Experimental automation API
The versioned pilot surface is under /api/v1/; its deployed schema is available
at /api/v1/openapi.json. It is not yet a stable SDK. Browser management remains
separate behind session and CSRF checks.
A Project Developer credential delegates read, optional import and optional
compute actions for one project. It never adds permissions. It expires within five
minutes or when its parent session/access ends. Requests use Authorization: Bearer
and bounded application/json, without browser cookies or an Origin header.
Never put credentials in query strings, shared logs or shell arguments.
Platform’s cli/ophiolite.py supports login, logout, assets, inspect,
history, import-geotiff and export. Login reads the credential from standard
input and stores it in a private configuration file. Use exact revision strings
when inspecting/exporting. GeoTIFF import takes an explicit unit, name and command
ID; retain the same ID and body on retry. Export writes a raster plus manifest and
source evidence to a new directory.
Read endpoints are /api/v1/projects/{project}/read/{method}, using the native
protobuf JSON contract. Map operations are /maps/import, /maps/operate and
/maps/export. Request, route and credential project must match. Publication and
operators use the same policy and durable command journal as Workspace.
History uses limit and before_revision; asset listing remains bounded rather
than generally paginated. CLI project creation, service accounts, device login and
watch commands are not included in this increment.
Errors include HTTP status plus code such as INVALID_ARGUMENT,
UNAUTHENTICATED, PERMISSION_DENIED, NOT_FOUND, ABORTED, ALREADY_EXISTS or
UNAVAILABLE. After a lost publication response, repeat the original command.
Renewing a credential does not mean generating another publication command.