API Reference

Status: Fixture Preview. This reference tracks contracts/gestalt-cloud-membrane.v0.json version 0.0.1-fixture. See Capability State before using any operation as an integration boundary.

Gestalt’s membrane operations use a common response shape:

type MembraneResponse<T> = {
  operation: string;
  outcome: "admitted" | "refused" | "pending" | "projected" | "verified" | "queued" | "executed" | "failed";
  body: T;
  receipt?: {
    ref: string;
    outcome: string;
    reasons: string[];
    fixture?: boolean;
  };
};

Every response should be read with its capability-state label. Fixture receipts are useful for prototyping and refusal-code discipline; they are not production proof.

Observability

Operation	Method	Path	State
runtime.health	GET	/health	staging-durable
runtime.ready	GET	/ready	staging-durable
runtime.version	GET	/version	staging-durable
runtime.metrics	GET	/metrics	staging-durable
membrane.contract	GET	/v1/membrane/contract	shape-only

Tenant And Session

Operation	Method	Path	State
tenant.self	GET	/v1/tenant/self	shape-only
tenant.create	POST	/v1/tenants/create	staging-durable
company.bootstrap	POST	/v1/companies/bootstrap	staging-durable

Auth And Sessions

Operation	Method	Path	State
auth.loginStart	POST	/v1/auth/login/start	staging-durable
auth.loginFinish	POST	/v1/auth/login/finish	staging-durable
auth.sessionExchange	POST	/v1/auth/session/exchange	fixture-rehearsed
auth.sessionIssue	POST	/v1/auth/sessions/issue	staging-durable
auth.sessionInspect	POST	/v1/auth/sessions/inspect	staging-durable
auth.sessionRefresh	POST	/v1/auth/sessions/refresh	staging-durable
auth.rateLimitEvaluate	POST	/v1/auth/rate-limit/evaluate	staging-durable
auth.recoveryPolicy	POST	/v1/auth/recovery/policy	staging-durable
auth.recoveryExecute	POST	/v1/auth/recovery/execute	staging-durable
humanAuth.passkeyRegistrationOptions	POST	/v1/human-auth/passkey/registration/options	staging-durable
humanAuth.passkeyAssertionOptions	POST	/v1/human-auth/passkey/assertion/options	staging-durable
humanAuth.registerPasskey	POST	/v1/human-auth/passkey/register	staging-durable
humanAuth.passkeyImport	POST	/v1/human-auth/passkey/import	staging-durable

Production Gate And Key Custody

Operation	Method	Path	State
keyCustody.readiness	GET	/v1/key-custody/readiness	staging-durable
keyCustody.attest	POST	/v1/key-custody/attest	staging-durable
keyCustody.providerAttest	POST	/v1/key-custody/provider/attest	staging-durable
keyCustody.rotationRehearse	POST	/v1/key-custody/rotate	staging-durable
keyCustody.revoke	POST	/v1/key-custody/revoke	staging-durable
keyCustody.breakGlass	POST	/v1/key-custody/break-glass	staging-durable
keyCustody.signingRehearse	POST	/v1/key-custody/signing/rehearse	staging-durable
production.admissionPolicy	POST	/v1/production/admission/policy	staging-durable
production.admissionPrecheck	POST	/v1/production/admission/precheck	staging-durable
production.scopeInspect	GET	/v1/production/scope	staging-durable
production.scopeEvaluate	POST	/v1/production/scope/evaluate	staging-durable
tenant.productionLifecycleAdvance	POST	/v1/tenants/production-lifecycle/advance	staging-durable
company.productionLifecycleAdvance	POST	/v1/companies/production-lifecycle/advance	staging-durable
staging.maturityReport	POST	/v1/staging/maturity-report	staging-durable
tenant.onboardingGate	POST	/v1/tenants/onboarding-gate	staging-durable

These endpoints record the missing production gate explicitly. They can cite staging key-custody readiness, fixture attestations, provider attestations, public verification material, rotation rehearsals, key revocations, break-glass receipts, signing rehearsal refusals, production precheck refusals, minimized tenant onboarding records, minimized company bootstrap records, and tenant onboarding gates, but they do not provision production keys, call an external signer, accept private key material, ingest raw customer or register payloads, or set production_admission to true.

