Application HTTP contract

Configure in Connections → Applications → Curve applications → Configure application. Add a selected LAS file and its value curve; choose the portable LAS destination. No OSDU/SQL writer, hosted execution, approval requirement or native application delivery is implied. Selections and bindings belong to the signed-in account. Administration is required.

Input policy uses the source selection’s reviewed revision. Optional pin records that revision; file history is not retained. If replaced, old exact reads fail. Changing a binding creates a new generation and never changes existing runs. Follow does not run code. Missing values use JSON null, never zero. Axis and unit changes are unsupported in this initial application profile. Original bytes and normalized curve views are separate representations. Reader/mapping and lasio version are recorded per run. If they change, normalized reads and uncommitted publication require a new run; original byte reads remain exact.

Public machine API

POST /api/v1/projects/{project}/applications/{operation}, Content-Type application/json, Authorization Bearer credential, body includes matching project_id. Browser-authorized provider tokens additionally require X-Ophiolite-Application-Grant. No Origin or browser cookies. Delegates issued in Developer expire after five minutes and require the parent session; not unattended workload identities. Gateway must enable both identity and sources.

Operations: list, get(id), read(id), original(id), download(id) require read scope; start(id=binding,generation,command_id,application_version,parameters) and publish(id=run,changes=[{index,value}]) require write. Configuration is browser-only POST /api/applications/configure: name, selection_id, curve, optional expected_revision, destination=‘portable’; updates add id and current generation. List returns definition, bindings and runs. Indices are zero-based positions in the returned axis, not depths.

start command_id is immutable per account/project; different retries fail. Run inputs are exact, not a cross-system transaction. Same-run same-output publication recovers its receipt; different output fails. Publication state is independent of unobserved external execution outcome. If a script crashes after commit, repeat the identical request. A publication receipt confirms bytes/destination/identity, not the declared algorithm.

Limits: 100 bindings and runs per account/project; 100 lifetime source drafts shared with manual editing, consumed at publication only; 100,000 LAS samples, 64 curves, 1,000 changed cells, 4 KiB parameters, 2.1 MB HTTP request. Single gateway process. Application drafts cannot be edited/discarded through manual draft routes. Current project/source access is required on reads/publication/download; exported copies cannot be recalled. A replaced source before commit requires a new run. A committed artifact can be recovered without rereading old source bytes if access remains permitted.

Reference client

cli/curve_application.py uses only standard Python and public HTTP interfaces. Use browser login with the accompanying application_access.py helper, or set OPHIOLITE_TOKEN privately to a read/write delegate. Run:

python3 curve_application.py --url https://workspace.example.org --project PROJECT \
  --binding BINDING --start 100 --stop 103 --offset 2 --output my-result

Choose interval in source depth units. Example does not fill gaps. Output includes original.las, normalized input.json, result.las, receipt.json and retry state run.json and changes.json. Use a fresh directory for a different calculation; preserve it to retry. Check receipt hash with hashlib and result with lasio independently. Never commit tokens or originals without permission. HTTP permitted only for loopback; redirects refused.

Discover a binding

curl --fail-with-body "$WORKSPACE/api/v1/projects/$PROJECT/applications/list" \
  -H "Authorization: Bearer $OPHIOLITE_TOKEN" -H 'Content-Type: application/json' \
  --data "{\"project_id\":\"$PROJECT\"}"

Response has definition, bindings and runs. Each binding includes id, generation, name, selection_id, curve, expected_revision and destination. Pass its ID to the client; the client supplies the current generation at start. The repository path is cli/curve_application.py; the same curated reference client is downloadable at https://ophiolite.dev/docs/examples/applications/curve_application.py .

For a downloadable client and steps, see Run a Python curve application.

Browser-authorized application access

Qualified for the dedicated Keycloak public device client. Discovery: GET /api/v1/application-access/config returns issuer, client_id and poll_interval. Use RFC 8628 against the provider, then POST bearer-only JSON to:

• /api/v1/application-access/request: project_id, scopes (read, write), label; returns pending grant, confirmation_code and approval_url.
• /api/v1/application-access/status: id; only the owning provider session can poll.
• /api/v1/application-access/revoke: id; durable grant revocation.

Browser /api/application-access/{list,get,approve,deny,revoke} requires session, Origin and CSRF. Approve takes id and matching confirmation_code. It requires the same mapped account and current project administration. Binding configuration is not permission. A provider token alone never authorizes application operations. Each request rechecks active provider identity, issuer/subject/client/session, grant, route scope and current project/source authority. Machine requests reject browser cookies and Origin. Manual delegates retain their existing authorization path.

Pending grants expire in ten minutes, approved grants at most seven days and always require a valid provider session. Limit twenty active/pending grants per account; poll at least five seconds apart. Revocation affects subsequent authorization, not an in-flight transaction. New provider sessions require new consent. No offline access, hosted execution or general machine access to other API families is implied.