DEVELOPER CONTRACT

One Cybersive API.

The workspace uses one same-origin API. This page lists the routes the site calls and marks plainly which answer today.

01TRANSPORT

How the workspace calls the API

The server enforces every rule below. The browser cannot set an approval receipt.

Same-origin requests under /v1 with an HttpOnly session cookie. The site never reads the cookie.
Every mutation made while signed in carries an X-CSRF-Token header. Sign-in requests are sent before a session exists and rely on the engine's own protections.
Creating an engagement, each gate action, start, stop and issuing a token carry an Idempotency-Key. A retry of the same action reuses its key, so the engine can recognise the repeat.
The server checks account ownership and role on every call.

02ROUTES

Every route the site calls.

Routes marked live answer today. Every other route is one the site calls; it is not available yet.

The engine's published contract and its client disagree on several routes and shapes. The engine is settling which is current.

GET /healthzAnswers when the API is up.Live
GET /v1/catalogLists assessment engines and the minimum package for each.Live
GET /v1/sessionCurrent session, CSRF token and engagement roles.Not available yet
POST /v1/login/requestSends a sign-in code by email.Not available yet
POST /v1/login/verifyChecks the code and sets the session cookie.Not available yet
DELETE /v1/sessionClears the cookie and ends the server session.Not available yet
GET /v1/engagementsEngagements this account can see.Not available yet
POST /v1/engagementsCreates a new engagement for one package and domain.Not available yet
GET /v1/engagements/{id}Account-owned receipt snapshot.Not available yet
POST /v1/engagements/{id}/identityStarts identity for the engagement.Not available yet
GET /v1/engagements/{id}/identityIdentity state for the engagement.Not available yet
POST /v1/join/lookReads a join link: identity state and consent text.Not available yet
POST /v1/join/identity/startStarts identity after the consent is accepted.Not available yet
POST /v1/join/identity/statusIdentity state for a join link.Not available yet
POST /v1/engagements/{id}/checkoutAirwallex checkout link, only after identity.Not available yet
POST /v1/engagements/{id}/dns/challengeUnique TXT challenge after payment.Not available yet
POST /v1/engagements/{id}/dns/verifyCurrent TXT verification and ownership receipt.Not available yet
POST /v1/engagements/{id}/loaSigning link for the letter of authorization, after DNS proof.Not available yet
GET /v1/engagements/{id}/loaSignature state of the letter of authorization.Not available yet
POST /v1/engagements/{id}/startSchedules the run only after all receipts, scope, time and egress checks.Not available yet
POST /v1/engagements/{id}/stopKill switch: stops remaining work and records an audit entry.Not available yet
GET /v1/engagements/{id}/reportAccount-owned, integrity-checked and signed report.Not available yet
POST /v1/engagements/{id}/report/encrypted-downloadShort-lived link to the encrypted report archive.Not available yet
POST /v1/engagements/{id}/report/passwordPassword for the encrypted report archive.Not available yet
POST /v1/engagements/{id}/report/plaintext-codeEmails a one-time code for the plaintext report.Not available yet
POST /v1/engagements/{id}/report/plaintext-downloadShort-lived link to the plaintext report, after the emailed code.Not available yet
GET /v1/engagements/{id}/tokensOwner-only token metadata. Never the secret.Not available yet
POST /v1/engagements/{id}/tokensOwner-only, one-time secret after four gates.Not available yet
DELETE /v1/engagements/{id}/tokens/{tokenId}Immediate revocation and audit.Not available yet

03ENGINE CATALOG

Read live from the API.

This list comes from GET /v1/catalog when the page loads. Nothing is shown that the API did not return.

Working. Reading the catalog…

04DEVELOPER ACCESS

Developer tokens

Scoped developer tokens are issued only after identity, settled payment, DNS proof and signed authorization.
Only the account owner can issue or revoke a token.
Each token is scoped to one engagement, expires, and can be revoked at once.
The secret is shown once and never stored in the browser. Copy it when it appears.

05CUSTOMER WEBHOOKS

Not available yet

Customer webhooks

Customer webhooks are not live. Cybersive delivers no webhook events today.
The planned contract covers endpoint registration, a challenge, signed delivery, replay protection, retries, redaction and audit.

Open workspace