Application HTTP contract

Configure in Connections → Python access & applications → Configure Python input. Add a selected LAS file and its value curve; choose the portable LAS destination. No OSDU/SQL writer, hosted execution, approval requirement or native application delivery is implied. This paragraph describes the existing live-source route: selections and bindings belong to the signed-in administrator. The retained-input member route is documented below.

Input policy uses the source selection’s reviewed revision. Optional pin records that revision; file history is not retained. If replaced, old exact reads fail. Changing a binding creates a new generation and never changes existing runs. Follow does not run code. Missing values use JSON null, never zero. Axis and unit changes are unsupported in this initial application profile. Original bytes and normalized curve views are separate representations. Reader/mapping and lasio version are recorded per run. If they change, normalized reads and uncommitted publication require a new run; original byte reads remain exact.

Public API

POST /api/v1/projects/{project}/applications/{operation}, Content-Type application/json, Authorization Bearer credential, body includes matching project_id. Browser-authorized provider tokens additionally require X-Ophiolite-Application-Grant. No Origin or browser cookies. Delegates issued in Developer expire after five minutes and require the parent session; not unattended workload identities. Gateway must enable both identity and sources.

Operations: list, get(id), read(id), original(id), download(id) require read scope; start(id=binding,generation,command_id,application_version,parameters) and publish(id=run,changes=[{index,value}]), configure and share require write; inspect and options require read. On gateways with the one-API update, the same public routes accept browser sessions with CSRF proof (and exact Origin on POST), delegates and approved application grants. Never combine Bearer credentials with cookies or Origin. Check the deployment’s /api/v1/openapi.json for availability.

configure accepts name, selection_id, curve, optional expected_revision, destination=‘portable’; updates add id and current generation. Live-source configuration still requires administration and the selection owner’s identity. A create with command_id can be retried with identical fields after a lost response; changed fields are refused. Replay returns the existing binding at its current generation, including any later edits. List returns definition, bindings and runs. Indices are zero-based positions in the returned axis, not depths.

start command_id is immutable per account/project; different retries fail. Run inputs are exact, not a cross-system transaction. Same-run same-output publication recovers its receipt; different output fails. Publication state is independent of unobserved external execution outcome. If a script crashes after commit, repeat the identical request. A publication receipt confirms bytes/destination/identity, not the declared algorithm.

Live-source limits: 100 bindings and runs per account/project; 100 lifetime source drafts shared with manual editing, consumed at publication only; 100,000 LAS samples, 64 curves, 1,000 changed cells, 4 KiB parameters, 2.1 MB HTTP request. Single gateway process. Application drafts cannot be edited/discarded through manual draft routes. Current project/source access is required on reads/publication/download; exported copies cannot be recalled. A replaced source before commit requires a new run. A committed artifact can be recovered without rereading old source bytes if access remains permitted.

Reference client

cli/curve_application.py uses only standard Python and public HTTP interfaces. Use browser login with the accompanying application_access.py helper, or set OPHIOLITE_TOKEN privately to a read/write delegate. Run:

python3 curve_application.py --url https://workspace.example.org --project PROJECT \
  --binding BINDING --start 100 --stop 103 --offset 2 --output my-result

Choose interval in source depth units. Example does not fill gaps. Output includes original.las, normalized input.json, result.las, receipt.json and retry state run.json and changes.json. Use a fresh directory for a different calculation; preserve it to retry. Check receipt hash with hashlib and result with lasio independently. Never commit tokens or originals without permission. HTTP permitted only for loopback; redirects refused.

Discover a binding

curl --fail-with-body "$WORKSPACE/api/v1/projects/$PROJECT/applications/list" \
  -H "Authorization: Bearer $OPHIOLITE_TOKEN" -H 'Content-Type: application/json' \
  --data "{\"project_id\":\"$PROJECT\"}"

Response has definition, bindings and runs. Each binding includes id, generation, name, selection_id, curve, expected_revision and destination. Pass its ID to the client; the client supplies the current generation at start. The repository path is cli/curve_application.py; the same curated reference client is downloadable from this site: curve_application.py.

For a downloadable client and steps, see Run a Python curve application.

Browser-authorized application access

Qualified for the dedicated Keycloak public device client. Discovery: GET /api/v1/application-access/config returns issuer, client_id and poll_interval. Use RFC 8628 against the provider, then POST bearer-only JSON to:

• /api/v1/application-access/request: project_id, scopes (read, write), label; returns pending grant, confirmation_code and approval_url.
• /api/v1/application-access/status: id; only the owning provider session can poll.
• /api/v1/application-access/revoke: id; durable grant revocation.

