEnabled | boolean | no | — |
jurisdictionCode | string | null | no | — |
jurisdictionName | string | null | no | — |
maxApiRequestsPerHour | integer (int32) | no | — |
maxConnections | integer (int32) | no | — |
maxStorageGb | integer (int32) | no | — |
monitoringEnabled | boolean | no | — |
name | string | null | no | — |
primaryRegion | string | null | no | — |
region | string | null | no | — |
regulatoryFramework | string | null | no | — |
requireStandardContractualClauses | boolean | no | — |
tags | string | null | no | — |
version | string | null | no | — |
CreateUserRequest
Request model for creating a user.
| Property | Type | Required | Description |
|---|---|---|---|
email | string | null | no | Gets or sets the user's email address. |
fullName | string | null | no | Gets or sets the user's full name. |
role | string | null | no | Gets or sets the role to assign to the user. |
CreateVaultCommand
| Property | Type | Required | Description |
|---|---|---|---|
authenticationTag | string | null | no | — |
autoDeleteDays | integer (int32) | null | no | — |
autoDeleteEnabled | boolean | no | — |
description | string | null | no | — |
initializationVector | string | null | no | — |
instanceId | string (uuid) | no | — |
keyId | string | null | no | — |
maxDocuments | integer (int32) | null | no | — |
maxSizeBytes | integer (int64) | null | no | — |
name | string | null | no | — |
ownerId | string (uuid) | no | — |
salt | string | null | no | — |
CredentialLockdownResponse
Response body for a presented-credential lockdown.
| Property | Type | Required | Description |
|---|---|---|---|
recordId | string (uuid) | no | The compromise-record id (stable across idempotent retries). |
CrossBorderApprovalDto
| Property | Type | Required | Description |
|---|---|---|---|
adequacyOutcome | string | null | yes | — |
dataClassification | string | null | no | — |
decidedAt | string (date-time) | null | no | — |
decidedBy | string | null | no | — |
decisionReason | string | null | no | — |
decisionScope | string | null | no | — |
expiresAt | string (date-time) | null | no | — |
id | string (uuid) | yes | — |
mechanism | string | null | no | — |
origin | string | null | no | — |
purpose | string | null | yes | — |
recipient | string | null | yes | — |
requestedAt | string (date-time) | yes | — |
requestedBy | string | null | yes | — |
sourceJurisdiction | string | null | yes | — |
status | string | null | yes | — |
targetJurisdiction | string | null | yes | — |
territories | string[] | null | no | — |
CrossBorderApprovalDtoCursorResult
| Property | Type | Required | Description |
|---|---|---|---|
hasMore | boolean | no | — |
items | CrossBorderApprovalDto[] | null | no | — |
nextCursor | string | null | no | — |
pageSize | integer (int32) | no | — |
previousCursor | string | null | no | — |
CrossBorderVerdictDto
| Property | Type | Required | Description |
|---|---|---|---|
adequacyOutcome | string | null | yes | — |
approvalId | string (uuid) | null | no | — |
approvalStatus | string | null | no | — |
approvingAuthority | string | null | no | — |
binding | boolean | no | — |
decidedAt | string (date-time) | null | no | — |
evaluatedAt | string (date-time) | yes | — |
expiresAt | string (date-time) | null | no | — |
legalBasis | string | null | yes | — |
recipient | string | null | no | — |
sourceJurisdiction | string | null | yes | — |
targetJurisdiction | string | null | yes | — |
verdict | string | null | yes | — |
CrossRegionRolloutDto
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
endedAt | string (date-time) | null | no | — |
fromVersion | string | null | no | — |
haltReason | string | null | no | — |
haltedAutomatically | boolean | no | — |
id | string (uuid) | no | — |
nextRegion | string | null | no | — |
orderedRegions | string[] | null | no | — |
rolledRegions | string[] | null | no | — |
startedAt | string (date-time) | null | no | — |
state | string | null | no | — |
toVersion | string | null | no | — |
updatedAt | string (date-time) | null | no | — |
CustomDomainBindingDto
| Property | Type | Required | Description |
|---|---|---|---|
boundAt | string (date-time) | null | no | — |
customDomain | string | null | no | — |
enabled | boolean | no | — |
lastVerificationMessage | string | null | no | — |
organizationInstanceId | string (uuid) | no | — |
status | string | null | no | — |
verificationRecordName | string | null | no | — |
verificationRecordValue | string | null | no | — |
verifiedAt | string (date-time) | null | no | — |
DeclareInstanceServiceLevelRequest
| Property | Type | Required | Description |
|---|---|---|---|
availabilityTargetBasisPoints | integer (int32) | no | — |
criticalIncidentResponseMinutes | integer (int32) | no | — |
supportCoverage | string | null | no | — |
DeclineJointVentureRequest
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | — |
DedicatedMaterialisationQueueItem
| Property | Type | Required | Description |
|---|---|---|---|
cpuCores | integer (int32) | no | — |
instanceId | string (uuid) | no | — |
memoryGb | integer (int32) | no | — |
organizationName | string | null | no | — |
parentSovereignInstanceId | string (uuid) | no | — |
region | string | null | no | — |
requestId | string (uuid) | no | — |
requestedAt | string (date-time) | no | — |
storageGb | integer (int32) | no | — |
DeveloperIdEntry
Represents a developer ID entry.
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
displayName | string | null | no | — |
id | string (uuid) | no | — |
notes | string | null | no | — |
ownerEmail | string | null | no | — |
slug | string | null | no | — |
status | string | null | no | — |
suspendedReason | string | null | no | — |
updatedAt | string (date-time) | no | — |
DiscoveryResult
| Property | Type | Required | Description |
|---|---|---|---|
discoveredAt | string (date-time) | no | — |
endpoint | string | null | no | — |
errorMessage | string | null | no | — |
instanceId | string | null | no | — |
isHealthy | boolean | no | — |
latency | string (date-span) | no | — |
region | string | null | no | — |
status | DiscoveryStatus | no | — |
DiscoveryStatus
"Success" | "Unhealthy" | "Unreachable" | "NotFound" | "Timeout" | "Error" | "Maintenance" | "NoAdequateSovereign" with no declared properties.
DnsRecordDto
| Property | Type | Required | Description |
|---|---|---|---|
healthCheckEnabled | boolean | no | — |
healthCheckEndpoint | string | null | no | — |
id | string (uuid) | no | — |
lastVerifiedAt | string (date-time) | null | no | — |
name | string | null | no | — |
priority | integer (int32) | null | no | — |
status | string | null | no | — |
ttl | integer (int32) | no | — |
type | string | null | no | — |
value | string | null | no | — |
weight | integer (int32) | null | no | — |
zoneId | string (uuid) | no | — |
DnsZoneDto
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
id | string (uuid) | no | — |
name | string | null | no | — |
ownerInstanceId | string (uuid) | no | — |
ownerInstanceType | string | null | no | — |
parentZoneId | string (uuid) | null | no | — |
provider | string | null | no | — |
records | DnsRecordDto[] | null | no | — |
status | string | null | no | — |
updatedAt | string (date-time) | no | — |
zoneType | string | null | no | — |
DomainEvent
| Property | Type | Required | Description |
|---|---|---|---|
aggregateId | string (uuid) | no | — |
aggregateType | string | null | no | — |
eventId | string (uuid) | no | — |
metadata | map<string, string> | null | no | — |
occurredOn | string (date-time) | no | — |
version | integer (int32) | no | — |
DrivingCategoryGrantInput
| Property | Type | Required | Description |
|---|---|---|---|
code | string | null | no | — |
obtainedOn | string (date) | null | no | — |
validUntil | string (date) | null | no | — |
EstablishEVisaRequest
Request body for `POST /api/v1/cross-border/immigration-status/evisa`.
| Property | Type | Required | Description |
|---|---|---|---|
credentialId | string | null | no | Opaque eVisa credential identifier. |
validFrom | string (date) | no | Start of the eVisa's validity. |
validUntil | string (date) | null | no | End of the eVisa's validity; null when open-ended. |
FailMaterialisationRequest
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | Why it cannot be built. The organisation is owed an explanation and the next operator is owed the context — a blank is refused. |
FlagPresentedCredentialCompromisedCommand
| Property | Type | Required | Description |
|---|---|---|---|
consentRecordRef | string | null | yes | — |
credentialId | string | null | yes | — |
flaggedByUserId | string (uuid) | yes | — |
issuer | string | null | yes | — |
relyingPartyRef | string | null | no | — |
statusListIndex | integer (int64) | null | no | — |
statusListUrl | string | null | no | — |
vaultRef | string (uuid) | yes | — |
ForeignCredentialCaptureRequest
One submitted foreign credential reference (ZK metadata only — never a payload).
