Capability Registry API: schemas

The request and response bodies of the operations in this API.

ActionCatalogKind

Type: one of "capability", "workflow", "function"

CapabilityDescriptorBindingDto

Property	Type	Required	Description
`expectedDescriptorHash`	string	yes	Lowercase sha256 hex of the descriptor: the capability record's `descriptorHash` when it was picked.
`ref`	string	yes

CapabilityProviderBindingDto

Property	Type	Required	Description
`capabilityRef`	string	yes	Canonical capability ref this binding backs.
`createdAt`	string	yes
`credentialBindingId`	string	no	Opaque credential-binding id resolved by the credential-broker. Absent ⇒ the backing needs no brokered secret. Never a secret.
`id`	string	yes
`isDefault`	boolean	yes	Whether this binding is the org's default for the ref. At most one default per (orgId, capabilityRef).
`orgId`	string	yes	Tenant org this binding is scoped to.
`providerConfig`	object	yes	Transport-specific config (e.g. `{ url }` for http_endpoint). Never a secret.
`providerKind`	one of `"model_modality"`, `"http_endpoint"`, `"worker"`, `"integration"`, `"platform_service"`	yes
`readiness`	ProviderBindingReadinessDto	yes	Whether the binding can serve an invocation now, derived at read time. Non-integration bindings are always ready.
`targetCapabilities`	array of string	yes	Capabilities the binding's target needs of its own to serve the ref (e.g. `credential:resolve@1` for a connector operation that reads its connection's credential). A delegated caller lends them separately and the target is lent exactly these. Empty ⇒ the target needs nothing.
`updatedAt`	string	yes

CapabilityProviderBindingDtoDataEnvelope

Property	Type	Required	Description
`data`	CapabilityProviderBindingDto	yes

CapabilityProviderBindingListDto

Property	Type	Required	Description
`bindings`	array of CapabilityProviderBindingDto	yes

CapabilityProviderBindingListDtoDataEnvelope

Property	Type	Required	Description
`data`	CapabilityProviderBindingListDto	yes

CreateCapabilityProviderBindingDto

Property	Type	Required	Description
`capabilityRef`	string	yes
`credentialBindingId`	string	no	Opaque credential-binding id. Never a secret.
`isDefault`	boolean	no	Mark this binding as the org's default for the ref. Defaults to false.
`providerConfig`	object	yes	Transport config. Never a secret.
`providerKind`	one of `"model_modality"`, `"http_endpoint"`, `"worker"`, `"integration"`, `"platform_service"`	yes
`targetCapabilities`	array of string	no	Capabilities the binding's target needs of its own to serve the ref (e.g. `credential:resolve@1` for a connector operation that reads its connection's credential). A delegated caller lends them separately and the target is lent exactly these. Empty ⇒ the target needs nothing.

CreateHookBindingDto

Property	Type	Required	Description
`executeAs`	SubjectRefDto	yes	Kernel `SubjectRef` the handler executes as: the creator themself, or the organization when an administrator creates the binding in the org Space.
`handler`	HookHandlerRefDto	yes	The action kind and the exact capability descriptor: its ref and the capability record's current `descriptorHash`.
`hookPointId`	string	yes
`mode`	HookMode	yes
`parameters`	object	no	Typed configuration for the handler, passed to it with every invocation. The handler declares their schema (the `parameters` property of its capability's input schema); a binding whose parameters that schema refuses, or whose handler declares none, is refused (`parameters-invalid`, `parameters-not-declared`). Absent means none.
`participation`	HookParticipation	yes
`projection`	array of string	yes	The approved input projection (field pointers).
`space`	SpaceRefDto	yes	The Space the binding is scoped to: the caller's org Space or their own user Space.

DataClassification

Type: one of "public", "internal", "confidential", "secret", "regulated"

HookBindingAction

What this caller may do to the binding, judged by the same authority the mutating route applies. Empty means read-only.

Type: one of "remove", "remove-required"

HookBindingAuthority

How far the execute delegation got: awaiting (not served), provisioning, authorized, or ended (served; fails closed until re-authorized). A read model for authors; execution never trusts it.

Type: one of "awaiting", "provisioning", "authorized", "ended"

HookBindingAuthorityRefusal

Why the last attempt did not promote the binding.

Type: one of "requires-member", "owner-unreachable", "origination-refused", "delegation-ended", "owner-changed"

HookBindingConflictCode

SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.

Type: one of "HOOK_BINDING_CONTENTION", "HOOK_BINDING_NOT_REQUIRED", "HOOK_BINDING_REQUIRED_NEEDS_POLICY_REMOVAL"

HookBindingConflictProblemDto

RFC 9457 problem document of a hook binding route. Extension members stay top-level and open, as on ProblemDetailsDto.

