📄️ Capability reference
Every vagary-core capability, generated from its versioned OpenAPI contract (contracts//v1/openapi.yaml). Each page lists the capability's endpoints, auth, key schemas, and (where it exists) its sellable product face. Public access is via the consolidated API gateway — the edge at api. (api.vagarylabs.com master / api.vagaryvoice.cloud voice / api.vagarylife.com life), NOT internal container URLs. This is the master contract authority — a capability's page can only be changed by changing its shipped contract.
📄️ Ads serving
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Affiliate
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Analytics
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Audit log
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Billing & metering
Usage metering + multi-rail billing as a shared capability — one account buys across products. METERING multi-rail (Dodo/PayPal/crypto/Razorpay; Stripe DORMANT), subscriptions, invoices, dunning. Metering NEVER blocks a product runtime (queue + reconcile). Payment secrets resolved server-side (Infisical), never in body/DB/logs. SELLER OF RECORD differs by rail (ADR-110 D3) we are the seller and our tax is added. stripe is retained but DORMANT — it cannot settle for an India LLP (no PA-CB licence; invite-only) and refuses every charge/refund/capture with 422 regardless of credentials (ADR-110 D4).
📄️ Campaign orchestration
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ CDN
CDN control-plane. Multi-provider (cloudflare | cloudfront | fastly | direct | stub). Cloudflare purge is capped at 30 URLs/call and requires CLOUDFLAREZONEID + CLOUDFLAREAPITOKEN (env-only); absent creds fall back to 'direct' mode (no upstream purge call, never raising). generatecachekey = sha256 first-32 hex of url + sorted vary headers.
📄️ CMS
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Compliance
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Config flags
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Contact center
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Content ingestion
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Content moderation
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Conversation intelligence
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Dedup index
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Dialog engine
This capability is granted by an API key scoped to the ai-suite product (product face). See the product reference below.
📄️ API edge (gateway)
Capability edge. Auth /v1/deliveries -> webhook-egress, /v1/transcribe -> stt. The authenticated organization_id is injected into the forwarded body (anti-spoof).
📄️ Entitlement
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Eval harness
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Experimentation
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Flow builder
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ i18n
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Identity (OIDC)
The fleet identity provider — one OIDC issuer for all products, so a single account authenticates across the fleet (the cross-product SSO the census found impossible). Signs RS256/JWKS; per-brand realms. Consolidates the 19-service platform auth + voice + bellring (C3). The signing key is resolved server-side and NEVER present in a repo, a consumer, or a facade. Status Phase 1 ETL → G0 gate → Phase 2 repoint-with-fallback → Phase 3 per-consumer deletes (voice last).
📄️ Long-term memory
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Marketplace
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Media transcode
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Notifications
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Observability
Shared observability instrumentation standard (Track H1). Defines the two unauthenticated, tailnet-scoped exposition endpoints every service serves (GET /metrics Prometheus text; GET /health liveness), the Fix-157 label-cardinality/PII policy that is a MANDATORY SDK default, the structured-log JSON schema, and the OTLP tracing env contract. ZERO new store — emits to the existing substrate one-pane (Prometheus/VictoriaMetrics · Alloy→Loki · Tempo/OTLP · GlitchTip). Full policy: standard.md.
📄️ Provider gateway
This capability is granted by an API key scoped to the ai-suite product (product face). See the product reference below.
📄️ Realtime media
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Retrieval
This capability is granted by an API key scoped to the ai-suite product (product face). See the product reference below.
📄️ Revenue tracking
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Scheduler
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Security
Inbound-security config plane. All /v1/security/* routes are platform-admin gated (Bearer SECURITYADMINTOKEN; fail-CLOSED when unset). The IP-allowlist is a shared Redis Set (I4 shared-contract, NOT a shared DB) with additive-trust, fail-CLOSED semantics. WAF-rule persistence (wafrules) and the SIEM DLQ (siemdlq) are §29.5-protected operator-gated migrations — not created by this service.
📄️ SEO discoverability
SEO discoverability push capability. Submits content URLs to IndexNow (Bing/Yandex) for a (host, key), and pings a WebSub/PubSubHubbub hub in publisher mode that a feed has updated. Both are stateless outbound actions. Also optionally serves the per-host IndexNow verification key file when a deploy owns the host→key map (public, unauthenticated — search engines HEAD-probe it).
📄️ Session store
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Social distribution
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Speech-to-text
This capability is granted by an API key scoped to the speech-api product (product face). See the product reference below.
📄️ Text-to-speech
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Vertical factory
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.
📄️ Webhook egress
This capability is granted by an API key scoped to the webhooks product (product face). See the product reference below.
📄️ Workflow automation
This capability is granted by an API key scoped to the `` product (product face). See the product reference below.