| Property | Type | Required | Description |
|---|---|---|---|
issuerJurisdiction | string | null | no | Issuer jurisdiction code (ISO 3166 alpha-2 or a recognised grouping code). |
kind | string | null | no | The credential kind (`foreign-passport` | `residence-permit` | …). |
label | string | null | no | Plain-language, non-identifying label, e.g. "UAE Emirates ID". |
originLoA | string | null | no | The asserted origin assurance level (`low` | `substantial` | `high`). |
originScheme | string | null | no | The origin trust-scheme id, e.g. `UAEPass`. |
ForeignCredentialRefDto
| Property | Type | Required | Description |
|---|---|---|---|
id | string (uuid) | no | — |
identifierMask | string | null | no | — |
issuerJurisdiction | string | null | no | — |
kind | string | null | no | — |
label | string | null | no | — |
originLoA | string | null | no | — |
originScheme | string | null | no | — |
rejectionReason | string | null | no | — |
status | string | null | no | — |
GlobalInstance
| Property | Type | Required | Description |
|---|---|---|---|
activatedAt | string (date-time) | null | no | — |
configuration | InstanceConfiguration | no | — |
connectedOrganizationInstances | (string (uuid))[] | null | no | — |
connectedSovereignInstances | (string (uuid))[] | null | no | — |
createdAt | string (date-time) | no | — |
createdBy | string | null | no | — |
deletedAt | string (date-time) | null | no | — |
deletedBy | string | null | no | — |
domainEvents | DomainEvent[] | null | no | — |
endpointUrl | string | null | no | — |
hasDomainEvents | boolean | no | — |
healthCheckStatus | string | null | no | — |
id | string (uuid) | no | — |
isDeleted | boolean | no | — |
isHealthy | boolean | no | — |
lastHealthCheck | string (date-time) | null | no | — |
metadata | InstanceMetadata | no | — |
name | string | null | no | — |
provisionedAt | string (date-time) | null | no | — |
rowVersion | string (byte) | null | no | — |
status | InstanceStatus | no | — |
suspensionReason | string | null | no | — |
terminatedAt | string (date-time) | null | no | — |
terminationReason | string | null | no | — |
type | InstanceType | no | — |
updatedAt | string (date-time) | null | no | — |
updatedBy | string | null | no | — |
HealthStatus
| Property | Type | Required | Description |
|---|---|---|---|
checkedAt | string (date-time) | no | — |
httpStatusCode | integer (int32) | null | no | — |
isHealthy | boolean | no | — |
reason | string | null | no | — |
responseTime | string (date-span) | no | — |
HomeRealmDiscoveryRequest
| Property | Type | Required | Description |
|---|---|---|---|
domain | string | null | no | — |
HomeRealmDiscoveryResponse
| Property | Type | Required | Description |
|---|---|---|---|
authorizeUrl | string | null | no | — |
isDefaultRealm | boolean | no | — |
realmToken | string | null | no | — |
region | string | null | no | — |
ImmigrationStatusDto
| Property | Type | Required | Description |
|---|---|---|---|
brpMask | string | null | no | — |
brpRetiredAt | string (date-time) | null | no | — |
brpValidUntil | string (date) | no | — |
canPerformCutover | boolean | no | — |
canonicalAt | string (date-time) | null | no | — |
eVisaCredentialId | string | null | no | — |
eVisaValidFrom | string (date) | null | no | — |
eVisaValidUntil | string (date) | null | no | — |
shareCodes | ImmigrationShareCodeDto[] | null | no | — |
stage | string | null | no | — |
statusVersion | integer (int32) | no | — |
supersessionReceiptRef | string | null | no | — |
transitionId | string (uuid) | no | — |
verifications | ImmigrationVerificationDto[] | null | no | — |
ImmigrationVerificationConsoleDto
| Property | Type | Required | Description |
|---|---|---|---|
policy | ImmigrationVerificationPolicyDto | no | — |
requests | ImmigrationVerificationRequestDto[] | null | no | — |
verifications | ImmigrationVerificationDto[] | null | no | — |
ImmigrationVerificationDto
| Property | Type | Required | Description |
|---|---|---|---|
basis | string | null | no | — |
checkedAt | string (date-time) | no | — |
claimType | string | null | no | — |
credentialId | string | null | no | — |
entitlementValidUntil | string (date) | null | no | — |
maxStalenessDays | integer (int32) | no | — |
outcome | string | null | no | — |
requiresRecheck | boolean | no | — |
shareCodeId | string (uuid) | no | — |
statusVersion | integer (int32) | no | — |
subjectStage | string | null | no | — |
verificationId | string (uuid) | no | — |
verifierOrgRef | string | null | no | — |
ImmigrationVerificationPolicyDto
| Property | Type | Required | Description |
|---|---|---|---|
acceptedClaimTypes | string[] | null | no | — |
acceptedJurisdictions | string[] | null | no | — |
maxStalenessDays | integer (int32) | no | — |
organizationRef | string | null | no | — |
requireCanonicalEVisa | boolean | no | — |
ImmigrationVerificationRequestDto
| Property | Type | Required | Description |
|---|---|---|---|
claimType | string | null | no | — |
dueOn | string (date) | no | — |
fulfilledAt | string (date-time) | null | no | — |
fulfilledByVerificationId | string (uuid) | null | no | — |
requestId | string (uuid) | no | — |
requestedAt | string (date-time) | no | — |
status | string | null | no | — |
subjectRef | string | null | no | — |
InboundResidencyDecisionDto
| Property | Type | Required | Description |
|---|---|---|---|
adequacy | string | null | no | — |
destinationInstance | string | null | no | — |
destinationJurisdiction | string | null | no | — |
lawfulBasisRef | string | null | no | — |
originJurisdiction | string | null | no | — |
sourceInstance | string | null | no | — |
translatedOnly | boolean | no | — |
IncidentActionRequest
Body of a console incident action.
| Property | Type | Required | Description |
|---|---|---|---|
rootCause | string | null | no | Required by the owner to resolve. The console never collected it, which is half of why this endpoint could not drive the lifecycle. |
InstanceActivationStatus
"Unknown" | "Active" with no declared properties.
InstanceConfiguration
| Property | Type | Required | Description |
|---|---|---|---|
autoScalingEnabled | boolean | no | — |
backupEnabled | boolean | no | — |
backupRetentionDays | integer (int32) | no | — |
highAvailabilityEnabled | boolean | no | — |
maxApiRequestsPerHour | integer (int32) | no | — |
maxConnections | integer (int32) | no | — |
maxStorageGb | integer (int64) | no | — |
monitoringEnabled | boolean | no | — |
InstanceConfigurationDto
| Property | Type | Required | Description |
|---|---|---|---|
autoScalingEnabled | boolean | no | — |
backupEnabled | boolean | no | — |
backupRetentionDays | integer (int32) | no | — |
highAvailabilityEnabled | boolean | no | — |
maxApiRequestsPerHour | integer (int32) | no | — |
maxConnections | integer (int32) | no | — |
maxStorageGb | integer (int64) | no | — |
monitoringEnabled | boolean | no | — |
InstanceDeploymentModel
"Unspecified" | "CloudAzure" | "CloudAWS" | "CloudGCP" | "OnPremise" | "Hybrid" | "AirGapped" | "PartnerSovereignCloud" | "CloudOracle" | "CustomerCloud" | "ServiceProviderOperated" with no declared properties.