Property	Type	Required	Description
`actionableBy`	ProblemActionableBy	no	Who can act on this refusal: `user` (correct the input, sign in), `org-admin` (an administrator of the organisation), `platform` (the operators of this installation), `none` (nobody — it cannot succeed). ABSENT when not known; never guessed.
`code`	HookBindingConflictCode	yes	SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.
`contention`	HookBindingContentionCause	no	Present on HOOK_BINDING_CONTENTION: why the write lost.
`detail`	string	no	Human-readable and specific to THIS occurrence.
`errors`	array of ProblemFieldIssueDto	no	Field-level issues, when the refusal is about the request body.
`instance`	string	no	URI reference identifying the occurrence — a request path, a run, a row.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for the message keyed by `code` — typed and allowlisted per code by its declaration. Never server-authored copy, never internal diagnostics.
`retry`	ProblemRetry	no	What a retry can achieve: `transient` (later, unchanged), `after-change` (only after someone changes something), `never` (a defect until a fixed version ships). ABSENT when not known.
`retryable`	boolean	no	True on HOOK_BINDING_CONTENTION: the write was rolled back whole; send it again.
`status`	number	yes	The HTTP status code, repeated in the body so a logged document is self-contained.
`title`	string	yes	Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`.
`traceId`	string	no	W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not.
`type`	string	yes	Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`.

HookBindingContentionCause

Present on HOOK_BINDING_CONTENTION: why the write lost.

Type: one of "deadlock", "serialization-failure"

HookBindingDormancyDto

Property	Type	Required	Description
`cause`	HookBindingDormantCause	yes
`codes`	array of HookBindingRefusalCode	yes	The admission codes a refusing declaration raised (`declaration-refused`); empty for every other cause.

HookBindingDormantCause

Type: one of "execute-as-organization-on-session-point", "declaration-withdrawn", "declaration-refused", "descriptor-withdrawn"

HookBindingDto

Property	Type	Required	Description
`authority`	HookBindingAuthority	yes	How far the execute delegation got: awaiting (not served), provisioning, authorized, or ended (served; fails closed until re-authorized). A read model for authors; execution never trusts it.
`authorityRefusal`	HookBindingAuthorityRefusal	no	Why the last attempt did not promote the binding.
`authorityUpstreamCode`	string	no	The authorization-api code behind an `origination-refused`.
`availableActions`	array of HookBindingAction	yes	What this caller may do to the binding, judged by the same authority the mutating route applies. Empty means read-only.
`bindingId`	string	yes
`dormancy`	HookBindingDormancyDto or null	yes	Non-null exactly when `state` is `dormant`.
`executeAs`	SubjectRefDto	yes
`handler`	HookHandlerRefDto	yes
`hookPointId`	string	yes
`mode`	HookMode	yes
`orgId`	string	yes	The org the binding was admitted in.
`origin`	HookBindingOrigin	yes	`authored` in the registry by a member, or `contributed` by an installation.
`parameters`	object	no	The handler's admitted parameters; absent means none.
`participation`	HookParticipation	yes
`projection`	array of string	yes
`revision`	number	yes
`space`	SpaceRefDto	yes
`state`	HookBindingState	yes	`active` bindings are served to the owner; `dormant` ones are withheld, with `dormancy` saying why.

HookBindingDtoDataEnvelope

Property	Type	Required	Description
`data`	HookBindingDto	yes

HookBindingEffectiveEntryDto

Property	Type	Required	Description
`applies`	boolean	yes	True when the binding applies to operations in the viewed Space: active and not suppressed on the chain. This is the set the owner's composer evaluates.
`binding`	HookBindingDto	yes
`inheritance`	HookBindingInheritance	yes	`own` when declared in the viewed Space; `inherited` when declared in an ancestor, which `binding.space` names.
`readOnly`	boolean	yes	True when this caller has no action at all on the entry: `binding.availableActions` and `suppressionActions` are both empty.
`suppressedBy`	array of HookBindingSuppressionDto	yes	The suppressions on the chain that stop this binding applying here. Empty when it is not suppressed.
`suppressionActions`	array of HookBindingSuppressionAction	yes	What this caller may do about the binding AT the viewed Space, judged by the same rules the suppression routes apply.