Browser /api/v1/application-access/{list,get,approve,deny,revoke} requires session, Origin and CSRF. Approve takes id and matching confirmation_code. It requires the same mapped account and current project access; write consent requires member or administrator eligibility. Retained-LAS execution additionally requires member/compute permission, an explicit runner grant and current input access. Live-source operations retain their administrator/source-owner restrictions. Binding configuration is not permission. A provider token alone never authorizes application operations. Each request rechecks active provider identity, issuer/subject/client/session, grant, route scope and current project/source authority. Machine requests reject browser cookies and Origin. Manual delegates retain their existing authorization path.

Pending grants expire in ten minutes, approved grants at most seven days and always require a valid provider session. Limit twenty active/pending grants per account; poll at least five seconds apart. Revocation affects subsequent authorization, not an in-flight transaction. New provider sessions require new consent. No offline access, hosted execution or general machine access to other API families is implied.

Capability 3: application reach

A request with capability: 3 (the Python SDK’s device_login asks for it) must include read; write is optional. Capability 3 keeps everything capability 1 allows and adds project discovery and the project’s data reads: wells and entities, the catalogue, sources, subscriptions, collections, result groups, stages, search, capabilities, activity, native reads and the policy context. It gains no new writes: creating entities, drafting sources and every other write in those areas stay refused, while capability 1’s application writes remain available to a write grant. The consent screen names the project and says, in two sentences, what the application may read and (with write) upload, publish and share.

POST /api/v1/projects/list and POST /api/v1/projects/organizations take no project in the path. A credential bound to one project (a capability-3 grant, a project access key, a delegate, an agent) lists exactly that project and the organisation holding it; a browser session lists every project the person holds; a workload lists the projects its policy names that still exist. Capability-1 grants are refused discovery. In the SDK: ophiolite.connect(url, credential).projects(), and ophiolite projects / ophiolite orgs on the command line.

Retained inputs and ordinary members (Stages 2D–2E)

An administrator can instead configure a retained LAS asset using release_id, asset_index, curve, name and explicit runners (account IDs). Updates include id/generation. The binding pins package manifest digest, asset index, source revision and payload SHA256. The package must be an unreviewed snapshot or approved release; candidate and withdrawn packages are refused. Review is optional. inspect takes release_id/asset_index and returns curves plus the bounded distribution audience. options lists available retained LAS inputs. These operations do not launch Python.

A user must have current project access, a current binding execution grant and current retained-input distribution access. Start/publication additionally require native role member and can_compute. Application consent authorizes read/write requests, not resources; it does not grant execution or data access. Deployment policy still bounds the retained-input audience; ask the deployment administrator when a colleague is outside it. The PostgreSQL administration slice does not itself share account-owned SQL selections or enable SQL curves.

list includes a member’s permitted shared bindings and their own runs; configuration remains administrator-only. The existing standard-library curve client is unchanged: list, start, read, original, publish, download use the same fields. Original reads identify representation=retained-original; normalized curves retain the existing axis/unit/null policy. These reads use retained bytes, never the creator’s upstream credential. Replacing the source file does not remove the retained input.

Retained publication directly calls the qualified Connectors artifact writer; it never impersonates an administrator or invokes account-owned Drafts. Output bytes, run state and receipt are one SQLite transaction. Idempotent run/output identities and edit-result manifests are preserved. At most 32 MiB/result, 100 results/project, and 512 MiB jointly across retained releases and application outputs. Retained reads are serialized by the bounded pilot application lock; this is not a 100-user SLA.

result-list, result-preview(id), result-download(id) require read scope on the public machine API and also exist on the browser application route. Preview is at most 200 rows, with total_rows/truncated and explicit missing values. Download includes payload_base64, the existing publication receipt and complete run lineage. Workspace exposes these under Data → Results. They are retained derivatives, not new live catalog selections, source writes or automatic native-app synchronization.

share(id,audience=[account IDs]) is controlled by the result author and is available on the public applications route with write scope. Recipients also need current project access and current input distribution rights. An empty audience revokes all recipients. Being a project administrator does not expose someone else’s private result. Result sharing never grants binding execution. Project/input withdrawal or distribution revocation blocks subsequent consumption; removal of a runner stops new reads/publication through that binding but does not recall a result already explicitly shared under its separate consumption policy. A successful publication and script-declared provenance are not scientific approval.

The dedicated application_results and application_shares tables extend the existing application run/receipt journal. A backup must preserve the journal and configured source distribution policies. Never silently widen a restored audience.

OpendTect reference consumer

The native GR adapter uses the same public start/read/original/publish/download calls and browser-approved identity. It does not require privileged server imports. Runs identify opendtect-gr-patch/1; destination and native-operation evidence are script-declared. Publication validates the bounded patch contract, not the claimed host action or scientific correctness.