InstanceDiscoveryDocument
Public, anonymous-readable instance discovery document served at `GET /api/v{version}/discovery/.well-known/instance`. Contains only metadata — no PII, no tenant data — so it is safe to expose without authentication per RFC 8615.
| Property | Type | Required | Description |
|---|---|---|---|
apiVersions | string[] | null | no | API versions this instance currently advertises. |
discoveryEndpoint | string | null | no | User-discovery endpoint URL template. |
generatedAt | string (date-time) | no | UTC timestamp when the document was generated. |
healthEndpoint | string | null | no | Liveness endpoint URL fragment. |
instanceId | string | null | no | Stable identifier of this instance. |
metricsEndpoint | string | null | no | Prometheus metrics endpoint URL fragment. |
readyEndpoint | string | null | no | Readiness endpoint URL fragment. |
serviceName | string | null | no | Logical service name (matches the OBS-001 service name). |
InstanceListDto
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
endpointUrl | string | null | no | — |
id | string (uuid) | no | — |
isHealthy | boolean | no | — |
jurisdiction | string | null | no | — |
lastHealthCheck | string (date-time) | null | no | — |
name | string | null | no | — |
region | string | null | no | — |
status | InstanceStatus | no | — |
type | InstanceType | no | — |
InstanceListDtoCursorResult
| Property | Type | Required | Description |
|---|---|---|---|
hasMore | boolean | no | — |
items | InstanceListDto[] | null | no | — |
nextCursor | string | null | no | — |
pageSize | integer (int32) | no | — |
previousCursor | string | null | no | — |
InstanceMember
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
createdBy | string | null | no | — |
deletedAt | string (date-time) | null | no | — |
deletedBy | string | null | no | — |
domainEvents | DomainEvent[] | null | no | — |
email | string | null | no | — |
emailVerified | boolean | no | — |
firstName | string | null | no | — |
hasDomainEvents | boolean | no | — |
id | string (uuid) | no | — |
instanceId | string (uuid) | no | — |
isActive | boolean | no | — |
isDeleted | boolean | no | — |
lastName | string | null | no | — |
roles | string[] | null | no | — |
rowVersion | string (byte) | null | no | — |
updatedAt | string (date-time) | null | no | — |
updatedBy | string | null | no | — |
InstanceMetadata
| Property | Type | Required | Description |
|---|---|---|---|
availabilityZone | string | null | no | — |
complianceCertifications | string[] | null | no | — |
dataCenter | string | null | no | — |
jurisdiction | string | null | no | — |
region | string | null | no | — |
tags | map<string, string> | null | no | — |
version | string | null | no | — |
InstanceMetadataDto
| Property | Type | Required | Description |
|---|---|---|---|
complianceCertifications | string[] | null | no | — |
jurisdiction | string | null | no | — |
region | string | null | no | — |
tags | map<string, string> | null | no | — |
version | string | null | no | — |
InstanceRegistry
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
createdBy | string | null | no | — |
deletedAt | string (date-time) | null | no | — |
deletedBy | string | null | no | — |
description | string | null | no | — |
domainEvents | DomainEvent[] | null | no | — |
entries | map<string, InstanceRegistryEntry> | null | no | — |
hasDomainEvents | boolean | no | — |
id | string (uuid) | no | — |
isDeleted | boolean | no | — |
lastUpdatedAt | string (date-time) | no | — |
name | string | null | no | — |
rowVersion | string (byte) | null | no | — |
totalInstances | integer (int32) | no | — |
updatedAt | string (date-time) | null | no | — |
updatedBy | string | null | no | — |
InstanceRegistryEntry
| Property | Type | Required | Description |
|---|---|---|---|
activationStatus | InstanceActivationStatus | no | — |
activationUpdatedAt | string (date-time) | null | no | — |
endpointUrl | string | null | no | — |
instanceId | string (uuid) | no | — |
instanceName | string | null | no | — |
instanceType | InstanceType | no | — |
region | string | null | no | — |
registeredAt | string (date-time) | no | — |
registryId | string (uuid) | no | — |
subscriptionTier | string | null | no | — |
InstanceServiceLevelDto
| Property | Type | Required | Description |
|---|---|---|---|
availabilityTargetBasisPoints | integer (int32) | no | — |
availabilityTargetPercent | number (double) | no | — |
criticalIncidentResponseMinutes | integer (int32) | no | — |
declaredAt | string (date-time) | no | — |
supportCoverage | string | null | no | — |
InstanceStatus
"Provisioning" | "Active" | "Suspended" | "Maintenance" | "Degraded" | "Failed" | "Terminating" | "Terminated" with no declared properties.
InstanceType
"Global" | "Sovereign" | "Organization" | "Edge" | "Development" with no declared properties.
IssueCertificateRequest
Request model for issuing a certificate.
| Property | Type | Required | Description |
|---|---|---|---|
certificateType | CertificateType | yes | — |
instanceId | string (uuid) | null | no | Optional instance ID to associate with the certificate. |
signingCertificateThumbprint | string | null | no | Thumbprint of the signing certificate (required for leaf certificates). |
subjectName | string | null | yes | Subject name (Distinguished Name) for the certificate. Example: "CN=Essence Intermediate CA, O=Essence Platform, C=US" |
validityDays | integer (int32) | yes | Number of days the certificate should be valid. |
IssueCertificateResponse
Response model for certificate issuance.
| Property | Type | Required | Description |
|---|---|---|---|
issuedAt | string (date-time) | yes | UTC timestamp when the certificate was issued. |
thumbprint | string | null | yes | Thumbprint of the issued certificate. |
JointVentureDto
| Property | Type | Required | Description |
|---|---|---|---|
approvalQuorum | map<string, integer (int32)> | null | no | — |
custodyModel | string | null | no | — |
declineReason | string | null | no | — |
dualControlScope | string | null | no | — |
id | string (uuid) | no | — |
name | string | null | no | — |
proposedAt | string (date-time) | no | — |
respondedAt | string (date-time) | null | no | — |
sponsors | JointVentureSponsorDto[] | null | no | — |
status | string | null | no | — |
windDownCopyToBothParents | boolean | no | — |
windDownDestructionRequiresBothParents | boolean | no | — |
JointVentureSponsorDto
| Property | Type | Required | Description |
|---|---|---|---|
billingSharePercent | number (double) | no | — |
organizationId | string (uuid) | no | — |
organizationName | string | null | no | — |
KeySovereigntyAttestation
| Property | Type | Required | Description |
|---|---|---|---|
algorithm | string | null | no | — |
backupId | string (uuid) | yes | — |
contentHash | string | null | yes | — |
encryptionKeyId | string | null | yes | — |
foreignRegion | string | null | yes | — |
keyNeverLeftSovereignKms | boolean | no | — |
signature | string | null | yes | — |
signedAt | string (date-time) | yes | — |
sovereignKmsRegion | string | null | yes | — |
statement | string | null | yes | — |
LatencyMeasurementResult
Result model for latency measurements.
| Property | Type | Required | Description |
|---|---|---|---|
endpoint | string | null | no | Gets or sets the endpoint URL that was measured. |
isReachable | boolean | no | Gets or sets a value indicating whether the endpoint was reachable. |
latency | string (date-span) | no | Gets or sets the measured round-trip latency. Returns TimeSpan.MaxValue if the endpoint is unreachable. |
measuredAt | string (date-time) | no | Gets or sets the timestamp when the measurement was performed. |
LinkImmigrationStatusRequest
Request body for `POST /api/v1/cross-border/immigration-status/link`. There is deliberately no field for the BRP card number or the holder's date of birth. The entry screen asks for both so the person knows which document they are linking; the device keeps them and sends only the trailing mask.
| Property | Type | Required | Description |
|---|---|---|---|
brpMask | string | null | no | Trailing characters of the BRP card number (1–8). |
brpValidUntil | string (date) | no | The expiry printed on the BRP card. |
MessageStatusResponse
Response model for message delivery status.
| Property | Type | Required | Description |
|---|---|---|---|
lastUpdatedAt | string (date-time) | no | Gets or sets the timestamp of the last status update. |
maxRetries | integer (int32) | no | Gets or sets the maximum number of retry attempts. |
messageId | string | null | no | Gets or sets the unique identifier of the message. |
queueDepth | integer (int64) | no | Gets or sets the current queue depth for pending messages. |
retryCount | integer (int32) | no | Gets or sets the current retry attempt number. |
status | string | null | no | Gets or sets the current delivery status (Pending, Processing, Delivered, Failed, Queued). |
MessagingHealthResponse
Response model for messaging subsystem health check.
