API edge (gateway)
Capability edge. Auth: bootstrap mode (Bearer EDGE_BOOTSTRAP_TOKEN + X-Organization-Id header) today; jwks mode (Bearer identity RS256 JWT, organization_id from the verified claim) once identity/C3 is live. Per-organization_id token-bucket rate limit. Contract routing: /v1/deliveries* -> webhook-egress, /v1/transcribe* -> stt. The authenticated organization_id is injected into the forwarded body (anti-spoof).
- Group: Auth & gateway
- Contract:
contracts/edge/v1/openapi.yaml - Public access: none — internal-only capability. It is NOT exposed on the public API gateway (
https://api.vagarylabs.com); it is reachable only inside the fleet (container/tailnet) by first-party callers. There is no customer-facing endpoint to call. - Auth (internal):
bearerTokenfirst-party bearer
Endpoints
| Method | Path | Summary |
|---|---|---|
GET | /health | liveness + current auth mode + routes (open) |
GET | /metrics | Prometheus text (open) |
POST | /v1/{capabilityPath} | authenticate + rate-limit + route to the capability upstream |
GET | /v1/{capabilityPath} | authenticate + rate-limit + route (e.g. status reads) |
Schemas
Error
| Field | Type | Description |
|---|---|---|
error | string | machine code (unauthorized, forbidden, not_found, validation_error, rate_limited, upstream_failed) |
reason | string | |
detail | object | |
request_id | string |
Generated by scripts/gen-capability-docs.py from contracts/edge/v1/openapi.yaml — the contract IS the source of truth; edit the contract, not this page.