BUILD · THE GENERATED CONTRACT
Generated from the route table. It cannot drift from the server.
Most API documentation is a second document, written by a person, that quietly stops matching the server it describes. This one is generated from the live route table on every request — there is no separate file to forget to update, because there is no separate file. Fetch it and you are reading the same table the server itself dispatches on.
This page is about the shape of the API, not what each auth plane is allowed to do. That is a different page, linked below.
Fetch it yourself
An OpenAPI 3.0.3 document, at a well-known path, no key required to read it.
curl -s https://id.orbis.id/openapi.jsonEvery route names the plane it sits behind
Every operation object in the document carries its own x-auth field — the
plane it is dispatched under, not a guess a reader has to make from the path. Grouping
and counting them is one line of jq, and the result is a census of the API's
shape rather than a hand-maintained table that goes stale the week after somebody writes it.
curl -s https://id.orbis.id/openapi.json | jq '[.paths[][]["x-auth"]] | group_by(.) | map({(.[0]): length}) | add'| Plane | Routes |
|---|---|
| PUB | 251 |
| BO_ENTRA | 194 |
| OP | 52 |
| PSESS | 35 |
| ENTRA_WALLET | 16 |
| HJWT | 12 |
| ENTRA | 10 |
| HSESS | 5 |
| WIRE | 4 |
| BO | 2 |
| OWNER | 1 |
| Total | 582 |
251 of 582 routes require no authentication at all — the PUB plane. The rest sit behind an operator bearer token, a partner session, a holder JWT, or Entra, depending on the row.
Seven routes also answer at /v1 — the same handler, twice
A second address is not a second implementation. platform/src/routes/public-api-v1.ts
is a path rewrite applied before dispatch — a request to /v1/… is mapped onto the
exact unversioned path that already serves it, in platform/src/server/http.ts, and the
server routes the rewritten path exactly as it always did. Same handler, same auth, same body,
same response. Nothing below is retired; the unversioned addresses keep answering forever.
| Method | /v1 address | also served at |
|---|---|---|
| POST | /v1/tenants | /api/tenants |
| POST | /v1/types | /api/types |
| POST | /v1/offers | /api/offers |
| POST | /v1/tenants/{slug}/bills | /api/tenants/{slug}/bills |
| GET | /v1/member/me | /member/me |
| POST | /v1/wallet/{accountId}/items/{id}/accept | /api/wallet/{accountId}/items/{id}/accept |
| POST | /v1/wallet/{accountId}/items/{id}/sharing | /api/wallet/{accountId}/items/{id}/sharing |
Seven operations, chosen once and cited rather than re-decided: the module's own header names
them as ported, port-as-is, from the shipped platform's V1_PROMISED list. No path
above is a link — none of them is a full URL this build's own external probe has checked, so
each is named in code rather than rendered as something to click.
What the document does not cover
Shape is not the same thing as meaning. The document tells you a route exists, what method it answers to, and which plane gates it — it does not tell you what a standard like the Token Status List actually demands, or what we hold and do not hold against it. That comparison is meant to live one row at a time on a standards page, deliberately kept separate from a document a machine regenerates automatically — read it here.
It also does not tell you which fields are safe to log, retain, or hand to a third party. That is a data-handling question, not a shape question, and it belongs on a security page, linked here, not this one.
What is real here.
The document itself is generated and live. What it is generated FROM — the route table — is the platform's own, and this page cannot show you its source; it can only show you what the source answers when you ask it.
The register holds 17 live · 2 partial · 2 planned · 5 not yet.
4 of the 4 capabilities this page depends on have no row in the register yet, so this page will not print a state for them. They are named rather than dropped, because a slice that silently shortens itself is the same defect as a claim with no receipt.
- generated-contract
- vc-issuance
- oauth-metadata
- v1-alias
The register route serves, but it carries no row for these yet. List what it does carry:
curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'Straight answers
- Can the document and the server ever disagree?
- Not for long — the document is produced from the same table the server dispatches on, on every request, rather than maintained by hand.
- Does the document tell me what each plane is allowed to do?
- No. It names the plane; a standards page and a security page — not this one — are where that meaning belongs.
- Do I need a key to fetch the document itself?
- No — the document is on the permissionless plane, like the command above shows.
- Does
/v1replace the unversioned paths? - No. It is additive — the same seven operations answer at both addresses, forever, with nothing retired.
Do not trust us. Check us.