| Property | Type | Required | Description |
|---|---|---|---|
averageDeliveryLatency | string (date-span) | no | Gets or sets the average message delivery latency. |
checkedAt | string (date-time) | no | Gets or sets the timestamp when the health check was performed. |
circuitBreakerOpen | boolean | no | Gets or sets a value indicating whether any circuit breaker is open. |
isHealthy | boolean | no | Gets or sets a value indicating whether the messaging subsystem is healthy. |
queueDepth | integer (int64) | no | Gets or sets the current queue depth for pending messages. |
totalMessagesDelivered | integer (int64) | no | Gets or sets the total number of messages delivered successfully. |
totalMessagesFailed | integer (int64) | no | Gets or sets the total number of messages that failed permanently. |
totalMessagesSent | integer (int64) | no | Gets or sets the total number of messages sent. |
MessagingStatistics
| Property | Type | Required | Description |
|---|---|---|---|
averageDeliveryLatency | string (date-span) | no | — |
circuitBreakerOpen | boolean | no | — |
instanceId | string | null | no | — |
p95DeliveryLatency | string (date-span) | no | — |
p99DeliveryLatency | string (date-span) | no | — |
retryRate | number (double) | no | — |
successRate | number (double) | no | — |
throughputMessagesPerSecond | number (double) | no | — |
totalMessagesDelivered | integer (int64) | no | — |
totalMessagesFailed | integer (int64) | no | — |
totalMessagesQueued | integer (int64) | no | — |
totalMessagesSent | integer (int64) | no | — |
windowEnd | string (date-time) | no | — |
windowStart | string (date-time) | no | — |
ModuleEntry
Represents an installed module entry surfaced by the organization module endpoints.
| Property | Type | Required | Description |
|---|---|---|---|
category | string | null | no | — |
description | string | null | no | — |
enabled | boolean | no | — |
installedAt | string (date-time) | no | — |
moduleId | string | null | no | — |
name | string | null | no | — |
updatedAt | string (date-time) | no | — |
version | string | null | no | — |
OpenRenunciationTeardownRequest
The irreversible confirm's payload.
| Property | Type | Required | Description |
|---|---|---|---|
credentialRefs | string[] | null | no | Opaque references to the nationality-derived credentials the teardown will revoke. Carried to EPIC 6 so it can attribute EPIC 9's later credential-revoked events to this renunciation. |
jurisdiction | string | null | no | Non-PII code of the nationality being renounced. |
OpenReturningNationalIntakeRequest
Request body for `POST /api/v1/cross-border/returning-national/intake`. Carries the corridor and the ZK foreign-credential references only; the returning national is taken from the caller's JWT subject and never from this body.
| Property | Type | Required | Description |
|---|---|---|---|
credentials | ForeignCredentialCaptureRequest[] | null | no | The foreign credential references the person is arriving with (at least one). |
destinationJurisdiction | string | null | no | The destination (home) jurisdiction code. |
originJurisdiction | string | null | no | The origin (departure) jurisdiction code. |
OptimalInstanceRequest
Request model for `POST /api/v1/discovery/optimal` — the upstream GeoIP2 lookup outcome used to resolve the optimal instance for a client (FR-03.024b).
| Property | Type | Required | Description |
|---|---|---|---|
confidence | integer (int32) | null | no | Gets or sets the GeoIP country-confidence (0–100). Defaults to 0 when absent. |
countryCode | string | null | no | Gets or sets the ISO 3166-1 alpha-2 client country from the GeoIP2 lookup. Omitted or empty models a GeoIP-unresolvable lookup. |
OrganizationCreatorType
"Unspecified" | "SelfServe" | "Partner" | "EssenceOperator" | "Sponsor" with no declared properties.
OrganizationInstanceDto
| Property | Type | Required | Description |
|---|---|---|---|
configuration | InstanceConfigurationDto | no | — |
createdAt | string (date-time) | no | — |
customDomain | string | null | no | — |
customDomainEnabled | boolean | no | — |
endpointUrl | string | null | no | — |
globalInstanceId | string (uuid) | no | — |
id | string (uuid) | no | — |
isDedicated | boolean | no | — |
isHealthy | boolean | no | — |
lastHealthCheck | string (date-time) | null | no | — |
metadata | InstanceMetadataDto | no | — |
name | string | null | no | — |
organizationId | string (uuid) | no | — |
organizationName | string | null | no | — |
status | InstanceStatus | no | — |
type | InstanceType | no | — |
updatedAt | string (date-time) | no | — |
OrgHostOrganizationResponse
| Property | Type | Required | Description |
|---|---|---|---|
organizationId | string (uuid) | null | no | — |
OrgRealmDiscoveryRequest
| Property | Type | Required | Description |
|---|---|---|---|
host | string | null | no | — |
OrgResidencyEvidencePackageDto
| Property | Type | Required | Description |
|---|---|---|---|
generatedAt | string (date-time) | yes | — |
notices | OrgResidencyRelocationNoticeDto[] | null | yes | — |
status | OrgResidencyStatusDto | yes | — |
OrgResidencyRelocationNoticeDto
| Property | Type | Required | Description |
|---|---|---|---|
destinationRegion | string | null | yes | — |
effectiveAt | string (date-time) | yes | — |
id | string (uuid) | yes | — |
legalBasis | string | null | yes | — |
operationReference | string | null | no | — |
organizationId | string (uuid) | yes | — |
plainLanguageImpact | string | null | yes | — |
raisedAt | string (date-time) | yes | — |
raisedBy | string | null | yes | — |
respondedAt | string (date-time) | null | no | — |
respondedBy | string | null | no | — |
response | string | null | no | — |
responseComment | string | null | no | — |
sourceRegion | string | null | yes | — |
status | string | null | yes | — |
OrgResidencyStatusDto
| Property | Type | Required | Description |
|---|---|---|---|
currentRegion | string | null | yes | — |
effectiveAt | string (date-time) | yes | — |
evidencePackageUrl | string | null | yes | — |
legalBasis | string | null | yes | — |
noticeCount | integer (int32) | yes | — |
organizationId | string (uuid) | yes | — |
pendingRelocation | OrgResidencyRelocationNoticeDto | no | — |
OrgSettings
Represents organization-level settings.
| Property | Type | Required | Description |
|---|---|---|---|
billingEmail | string | null | no | — |
country | string | null | no | — |
createdAt | string (date-time) | no | — |
domain | string | null | no | — |
employeeCount | string | null | no | — |
industry | string | null | no | — |
locale | string | null | no | — |
logoUrl | string | null | no | — |
name | string | null | no | — |
organizationId | string (uuid) | no | — |
primaryContactEmail | string | null | no | — |
primaryContactName | string | null | no | — |
slug | string | null | no | — |
timezone | string | null | no | — |
updatedAt | string (date-time) | no | — |
PasswordPolicySettings
Represents password policy configuration.
| Property | Type | Required | Description |
|---|---|---|---|
maxAgeDays | integer (int32) | no | — |
minLength | integer (int32) | no | — |
preventReuse | integer (int32) | no | — |
requireDigit | boolean | no | — |
requireLowercase | boolean | no | — |
requireSpecialChar | boolean | no | — |
requireUppercase | boolean | no | — |
PerformCutoverRequest
Request body for `POST /api/v1/cross-border/immigration-status/cutover`.
| Property | Type | Required | Description |
|---|---|---|---|
actor | string | null | no | Who is performing the cutover (`holder` | `platform`). |
ProblemDetails
| Property | Type | Required | Description |
|---|---|---|---|
detail | string | null | no | — |
instance | string | null | no | — |
status | integer (int32) | null | no | — |
title | string | null | no | — |
type | string | null | no | — |
ProposeJointVentureRequest
| Property | Type | Required | Description |
|---|---|---|---|
counterpartBillingSharePercent | number (double) | no | — |
counterpartOrganizationId | string (uuid) | no | — |
counterpartOrganizationName | string | null | no | — |
custodyModel | string | null | no | — |
name | string | null | no | — |
proposingBillingSharePercent | number (double) | no | — |
proposingOrganizationName | string | null | no | — |
requireBothParents | boolean | no | — |
ProvisioningStatusDto
| Property | Type | Required | Description |
|---|---|---|---|
completedAt | string (date-time) | null | no | — |
createdAt | string (date-time) | no | — |
currentStep | integer (int32) | no | — |
errorCategory | string | null | no | — |
id | string (uuid) | no | — |
instanceId | string (uuid) | no | — |
instanceUrl | string | null | no | — |
isRetryable | boolean | no | — |
jurisdiction | string | null | no | — |
percentComplete | integer (int32) | no | — |
rollbackSuccessful | boolean | null | no | — |
startedAt | string (date-time) | null | no | — |
status | string | null | no | — |
totalSteps | integer (int32) | no | — |
ProvisionSupervisedInstanceCommand
| Property | Type | Required | Description |
|---|---|---|---|
ageAssuranceLevel | AgeAssuranceLevel | no | — |
ageAssuranceMethod | string | null | no | — |
controlTemplateRef | string | null | no | — |
graduationScheduleRef | string | null | no | — |
guardianId | string (uuid) | no | — |
supervisedInstanceId | string (uuid) | no | — |
supervisionEndsOn | string (date-time) | null | no | — |
PublicInstanceListResponse
| Property | Type | Required | Description |
|---|---|---|---|
instances | PublicInstanceOptionDto[] | null | no | — |
regions | PublicRegionDto[] | null | no | — |
PublicInstanceOptionDto
| Property | Type | Required | Description |
|---|---|---|---|
displayName | string | null | no | — |
id | string | null | no | — |
jurisdiction | string | null | no | — |
PublicRegionDto
| Property | Type | Required | Description |
|---|---|---|---|
code | string | null | no | — |
displayName | string | null | no | — |
instances | PublicRegionInstanceDto[] | null | no | — |
regulatoryFramework | string | null | no | — |
PublicRegionInstanceDto
| Property | Type | Required | Description |
|---|---|---|---|
displayName | string | null | no | — |
instanceId | string (uuid) | no | — |
RaiseRelocationNoticeBody
Request body to raise a pre-cutover residency relocation notice for one organisation.
