Network Authority API
Generated HTTP surface reference for USG. This page intentionally has no try-it or request execution controls. Use /swagger.json for automation.
HTTP Surfaces
Signed POST routes require operator or node signing outside the browser.
| Method | Path / command | Surface | Purpose | Access | Rate limit |
|---|---|---|---|---|---|
| GET | /health | Health summary | Expanded service health summary. | None | — |
| GET | /healthz | Liveness | Process-level health probe. | None | — |
| GET | /readyz | Readiness | Database and migration readiness. | None | — |
| GET | /metrics | Metrics | Prometheus-compatible runtime metrics. Internal: bind to the management interface, do not expose publicly. | Internal network only | — |
| GET | /sovereign.json | Sovereign metadata | Operator-safe public trust material. | None | — |
| GET | /genesis | Genesis | Signed network trust root. | None | — |
| GET | /policy | Policy | Active DB-backed policy manifest. | None | — |
| GET | /crl | Revocation list | Current signed certificate revocation list. | None | — |
| GET | /nodes | Nodes | Active node count. The per-node roster (keys, roles, remote addresses) requires operator authentication. | None for counts; operator signature for the roster | — |
| GET | /dashboard | Sovereign dashboard | Read-only sovereign health and trust view. | None | — |
| GET | /dashboard.json | Dashboard JSON | Machine-readable sovereign health and trust summary. | None | — |
| GET | /connectome | Connectome | Human-readable recognition and revocation view. | None | — |
| GET | /connectome.json | Connectome JSON | Machine-readable Connectome summary. | None | — |
| GET | /atlas | Trust Atlas | Read-only recognition graph explorer with evidence overlay. | None | — |
| GET | /atlas.json | Atlas JSON | Machine-readable Atlas summary with graph digest. | None | — |
| GET | /connectome/trust-path |
Trust path |
Explain recognition between two sovereigns.
Requires from and to query parameters. |
None | — |
| GET | /recognition-graph | Recognition graph | Source graph for trust explanations. | None | — |
| GET | /recognition-treaties | Recognition treaties | List persisted sovereign treaties. | None | — |
| GET | /recognition-policy | Recognition policy | Current portable-trust acceptance policy. | None | — |
| GET | /sovereign-revocation-feed | Sovereign revocation feed | Export revocations issued by a sovereign. | None | — |
| GET | /attestations | Membership attestations | List issued portable membership attestations. | None | — |
| GET | /agents | Agent discovery |
Discover agent descriptors by capability. Without a capability filter, returns a count only.
Pass capability= to receive descriptors; the unfiltered form does not enumerate the registry. |
None | — |
| GET | /agents/{node_public_key} |
Agent lookup | Read one agent descriptor. | None | — |
| GET | /swagger.json | OpenAPI metadata | Generated HTTP protocol surface metadata. | None | — |
| GET | /api-reference | API reference | Read-only HTTP API reference. | None | — |
| GET | /cli-reference | CLI reference | Generated CLI command reference. | None | — |
| POST | /join |
Join | Issue a certificate from a single-use invite. | Node PoP | — |
| POST | /heartbeat |
Heartbeat | Update authenticated node liveness. | Node PoP | — |
| POST | /renew |
Renew | Renew a non-revoked node certificate. | Node PoP | — |
| POST | /agents |
Register agent | Publish an authenticated agent descriptor. | Node PoP | — |
| DELETE | /agents/{node_public_key} |
Remove agent | Delete an authenticated descriptor. | Node PoP | — |
| POST | /admin/invite |
Invite | Create a scoped enrollment token. | Operator signature | — |
| POST | /admin/revoke |
Revoke | Publish a new signed CRL. | Operator signature (privileged tier) | — |
| POST | /admin/operator-keys/{key_id}/revoke |
Revoke operator key | Switch an operator key off at runtime without restarting. Terminal; refuses the last usable key. | Operator signature (privileged tier) | 30/min per IP |
| POST | /admin/policy |
Policy publish | Activate a signed policy version. | Operator signature (privileged tier) | — |
| GET | /admin/policy/history |
Policy history | Inspect persisted policy versions. | Operator signature | — |
| POST | /admin/policy/rollback |
Policy rollback | Reactivate a previous policy. | Operator signature (privileged tier) | — |
| POST | /admin/attestations |
Issue attestation | Issue portable membership evidence. | Operator signature (privileged tier) | — |
| POST | /admin/attestations/{attestation_id}/revoke |
Revoke attestation | Publish sovereign-level attestation revocation. | Operator signature (privileged tier) | — |
| POST | /admin/recognition-policy |
Set recognition policy | Set portable trust acceptance policy. | Operator signature (privileged tier) | — |
| POST | /admin/recognition-treaties |
Issue treaty | Create a direct-recognition treaty for another sovereign. | Operator signature (privileged tier) | — |
| POST | /admin/recognition-treaties/{treaty_id}/revoke |
Revoke treaty | End a persisted recognition treaty. | Operator signature (privileged tier) | — |
| POST | /admin/sovereign-revocation-feeds/import |
Import revocation feed | Import revoked trust material from a recognized sovereign. | Operator signature (privileged tier) | — |
| POST | /consensus/verify |
Verify consensus proof | Verify a K-of-N consensus proof. | None | 60/min per IP |
| POST | /agreements/verify |
Verify agreement | Verify signatures on a relationship agreement. | None | 60/min per IP |
| POST | /disclosure/verify |
Verify disclosure | Verify a selective-disclosure capability proof. | None | 60/min per IP |
| POST | /trust-evidence/verify |
Verify trust evidence | Verify a signed TrustEvidence record. | None | 60/min per IP |
| POST | /boundary/verify |
Verify boundary decision | Verify a signed BoundaryDecision. | None | 60/min per IP |
| POST | /data-usage/verify |
Verify data usage | Verify a signed data-usage record. | None | 60/min per IP |
| POST | /recognition-treaties/verify |
Verify treaty | Verify a signed recognition treaty. | None | 60/min per IP |
| POST | /attestations/verify |
Verify attestation | Verify a signed membership attestation. | None | 60/min per IP |
| POST | /attestations/verify-with-treaty |
Verify with treaty | Verify an attestation using a recognition treaty. | None | 60/min per IP |
No API surfaces match the current search.
No browser request builder is provided. POST/admin routes are
documented here, but must be executed by the CLI or a signed HTTP client.