Koerper Ingress

Operation	Method	Path	State
standing.claim	POST	/v1/standing/claim	staging-durable
standing.evaluate	POST	/v1/standing/evaluate	staging-durable
standing.grant	POST	/v1/standing/grant	staging-durable
standing.revoke	POST	/v1/standing/revoke	staging-durable
mandate.delegate	POST	/v1/mandates/delegate	staging-durable
mandate.revoke	POST	/v1/mandates/revoke	staging-durable
advisor.openMatter	POST	/v1/advisor/matters/open	staging-durable
advisor.issueOpinion	POST	/v1/advisor/opinions/issue	staging-durable
advisor.requestEvidence	POST	/v1/advisor/evidence/request	staging-durable
lens.scope	POST	/v1/lens/scope	staging-durable
lens.disclose	POST	/v1/lens/disclose	staging-durable
intervention.request	POST	/v1/interventions/request	staging-durable
intervention.issue	POST	/v1/interventions/issue	staging-durable

These are fixture ingress records for generated Koerpers and advisor/lens surfaces. They do not provision production key custody, admit real customer data, create standing from HumanAuth alone, grant advisor admin authority, or expose raw DB, connector payloads, or biometric material.

Intents And Shop

Operation	Method	Path	State
intent.precheck	POST	/v1/intents/precheck	fixture-rehearsed
intent.commit	POST	/v1/intents/commit	fixture-rehearsed
shop.prepare	POST	/v1/shop/prepare	fixture-rehearsed
shop.commit	POST	/v1/shop/commit	fixture-rehearsed
vertical.de.invoicePaymentAdvisor	POST	/v1/verticals/de/invoice-payment-advisor	fixture-rehearsed

Authority And Capability

Operation	Method	Path	State
authority.resolveContext	POST	/v1/authority/resolve-context	fixture-rehearsed
capability.publish	POST	/v1/capabilities/publish	fixture-rehearsed
capability.policy.evaluate	POST	/v1/capabilities/policy/evaluate	staging-durable
authority.hostedOperator.grant	POST	/v1/authority/operators/grant	staging-durable
authority.hostedOperator.revoke	POST	/v1/authority/operators/revoke	staging-durable
authority.package.status	GET	/v1/authority/packages/status	staging-durable
authority.package.import	POST	/v1/authority/packages/import	staging-durable
authority.package.publisher.onboard	POST	/v1/authority/packages/publishers/onboard	staging-durable
authority.package.reviewer.onboard	POST	/v1/authority/packages/reviewers/onboard	staging-durable
authority.package.candidate	POST	/v1/authority/packages/candidate	fixture-rehearsed
authority.package.review	POST	/v1/authority/packages/review	staging-durable
authority.package.activate	POST	/v1/authority/packages/activate	staging-durable
authority.package.revoke	POST	/v1/authority/packages/revoke	staging-durable
capability.importResolve	POST	/v1/capability/import/resolve	shape-only
authority.epochDefine	POST	/v1/authority/epochs/define	shape-only
authority.epochTransition	POST	/v1/authority/epochs/transition	shape-only
pendulum.publish	POST	/v1/pendulum/publish	shape-only
pendulum.publishSource	POST	/v1/pendulum/publish-source	shape-only
verlag.publishInstrument	POST	/v1/verlag/instruments/publish	shape-only
pilot.admissionGate	POST	/v1/pilot/admission-gate	staging-durable-refusal

Ops And Incidents

Operation	Method	Path	State
ops.edgePolicyCheck	POST	/v1/ops/edge-policy/check	staging-durable
ops.restoreRehearse	POST	/v1/ops/restore/rehearse	staging-durable
ops.incidentReceipt	POST	/v1/ops/incident/receipt	staging-durable
ops.status	GET	/v1/ops/status	staging-durable

capability.publish is the first exposed publication-shaped capability surface. It stores a fixture capability manifest and makes it available to capability.policy.evaluate inside the current fixture runtime. The manifest can be written as M7 evidence when remote storage is configured, but published capabilities are not rehydrated as active evaluator input after restart yet. M27 adds separate staging-durable Verlag publisher and reviewer trust records for authority packages; those are still fixture trust roots and do not enable production admission.

