Sprint 18.1
Applications
Register tenant-owned development, sandbox, and production clients with explicit owners and redirect URLs.
Administration
Enterprise developer platform
Governed applications, credentials, scopes, rate limits, audit logs and stable public APIs.
Sprint 18.1
Credentials
Issue one-time API secrets, rotate credentials safely, set expiry, and revoke access immediately.
Sprint 18.1
Scopes & grants
Approve granular scopes and optionally constrain access to specific resources.
Sprint 18.1
Rate limits
Apply application policies by period, environment, sustained limit, and burst allowance.
Sprint 18.1
Request logs
Inspect correlation IDs, endpoints, status codes, latency, and rate-limit decisions without storing sensitive bodies.
Sprint 18.1
API explorer
Use the OpenAPI 3.1 contract for /api/public/v1 and test approved tenant-scoped endpoints.
Public API v1
Stable tenant-aware contracts are available under /api/public/v1. API secrets are shown once, stored as SHA-256 hashes, and evaluated together with application status, expiry, scopes, grants, and rate-limit policy.
Initial scopes
organization.read · user.read · okr.read · okr.write · project.read · project.write · analytics.read · document.read · document.write · workspace.read · workspace.write · collaboration.read · collaboration.write · ai.invoke
Operational boundary
Production deployments should enforce distributed rate counters, idempotency storage, gateway request-size limits, secret rotation procedures, and retention rules for request logs.