| Property | Type | Required | Description |
|---|---|---|---|
destinationRegion | string | null | no | Region the organisation's data will reside in after cutover. |
effectiveAt | string (date-time) | no | When the relocation takes effect (UTC); must be in the future. |
legalBasis | string | null | no | Legal basis for holding the data in the destination region. |
operationReference | string | null | no | Originating EPIC 88 residency-migration lifecycle operation, when tracked. |
organizationId | string (uuid) | no | Organisation being re-homed. |
plainLanguageImpact | string | null | no | Plain-language description of what changes for the organisation. |
sourceRegion | string | null | no | Region the organisation's data resides in today. |
RaiseVerificationRequestsRequest
Request body for `POST /api/v1/cross-border/immigration-status/verification-requests`.
| Property | Type | Required | Description |
|---|---|---|---|
claimType | string | null | no | The entitlement claim being asked for. |
dueOn | string (date) | no | Date a response is needed by. |
subjectRefs | string[] | null | no | The organisation's own references for the people being asked. |
ReassignRegistryRequest
Request body for M:Essence.Core.Instance.Api.Controllers.RegistryController.Reassign(Essence.Core.Instance.Api.Controllers.ReassignRegistryRequest,System.Threading.CancellationToken).
| Property | Type | Required | Description |
|---|---|---|---|
region | string | null | no | — |
userId | string (uuid) | no | — |
ReceiveMessageRequest
Request model for receiving a cross-instance message.
| Property | Type | Required | Description |
|---|---|---|---|
maxRetries | integer (int32) | null | no | Gets or sets the maximum number of retry attempts (default: 3). |
messageId | string | null | no | Gets or sets the unique identifier of the message. |
payload | string | null | no | Gets or sets the encrypted message payload (up to 1 MB per NFR-03.022). |
sourceInstanceId | string | null | no | Gets or sets the source instance ID sending the message. |
targetInstanceId | string | null | no | Gets or sets the target instance ID receiving the message. |
ReceiveMessageResponse
Response model for message acceptance confirmation.
| Property | Type | Required | Description |
|---|---|---|---|
correlationId | string | null | no | Gets or sets the correlation ID for distributed tracing. |
messageId | string | null | no | Gets or sets the unique identifier of the received message. |
receivedAt | string (date-time) | no | Gets or sets the timestamp when the message was received. |
status | string | null | no | Gets or sets the current status of the message. |
RecordSovereignInstanceOperatorRequest
| Property | Type | Required | Description |
|---|---|---|---|
operatorLegalJurisdiction | string | null | no | — |
operatorOrganizationId | string (uuid) | no | — |
reason | string | null | no | — |
RegisterDrivingEntitlementRequest
Request body for `POST /api/v1/cross-border/driving-entitlement`. Carries ZK held-entitlement metadata only; the owner is taken from the caller's JWT subject and never from this body.
| Property | Type | Required | Description |
|---|---|---|---|
categories | DrivingCategoryGrantInput[] | null | no | Held categories with optional per-category validity windows. |
holderRef | string | null | no | Opaque holder reference (ZK — never a name or licence number). |
issuingJurisdiction | string | null | no | Issuing jurisdiction (ISO 3166 alpha-2). |
licenceExpiry | string (date) | no | Licence (whole-document) expiry (ISO date). |
restrictionCodes | string[] | null | no | Harmonised (EU Annex I) restriction codes; empty when unrestricted. |
RegisterInstanceCommand
| Property | Type | Required | Description |
|---|---|---|---|
endpointUrl | string | null | no | — |
instanceId | string (uuid) | no | — |
instanceName | string | null | no | — |
instanceType | InstanceType | no | — |
region | string | null | no | — |
RegistrationRequestDto
| Property | Type | Required | Description |
|---|---|---|---|
approvalConditions | string | null | no | — |
approvalTokenConsumed | boolean | no | — |
createdAt | string (date-time) | no | — |
expiresAt | string (date-time) | no | — |
id | string (uuid) | no | — |
isDedicated | boolean | null | no | — |
jurisdictionCode | string | null | no | — |
justification | string | null | no | — |
organizationId | string (uuid) | null | no | — |
organizationName | string | null | no | — |
region | string | null | no | — |
rejectionReason | string | null | no | — |
requestType | string | null | no | — |
requestedByEmail | string | null | no | — |
requestedByUserId | string (uuid) | no | — |
requestingInstanceId | string (uuid) | no | — |
requestingInstanceName | string | null | no | — |
reviewedAt | string (date-time) | null | no | — |
reviewedByUserId | string (uuid) | null | no | — |
slug | string | null | no | — |
status | string | null | no | — |
targetInstanceId | string (uuid) | no | — |
targetInstanceType | string | null | no | — |
RejectRegistrationRequestBody
Request body for rejecting a registration request.
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | Gets or sets the reason for rejection. |
RenunciationTeardownCaseDto
| Property | Type | Required | Description |
|---|---|---|---|
caseId | string (uuid) | no | — |
completedAt | string (date-time) | null | no | — |
jurisdiction | string | null | no | — |
openedAt | string (date-time) | no | — |
readyForReceipt | boolean | no | — |
receiptDigest | string | null | no | — |
status | string | null | no | — |
steps | RenunciationTeardownStepDto[] | null | no | — |
templateId | string | null | no | — |
validityCeilingDays | integer (int32) | no | — |
RenunciationTeardownStepDto
| Property | Type | Required | Description |
|---|---|---|---|
blockedReason | string | null | no | — |
detail | string | null | no | — |
evidenceRef | string | null | no | — |
key | string | null | no | — |
label | string | null | no | — |
obligationCode | string | null | no | — |
occurredAt | string (date-time) | null | no | — |
sequence | integer (int32) | no | — |
status | string | null | no | — |
timelineDays | integer (int32) | no | — |
RenunciationTeardownTemplateDto
| Property | Type | Required | Description |
|---|---|---|---|
jurisdiction | string | null | no | — |
notifyList | string[] | null | no | — |
steps | RenunciationTeardownStepDto[] | null | no | — |
templateId | string | null | no | — |
validityCeilingDays | integer (int32) | no | — |
RequestCrossBorderApprovalBody
Request body to raise a new cross-border approval request (S-03.02 write).
| Property | Type | Required | Description |
|---|---|---|---|
dataClassification | string | null | no | Highest data classification involved. |
purpose | string | null | no | Human-readable purpose / legal context of the requested transfer. |
recipient | string | null | no | Recipient (receiving instance / organisation) of the requested transfer. |
sourceJurisdiction | string | null | no | Source jurisdiction the data originates from. |
targetJurisdiction | string | null | no | Target jurisdiction the transfer would target. |
territories | string[] | null | no | Territories covered; empty = whole target jurisdiction. |
RetryFailedMessagesResponse
Response model for retry failed messages operation.
| Property | Type | Required | Description |
|---|---|---|---|
processedAt | string (date-time) | no | Gets or sets the timestamp when the retry operation was processed. |
successCount | integer (int32) | no | Gets or sets the number of messages successfully retried and delivered. |
RetryProvisioningRequest
Optional body of `POST /api/v1/instances/organization/{id}/retry-provisioning`. An empty body is the original call and behaves exactly as before.
