API Reference
REST API
The API gateway is the single entrypoint for all client requests. Every route except /health and unauthenticated auth endpoints requires a valid JWT Bearer token.
Base URL
Set via NEXT_PUBLIC_API_URL in the web app. Default local development:
https://altiusapi-gateway-production.up.railway.app
Include Authorization: Bearer <token> and Content-Type: application/json on authenticated requests.
OpenAPI specs
Swagger UI and OpenAPI JSON are available in non-production gateway environments. Production disables interactive docs for security.
Gateway
Interactive Swagger UI and machine-readable OpenAPI 3 spec.
Schema Engine
FastAPI auto-generated spec (direct service access in dev).
http://localhost:4001/openapi.jsonDomains
- Authentication
Login, refresh, OAuth2 SSO, agent tokens, and session management.
/auth - Governance
Pipelines, projects, audit log, RBAC, lineage, entitlements, and usage.
/governance - Schema
Registry, validation, compatibility, and drift.
/schema - Ontology
Object types, link types, entities, graph queries, and governed actions.
/ontology - Pipeline execution
Execute, validate DAG, schedules, streams, and node types.
/pipeline - Sandboxes
Isolated workspaces with propose, review, merge, and revert.
/sandboxes - Connectors
Saved connections and connector-framework type catalog.
/connectors - Tenants
Workspace provisioning and tenant metadata.
/tenants
Roles
JWT payloads carry a role claim. The gateway enforces minimum roles per route:
- viewer — read pipelines, schemas, sandboxes, ontology
- reviewer — approve or reject sandbox proposals
- engineer — create, edit, execute, merge
- admin — RBAC, drift resolution, agent registry, entitlements