Human Auth And Lifecycle

Operation	Method	Path	State
humanAuth.challenge	POST	/v1/human-auth/challenge	staging-durable
humanAuth.passkeyImport	POST	/v1/human-auth/passkey/import	staging-durable
humanAuth.verifyPasskey	POST	/v1/human-auth/passkey/verify	staging-durable
humanAuth.passkeyRevoke	POST	/v1/human-auth/passkey/revoke	staging-durable
humanAuth.passkeyRotate	POST	/v1/human-auth/passkey/rotate	staging-durable
humanAuth.faceMatchFallback	POST	/v1/human-auth/face-match	shape-only
authority.presenceApproval	POST	/v1/authority/presence-approval	fixture-rehearsed
authority.sessionRevoke	POST	/v1/authority/sessions/revoke	staging-durable
authority.keyRotate	POST	/v1/authority/keys/rotate	staging-durable

Effects And Economy

Operation	Method	Path	State
effect.intent	POST	/v1/effects/intent	staging-durable
effect.dispatch	POST	/v1/effects/dispatch	fixture-rehearsed
economy.invoice	POST	/v1/economy/invoice	staging-durable
economy.paymentObservation	POST	/v1/economy/payment-observation	staging-durable
economy.bookkeepingFact	POST	/v1/economy/bookkeeping-fact	staging-durable
economy.periodClose	POST	/v1/economy/period-close	fixture-rehearsed

Evidence, Proof, And Receipts

Operation	Method	Path	State
evidence.witness.fixture	POST	/v1/evidence/witness-fixture	fixture-rehearsed
evidence.connector.consent	POST	/v1/evidence/connectors/consent	staging-durable
evidence.connector.ingest	POST	/v1/evidence/connectors/ingest	staging-durable
evidence.connector.revoke	POST	/v1/evidence/connectors/revoke	staging-durable
evidence.connector.status	GET	/v1/evidence/connectors/status	staging-durable
receipt.verify	POST	/v1/receipts/verify	shape-only
proof.request	POST	/v1/proofs/request	shape-only
proof.bundle	POST	/v1/proofs/bundle	staging-durable
proof.verify	POST	/v1/proofs/verify	staging-durable, local-verifier-compatible
commit.recent	GET	/v1/commits/recent	staging-durable
refusal.codes	GET	/v1/refusals/codes	shape-only
refusal.registry	GET	/v1/refusals/registry	shape-only
m7.state	GET	/v1/m7/state	staging-durable

Read Models

Operation	Method	Path	State
read.standing.active	GET	/v1/read/standing/active	staging-durable
read.mandates.active	GET	/v1/read/mandates/active	staging-durable
read.economy.periodCloseReadiness	GET	/v1/read/economy/period-close-readiness	staging-durable
read.connectors.evidenceGaps	GET	/v1/read/connectors/evidence-gaps	staging-durable
read.proofs.history	GET	/v1/read/proofs/history	staging-durable
read.advisor.matters	GET	/v1/read/advisor/matters	staging-durable
workcell.publish	POST	/v1/workcells/publish	staging-durable
workcell.precheck	POST	/v1/workcells/precheck	staging-durable
workcell.revoke	POST	/v1/workcells/revoke	staging-durable

Read models project durable membrane evidence into Koerper-safe summaries. They never expose raw database rows, raw connector payloads, raw biometric material, or cross-tenant graphs. A Koerper builds list/detail/dashboard views from these endpoints rather than holding canonical state locally.