| Property | Type | Required | Description |
|---|---|---|---|
adminDisplayName | string | null | no | The founding administrator's display name, with Essence.Core.Instance.Api.Controllers.RetryProvisioningRequest.AdminEmail. |
adminEmail | string | null | no | The founding administrator's email (#22453). Read from the onboarding provisioner only (Essence.Core.Instance.Api.Authorization.OrgProvisionerRetryableAttribute.Scope); ignored from anyone else. |
force | boolean | no | Platform-operator override (#22452): retry a cleanly rolled-back workflow whatever its failure category. Honoured for a cross-instance platform operator only (403 otherwise) and only with a Essence.Core.Instance.Api.Controllers.RetryProvisioningRequest.Reason; recorded on the workflow. |
reason | string | null | no | Why the override is safe now — e.g. the deploy that fixed the cause. Required with Essence.Core.Instance.Api.Controllers.RetryProvisioningRequest.Force. |
ReturningNationalIntakeDto
| Property | Type | Required | Description |
|---|---|---|---|
credentials | ForeignCredentialRefDto[] | null | no | — |
creditPreview | AssuranceCreditPreviewDto | no | — |
destinationJurisdiction | string | null | no | — |
intakeId | string (uuid) | no | — |
originJurisdiction | string | null | no | — |
residency | InboundResidencyDecisionDto | no | — |
ReturningNationalIntakeFacts
| Property | Type | Required | Description |
|---|---|---|---|
basisIssuerJurisdiction | string | null | no | — |
basisOriginLoA | string | null | no | — |
basisOriginScheme | string | null | no | — |
corridorOriginJurisdiction | string | null | no | — |
intakeId | string (uuid) | no | — |
RevokeCertificateRequest
Request model for revoking a certificate.
| Property | Type | Required | Description |
|---|---|---|---|
reason | CertificateRevocationReason | yes | — |
RevokeCorridorAdequacyBody
Request body for a matrix-maintenance corridor flip-to-inadequate (FR-03.029a).
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | Operator-supplied reason for the matrix change (required). |
sourceJurisdiction | string | null | no | Source jurisdiction of the corridor losing adequacy. |
targetJurisdiction | string | null | no | Target jurisdiction of the corridor losing adequacy. |
RevokeRegistrationRequestBody
Request body for revoking a registration.
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | Gets or sets the reason for revocation. |
RolloutReasonRequest
Body of the halt / abandon actions.
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | Why the operator is acting. |
RolloutRegionOutcomeRequest
Body of `POST …/rollouts/{id}/regions/{region}/outcome`.
| Property | Type | Required | Description |
|---|---|---|---|
detail | string | null | no | What the gate observed; required when unhealthy. |
healthy | boolean | no | Whether the region passed its post-roll health gate. |
RoutingDecision
| Property | Type | Required | Description |
|---|---|---|---|
confidenceScore | number (double) | no | — |
decidedAt | string (date-time) | no | — |
estimatedLatency | string (date-span) | no | — |
intermediateHops | string[] | null | no | — |
isDirect | boolean | no | — |
isHighConfidence | boolean | no | — |
isMultiHop | boolean | no | — |
metadata | map<string, string> | null | no | — |
strategy | RoutingStrategy | no | — |
targetEndpoint | string | null | no | — |
targetInstanceId | string | null | no | — |
totalHops | integer (int32) | no | — |
RoutingHealthDto
| Property | Type | Required | Description |
|---|---|---|---|
checkedAt | string (date-time) | no | — |
routableInstanceCount | integer (int32) | no | — |
routableRegionCount | integer (int32) | no | — |
status | string | null | no | — |
RoutingStrategy
"LowestLatency" | "GeographicProximity" | "LoadBalanced" | "RegionAffinity" | "RoundRobin" | "Weighted" | "HomeInstance" | "MultiHop" | "Custom" with no declared properties.
SecuritySettings
Represents security configuration settings.
| Property | Type | Required | Description |
|---|---|---|---|
auditLogRetentionDays | integer (int32) | no | — |
dataResidencyRegion | string | null | no | — |
ipAllowList | string[] | null | no | — |
ipAllowListEnabled | boolean | no | — |
maxSessionsPerUser | integer (int32) | no | — |
mfaMethods | string[] | null | no | — |
mfaRequired | boolean | no | — |
passwordPolicy | PasswordPolicySettings | no | — |
sessionTimeoutMinutes | integer (int32) | no | — |
ssoEnabled | boolean | no | — |
ssoEntityId | string | null | no | — |
ssoProvider | string | null | no | — |
updatedAt | string (date-time) | no | — |
SelfHostedBootstrapPackage
| Property | Type | Required | Description |
|---|---|---|---|
blockers | string[] | null | no | — |
composeEnvironment | map<string, string> | null | no | — |
deploymentModel | InstanceDeploymentModel | no | — |
prerequisites | string[] | null | no | — |
runbook | string[] | null | no | — |
SendMessageCommand
| Property | Type | Required | Description |
|---|---|---|---|
encryptedBody | string | null | no | — |
encryptedMetadata | string | null | no | — |
encryptedSubject | string | null | no | — |
encryptionKeyId | string | null | no | — |
expirationDays | integer (int32) | no | — |
recipientId | string (uuid) | no | — |
recipientInstanceId | string (uuid) | no | — |
senderId | string (uuid) | no | — |
senderInstanceId | string (uuid) | no | — |
SendMessageRequest
Request model for sending a cross-instance message. Implements Essence.Core.Instance.Api.Filters.ICrossInstanceResidencyAddressed so the server-declared `[EnforceDataResidency]` filter can resolve the send's target jurisdiction.
| Property | Type | Required | Description |
|---|---|---|---|
maxRetries | integer (int32) | null | no | Gets or sets the maximum number of retry attempts (default: 3). |
payload | string | null | no | Gets or sets the encrypted message payload (up to 1 MB per NFR-03.022). |
sourceInstanceId | string | null | no | Gets or sets the source instance ID sending the message. |
targetInstanceId | string | null | no | Gets or sets the target instance ID receiving the message. |
SendMessageResponse
Response model for send message operation.
| Property | Type | Required | Description |
|---|---|---|---|
errorMessage | string | null | no | Gets or sets the error message if delivery failed. |
isFailed | boolean | no | Gets or sets a value indicating whether the message delivery failed permanently. |
isQueued | boolean | no | Gets or sets a value indicating whether the message was queued for later delivery. |
isSuccess | boolean | no | Gets or sets a value indicating whether the message was delivered successfully. |
messageId | string | null | no | Gets or sets the unique identifier of the sent message. |
status | string | null | no | Gets or sets the current delivery status. |
SovereignInstanceDto
| Property | Type | Required | Description |
|---|---|---|---|
allowedTransferJurisdictions | string[] | null | no | — |
complianceStatus | ComplianceStatus | no | — |
configuration | InstanceConfigurationDto | no | — |
countryCode | string | null | no | — |
createdAt | string (date-time) | no | — |
dataResidencyEnforced | boolean | no | — |
edgeCachingEnabled | boolean | no | — |
endpointUrl | string | null | no | — |
globalInstanceId | string (uuid) | no | — |
id | string (uuid) | no | — |
isHealthy | boolean | no | — |
jurisdictionCode | string | null | no | — |
jurisdictionName | string | null | no | — |
lastHealthCheck | string (date-time) | null | no | — |
metadata | InstanceMetadataDto | no | — |
name | string | null | no | — |
regulatoryFramework | string | null | no | — |
requireStandardContractualClauses | boolean | no | — |
status | InstanceStatus | no | — |
type | InstanceType | no | — |
updatedAt | string (date-time) | no | — |
SovereignInstanceOperatingTermsDto
| Property | Type | Required | Description |
|---|---|---|---|
operator | SovereignInstanceOperatorDto | no | — |
recorded | boolean | no | — |
serviceLevel | InstanceServiceLevelDto | no | — |
sovereignInstanceId | string (uuid) | no | — |
SovereignInstanceOperatorDto
| Property | Type | Required | Description |
|---|---|---|---|
changeReason | string | null | no | — |
jurisdictionBasis | string | null | no | — |
legalJurisdiction | string | null | no | — |
organizationId | string (uuid) | no | — |
recordedAt | string (date-time) | no | — |
SovereignRouteResult
Result model for an FR-03.024b sovereign route resolution (the success/route case; a rejection is surfaced as `HTTP 422` ProblemDetails instead).
| Property | Type | Required | Description |
|---|---|---|---|
outcome | string | null | no | The fallback outcome (`RouteToResolved` or `RouteToDefault`). |
reason | string | null | no | Human-readable explanation of the resolution. |
reasonCode | string | null | no | Machine-readable reason code for the resolution. |
sovereignId | string | null | no | The resolved sovereign instance id to route to. |
SponsoredResolutionRequest
| Property | Type | Required | Description |
|---|---|---|---|
fundingBankOrganizationId | string (uuid) | no | — |
mode | string | null | no | — |
supplierIdentityKey | string | null | no | — |
SponsoredResolutionResponse
AC-19-neutral. No organisation id, no provisioned/linked flag — see the controller remarks. If either is ever added here, the sponsored path leaks by default.
| Property | Type | Required | Description |
|---|---|---|---|
displayState | string | null | no | — |
resolutionRef | string | null | no | — |
StartCrossRegionRolloutRequest
Body of `POST …/rollouts`.
| Property | Type | Required | Description |
|---|---|---|---|
fromVersion | string | null | no | Envelope version deployed now, `major.minor`. |
regions | string[] | null | no | Regions to roll, in order. |
toVersion | string | null | no | Target envelope version, `major.minor`. |
StartVaultRehomeDocument
One document in a Essence.Core.Instance.Api.Controllers.StartVaultRehomeRequest.
| Property | Type | Required | Description |
|---|---|---|---|
documentId | string | null | yes | Opaque document identifier. |
label | string | null | yes | User-facing label shown in the per-document progress breakdown. |
StartVaultRehomeRequest
Request body for `POST /api/v1/instances/vault-rehome`. Deliberately has <b>no</b> user id: the job's owner is taken from the caller's subject claim, so the body cannot be used to open a re-home against someone else's documents.
| Property | Type | Required | Description |
|---|---|---|---|
clientCorrelationId | string | null | no | The initiator's opaque correlation handle, echoed on the relay completion event so the initiator can advance its own record off the real completion. Must not carry PII. |
crossesSovereignInstance | boolean | no | Whether the destination vault lives on a different sovereign instance. |
destinationInstanceId | string | null | no | The destination sovereign instance's <b>registered identifier</b> (not its display name) — the key the cross-sovereign relay resolves its trusted sync endpoint from. Required when Essence.Core.Instance.Api.Controllers.StartVaultRehomeRequest.CrossesSovereignInstance is true: without it the job could be started but never executed (debt-2026-08-13-049). |
destinationInstanceName | string | null | no | Destination instance display name; required when Essence.Core.Instance.Api.Controllers.StartVaultRehomeRequest.CrossesSovereignInstance is true. |
destinationVaultName | string | null | yes | Display name of the caller's own destination vault. |
documents | StartVaultRehomeDocument[] | null | no | The documents to move. Must be non-empty with unique ids. |
sourceVaultName | string | null | yes | Display name of the shared vault the documents are leaving. |
SubjectApprovalRequestBody
Request body for a subject-originated cross-border approval request.
| Property | Type | Required | Description |
|---|---|---|---|
dataClassification | string | null | no | Highest data classification involved. |
purpose | string | null | no | The subject's stated reason for the transfer. |
recipient | string | null | no | Recipient (receiving instance / organisation) of the requested transfer. |
sourceJurisdiction | string | null | no | Jurisdiction the subject's data resides in today. |
targetJurisdiction | string | null | no | Jurisdiction the subject is asking to transfer to. |
territories | string[] | null | no | Territories covered; empty = whole target jurisdiction. |
SupervisedInstanceDto
| Property | Type | Required | Description |
|---|---|---|---|
ageAssuranceAttributeId | string (uuid) | no | — |
ageAssuranceLevel | AgeAssuranceLevel | no | — |
ageAssuranceMethod | string | null | no | — |
batchId | string (uuid) | no | — |
controlTemplateRef | string | null | no | — |
graduationScheduleRef | string | null | no | — |
guardianId | string (uuid) | no | — |
majorityApproaching | boolean | no | — |
provisionedAt | string (date-time) | no | — |
recordId | string (uuid) | no | — |
status | SupervisionStatus | no | — |
supervisedInstanceId | string (uuid) | no | — |
supervisionEndsOn | string (date-time) | null | no | — |
SupervisedInstanceRosterEntry
| Property | Type | Required | Description |
|---|---|---|---|
ageAssuranceLevel | AgeAssuranceLevel | no | — |
ageAssuranceMethod | string | null | no | — |
supervisedInstanceId | string (uuid) | no | — |
supervisionEndsOn | string (date-time) | null | no | — |
SupervisionStatus
"Supervised" | "MajorityApproaching" | "Transitioning" | "Graduated" with no declared properties.
SupplierIdentityKeyResponse
The organisation's supplier identity, or absence. Carries the identity and nothing else: adding lifecycle state or a sponsor here would turn a token-mint lookup into the sponsorship-probing surface M:Essence.Core.Instance.Api.Controllers.SponsoredResolutionsController.Resolve(Essence.Core.Instance.Api.Controllers.SponsoredResolutionRequest,System.Threading.CancellationToken) is careful not to be.
| Property | Type | Required | Description |
|---|---|---|---|
supplierIdentityKey | string | null | no | — |
SuspendDeveloperIdRequest
Request payload for suspending a developer ID.
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | — |
SuspendInstanceRequest
Request model for suspending an instance.
| Property | Type | Required | Description |
|---|---|---|---|
reason | string | null | no | Gets or sets the reason for suspension. |
TerminateInstanceRequest
Request model for terminating an instance.
| Property | Type | Required | Description |
|---|---|---|---|
drain | boolean | null | no | Gets or sets whether live organisation instances beneath this one are decommissioned with it. Omitted or `false`: a parent with live children is refused with 409 (FR-03.007a). |
reason | string | null | no | Gets or sets why this instance is being decommissioned. |
TraefikDynamicConfiguration
| Property | Type | Required | Description |
|---|---|---|---|
http | TraefikHttpConfiguration | no | — |
TraefikHttpConfiguration
| Property | Type | Required | Description |
|---|---|---|---|
routers | map<string, TraefikRouter> | null | no | — |
TraefikRouter
| Property | Type | Required | Description |
|---|---|---|---|
entryPoints | string[] | null | no | — |
middlewares | string[] | null | no | — |
rule | string | null | no | — |
service | string | null | no | — |
tls | TraefikRouterTls | no | — |
TraefikRouterTls
| Property | Type | Required | Description |
|---|---|---|---|
certResolver | string | null | no | — |
UpdateConfigurationCommand
| Property | Type | Required | Description |
|---|---|---|---|
autoScalingEnabled | boolean | no | — |
backupEnabled | boolean | no | — |
backupRetentionDays | integer (int32) | no | — |
highAvailabilityEnabled | boolean | no | — |
instanceId | string (uuid) | no | — |
maxApiRequestsPerHour | integer (int32) | no | — |
maxConnections | integer (int32) | no | — |
maxStorageGb | integer (int64) | no | — |
monitoringEnabled | boolean | no | — |
UpdateDnsRecordCommand
| Property | Type | Required | Description |
|---|---|---|---|
newValue | string | null | no | — |
recordId | string (uuid) | no | — |
zoneId | string (uuid) | no | — |
UpdateDocumentCommand
| Property | Type | Required | Description |
|---|---|---|---|
documentId | string (uuid) | no | — |
encryptedMetadata | string | null | no | — |
name | string | null | no | — |
ownerId | string (uuid) | no | — |
UpdateHealthCheckCommand
| Property | Type | Required | Description |
|---|---|---|---|
instanceId | string (uuid) | no | — |
isHealthy | boolean | no | — |
statusMessage | string | null | no | — |
UpdateInstanceEndpointCommand
| Property | Type | Required | Description |
|---|---|---|---|
instanceId | string (uuid) | no | — |
newEndpointUrl | string | null | no | — |
UpdateInstanceHealthCommand
| Property | Type | Required | Description |
|---|---|---|---|
healthCheckStatus | string | null | no | — |
instanceId | string (uuid) | no | — |
isHealthy | boolean | no | — |
timestamp | string (date-time) | no | — |
UpdateMetadataCommand
| Property | Type | Required | Description |
|---|---|---|---|
availabilityZone | string | null | no | — |
complianceCertifications | string | null | no | — |
dataCenter | string | null | no | — |
instanceId | string (uuid) | no | — |
jurisdiction | string | null | no | — |
region | string | null | no | — |
tags | string | null | no | — |
version | string | null | no | — |
UpdateModuleRequest
Request model for updating a module's enabled state.