Realities And Zeitgestalt

Operation	Method	Path	State
reality.fork	POST	/v1/reality/fork	staging-durable
reality.commit	POST	/v1/reality/commit	fixture-rehearsed
reality.diff	POST	/v1/reality/diff	staging-durable
reality.promote	POST	/v1/reality/promote	fixture-rehearsed
reality.discard	POST	/v1/reality/discard	fixture-rehearsed
closure.surface	POST	/v1/closure/surface	staging-durable
tension.query	POST	/v1/tensions/query	fixture-rehearsed
zeitgestalt.query	POST	/v1/zeitgestalt/query	staging-durable

Detail pages

Each family below has a deeper page covering request/response shapes, SDK examples, and refusal codes.

• Intents and commits — intent.precheck, intent.commit
• Shop (hosted operator delegate) — shop.prepare, shop.commit
• Vertical: DE invoice / payment / advisor — vertical.de.invoicePaymentAdvisor
• Capabilities — capability.publish, capability.policy.evaluate
• Authority — authority.resolveContext, hosted operators, packages, presence approval, sessions, keys
• Package onboarding — authority.package.publisher.onboard, authority.package.reviewer.onboard
• Auth and sessions — auth.loginStart/loginFinish, auth.sessionExchange, auth.sessionIssue/sessionInspect/sessionRefresh, authority.sessionRevoke, auth.rateLimitEvaluate, auth.recoveryPolicy/recoveryExecute, passkey registration/assertion options, register, and import
• Admission and key custody — keyCustody.readiness/attest/revoke/providerAttest/rotationRehearse/signingRehearse/breakGlass, production.admissionPolicy/admissionPrecheck, production.scopeInspect/scopeEvaluate, tenant.productionLifecycleAdvance, company.productionLifecycleAdvance, staging.maturityReport, tenant.onboardingGate, pilot.admissionGate
• Operations posture — ops.edgePolicyCheck, ops.restoreRehearse, ops.incidentReceipt, ops.status
• Standing and mandates — standing.claim/evaluate/grant/revoke, mandate.delegate/revoke
• Advisor — advisor.openMatter, advisor.issueOpinion, advisor.requestEvidence
• Lens and intervention — lens.scope/disclose, intervention.request/issue
• Connectors — evidence.connector.consent/ingest/revoke/status
• Production gate — keyCustody.readiness, keyCustody.attest, production.admissionPrecheck, tenant.onboardingGate
• Reality — reality.fork/commit/diff/promote/discard
• Effects — effect.intent, effect.dispatch
• Economy — economy.invoice/payment_observation/bookkeeping_fact/period_close
• Evidence — evidence.witness.fixture, evidence.connector.consent/ingest/revoke/status
• Proofs and receipts — proof.request, proof.bundle, proof.verify, receipt.verify
• Human auth — humanAuth.challenge/passkeyImport/verifyPasskey/passkeyRevoke/passkeyRotate/faceMatchFallback
• Read models — read.standing.active, read.mandates.active, read.economy.periodCloseReadiness, read.connectors.evidenceGaps, read.proofs.history
• Zeitgestalt and tensions — zeitgestalt.query, tension.query, closure.surface
• Observability and misc — tenant.self, tenant.create, company.bootstrap, commit.recent, m7.state, refusal.codes, runtime.*

Default posture

The contract publishes a default posture that informs every refusal:

{
  "missing_standing": "refuse",
  "missing_authority_package": "pend",
  "stale_authority_package": "refuse",
  "low_confidence_extraction": "pend",
  "cross_tenant_access": "refuse",
  "projection_promotion_without_evidence": "refuse"
}

See reference/default-posture.md.

Open SDK boundary

typed request envelopes
typed response envelopes
local receipt verification
fixture simulation
proof disclosure request construction

Closed runtime boundary

production admission
tenant key custody
authority package activation
pendulum evaluator dispatch
proof issuance
operator audit policy

Forbidden surface

raw database access
private signing keys
cross-tenant graph traversal
production package mutation
unscoped proof bundle disclosure

Where to read next

• SDK: TypeScript
• SDK: Rust
• Concepts: the membrane
• Reference: capability state
• Reference: outcomes
• Reference: refusal codes