| Property | Type | Required | Description |
|---|---|---|---|
enabled | boolean | no | — |
UpdatePricingPlanRequest
| Property | Type | Required | Description |
|---|---|---|---|
basePrice | number (double) | null | no | — |
currency | string | null | no | — |
description | string | null | no | — |
features | map<string, unspecified> | null | no | — |
metadata | map<string, string> | null | no | — |
name | string | null | no | — |
trialDays | integer (int32) | null | no | — |
UpdateSovereignInstanceRegionCommand
| Property | Type | Required | Description |
|---|---|---|---|
allowedStorageRegions | string | null | no | — |
allowedTransferJurisdictions | string | null | no | — |
edgeCachingEnabled | boolean | no | — |
instanceId | string (uuid) | no | — |
primaryRegion | string | null | no | — |
requireStandardContractualClauses | boolean | no | — |
UpdateVaultCommand
| Property | Type | Required | Description |
|---|---|---|---|
description | string | null | no | — |
name | string | null | no | — |
ownerId | string (uuid) | no | — |
vaultId | string (uuid) | no | — |
UpdateVaultLimitsCommand
| Property | Type | Required | Description |
|---|---|---|---|
maxDocuments | integer (int32) | null | no | — |
maxSizeBytes | integer (int64) | null | no | — |
ownerId | string (uuid) | no | — |
vaultId | string (uuid) | no | — |
UpdateVerificationPolicyRequest
Request body for `PUT /api/v1/cross-border/immigration-status/org-policy`.
| Property | Type | Required | Description |
|---|---|---|---|
acceptedClaimTypes | string[] | null | no | Accepted entitlement claims; empty or absent for all. |
acceptedJurisdictions | string[] | null | no | Accepted issuing jurisdictions; empty or absent for all. |
maxStalenessDays | integer (int32) | no | How long a recorded result may be relied on, in days (1–365). |
requireCanonicalEVisa | boolean | no | When true, a result resolved against a physical BRP is refused. |
UploadDocumentCommand
| Property | Type | Required | Description |
|---|---|---|---|
checksum | string | null | no | — |
contentType | string | null | no | — |
encryptedMetadata | string | null | no | — |
encryptionKeyId | string | null | no | — |
name | string | null | no | — |
ownerId | string (uuid) | no | — |
sizeBytes | integer (int64) | no | — |
storageReference | string | null | no | — |
vaultId | string (uuid) | no | — |
UserMessage
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | — |
createdBy | string | null | no | — |
deletedAt | string (date-time) | null | no | — |
deletedBy | string | null | no | — |
deliveryConfirmed | boolean | no | — |
deliveryConfirmedAt | string (date-time) | null | no | — |
domainEvents | DomainEvent[] | null | no | — |
encryptedBody | string | null | no | — |
encryptedMetadata | string | null | no | — |
encryptedSubject | string | null | no | — |
encryptionKeyId | string | null | no | — |
expiresAt | string (date-time) | null | no | — |
hasDomainEvents | boolean | no | — |
id | string (uuid) | no | — |
isDeleted | boolean | no | — |
isRead | boolean | no | — |
readAt | string (date-time) | null | no | — |
recipient | InstanceMember | no | — |
recipientId | string (uuid) | no | — |
recipientInstanceId | string (uuid) | no | — |
rowVersion | string (byte) | null | no | — |
sender | InstanceMember | no | — |
senderId | string (uuid) | no | — |
senderInstanceId | string (uuid) | no | — |
sentAt | string (date-time) | no | — |
updatedAt | string (date-time) | null | no | — |
updatedBy | string | null | no | — |
UserSummaryResponse
Safe, outward-facing projection of an Essence.Core.Instance.Domain.Entities.InstanceMember for user discovery (profile lookup and search). Deliberately excludes the credential secret (`PasswordHash`) and login-tracking fields (`LastLoginAt`, `PasswordChangedAt`, `FailedLoginAttempts`, `LockoutEndAt`) so those can never cross an API boundary (debt-2026-06-28-527). Mirrors the safe shape already used by the `ListUsers` endpoint.
| Property | Type | Required | Description |
|---|---|---|---|
createdAt | string (date-time) | no | When the account was created. |
email | string | null | no | The member's email address. |
emailVerified | boolean | no | Whether the member's email is verified. |
firstName | string | null | no | The member's first name, if set. |
fullName | string | null | no | The member's display name (first + last, trimmed). |
id | string (uuid) | no | The member's unique identifier. |
isActive | boolean | no | Whether the account is active. |
lastName | string | null | no | The member's last name, if set. |
roles | string[] | null | no | The roles assigned to the member. |
ValidationProblemDetails
| Property | Type | Required | Description |
|---|---|---|---|
detail | string | null | no | — |
errors | map<string, string[]> | null | no | — |
instance | string | null | no | — |
status | integer (int32) | null | no | — |
title | string | null | no | — |
type | string | null | no | — |
ValidatorRegistrationRetryResult
| Property | Type | Required | Description |
|---|---|---|---|
alreadyRegistered | boolean | no | — |
centralValidatorId | string (uuid) | null | no | — |
errorCode | string | null | no | — |
errorMessage | string | null | no | — |
registrationTxHash | string | null | no | — |
skipped | boolean | no | — |
success | boolean | no | — |
VaultDocumentRef
| Property | Type | Required | Description |
|---|---|---|---|
checksum | string | null | no | — |
contentType | string | null | no | — |
createdAt | string (date-time) | no | — |
createdBy | string | null | no | — |
deletedAt | string (date-time) | null | no | — |
deletedBy | string | null | no | — |
encryptedMetadata | string | null | no | — |
encryptionKeyId | string | null | no | — |
id | string (uuid) | no | — |
isDeleted | boolean | no | — |
lastAccessedAt | string (date-time) | null | no | — |
name | string | null | no | — |
rowVersion | string (byte) | null | no | — |
sizeBytes | integer (int64) | no | — |
storageReference | string | null | no | — |
updatedAt | string (date-time) | null | no | — |
updatedBy | string | null | no | — |
vaultId | string (uuid) | no | — |
VaultDocumentRefCursorResult
| Property | Type | Required | Description |
|---|---|---|---|
hasMore | boolean | no | — |
items | VaultDocumentRef[] | null | no | — |
nextCursor | string | null | no | — |
pageSize | integer (int32) | no | — |
previousCursor | string | null | no | — |
VaultProvisioningRecord
| Property | Type | Required | Description |
|---|---|---|---|
archivedAt | string (date-time) | null | no | — |
createdAt | string (date-time) | no | — |
createdBy | string | null | no | — |
deletedAt | string (date-time) | null | no | — |
deletedBy | string | null | no | — |
description | string | null | no | — |
documentCount | integer (int32) | no | — |
domainEvents | DomainEvent[] | null | no | — |
hasDomainEvents | boolean | no | — |
id | string (uuid) | no | — |
instanceId | string (uuid) | no | — |
isActive | boolean | no | — |
isDeleted | boolean | no | — |
lastAccessedAt | string (date-time) | null | no | — |
maxDocuments | integer (int32) | no | — |
maxSizeBytes | integer (int64) | no | — |
metadata | string | null | no | — |
name | string | null | no | — |
ownerId | string (uuid) | no | — |
rowVersion | string (byte) | null | no | — |
totalSizeBytes | integer (int64) | no | — |
updatedAt | string (date-time) | null | no | — |
updatedBy | string | null | no | — |
VaultProvisioningRecordCursorResult
| Property | Type | Required | Description |
|---|---|---|---|
hasMore | boolean | no | — |
items | VaultProvisioningRecord[] | null | no | — |
nextCursor | string | null | no | — |
pageSize | integer (int32) | no | — |
previousCursor | string | null | no | — |
VaultRehomeDocumentDto
| Property | Type | Required | Description |
|---|---|---|---|
documentId | string | null | no | — |
errorCategory | string | null | no | — |
label | string | null | no | — |
state | string | null | no | — |
VaultRehomeStatusDto
| Property | Type | Required | Description |
|---|---|---|---|
clientCorrelationId | string | null | no | — |
completedAt | string (date-time) | null | no | — |
completionEmail | string | null | no | — |
completionResultHash | string | null | no | — |
createdAt | string (date-time) | no | — |
crossesSovereignInstance | boolean | no | — |
destinationInstanceName | string | null | no | — |
destinationVaultName | string | null | no | — |
documents | VaultRehomeDocumentDto[] | null | no | — |
documentsMoved | integer (int32) | no | — |
documentsTotal | integer (int32) | no | — |
errorCategory | string | null | no | — |
percentComplete | integer (int32) | no | — |
rehomeId | string (uuid) | no | — |
sourceVaultName | string | null | no | — |
startedAt | string (date-time) | null | no | — |
state | string | null | no | — |