HookBindingEffectiveSetDto

Property	Type	Required	Description
`canCreate`	boolean	yes	Whether this caller may create a binding in the viewed Space (the authority `POST hook-bindings` applies; admission of the body is separate).
`entries`	array of HookBindingEffectiveEntryDto	yes
`space`	SpaceRefDto	yes

HookBindingEffectiveSetDtoDataEnvelope

Property	Type	Required	Description
`data`	HookBindingEffectiveSetDto	yes

HookBindingForbiddenProblemDto

RFC 9457 problem document of a hook binding route. Extension members stay top-level and open, as on ProblemDetailsDto.

Property	Type	Required	Description
`actionableBy`	ProblemActionableBy	no	Who can act on this refusal: `user` (correct the input, sign in), `org-admin` (an administrator of the organisation), `platform` (the operators of this installation), `none` (nobody — it cannot succeed). ABSENT when not known; never guessed.
`code`	one of `"HOOK_BINDING_SPACE_NOT_PERMITTED"`	yes	SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.
`detail`	string	no	Human-readable and specific to THIS occurrence.
`errors`	array of ProblemFieldIssueDto	no	Field-level issues, when the refusal is about the request body.
`instance`	string	no	URI reference identifying the occurrence — a request path, a run, a row.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for the message keyed by `code` — typed and allowlisted per code by its declaration. Never server-authored copy, never internal diagnostics.
`retry`	ProblemRetry	no	What a retry can achieve: `transient` (later, unchanged), `after-change` (only after someone changes something), `never` (a defect until a fixed version ships). ABSENT when not known.
`status`	number	yes	The HTTP status code, repeated in the body so a logged document is self-contained.
`title`	string	yes	Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`.
`traceId`	string	no	W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not.
`type`	string	yes	Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`.

HookBindingInheritance

own when declared in the viewed Space; inherited when declared in an ancestor, which binding.space names.

Type: one of "own", "inherited"

HookBindingListDto

Property	Type	Required	Description
`bindings`	array of HookBindingDto	yes

HookBindingListDtoDataEnvelope

Property	Type	Required	Description
`data`	HookBindingListDto	yes

HookBindingNotFoundCode

SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.

Type: one of "HOOK_BINDING_NOT_FOUND", "HOOK_BINDING_SUPPRESSION_NOT_FOUND"

HookBindingNotFoundProblemDto

RFC 9457 problem document of a hook binding route. Extension members stay top-level and open, as on ProblemDetailsDto.

Property	Type	Required	Description
`actionableBy`	ProblemActionableBy	no	Who can act on this refusal: `user` (correct the input, sign in), `org-admin` (an administrator of the organisation), `platform` (the operators of this installation), `none` (nobody — it cannot succeed). ABSENT when not known; never guessed.
`code`	HookBindingNotFoundCode	yes	SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.
`detail`	string	no	Human-readable and specific to THIS occurrence.
`errors`	array of ProblemFieldIssueDto	no	Field-level issues, when the refusal is about the request body.
`instance`	string	no	URI reference identifying the occurrence — a request path, a run, a row.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for the message keyed by `code` — typed and allowlisted per code by its declaration. Never server-authored copy, never internal diagnostics.
`retry`	ProblemRetry	no	What a retry can achieve: `transient` (later, unchanged), `after-change` (only after someone changes something), `never` (a defect until a fixed version ships). ABSENT when not known.
`status`	number	yes	The HTTP status code, repeated in the body so a logged document is self-contained.
`title`	string	yes	Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`.
`traceId`	string	no	W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not.
`type`	string	yes	Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`.

HookBindingOrigin

authored in the registry by a member, or contributed by an installation.

Type: one of "contributed", "authored"

HookBindingRefusalCode

The admission codes a refusing declaration raised (declaration-refused); empty for every other cause.

Type: one of "hook-point-mismatch", "mode-not-declared", "action-kind-incompatible", "participation-not-allowed", "projection-outside-declaration", "ambient-execute-authority", "bindings-refused"

HookBindingRefusalReason

Every reason, never only the first: the kernel's admission codes and the registry's own.

Type: string (22 values)

HookBindingRefusedProblemDto

RFC 9457 problem document of a hook binding route. Extension members stay top-level and open, as on ProblemDetailsDto.

Property	Type	Required	Description
`actionableBy`	ProblemActionableBy	no	Who can act on this refusal: `user` (correct the input, sign in), `org-admin` (an administrator of the organisation), `platform` (the operators of this installation), `none` (nobody — it cannot succeed). ABSENT when not known; never guessed.
`code`	one of `"HOOK_BINDING_REFUSED"`	yes	SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.
`detail`	string	no	Human-readable and specific to THIS occurrence.
`errors`	array of ProblemFieldIssueDto	no	Field-level issues, when the refusal is about the request body.
`instance`	string	no	URI reference identifying the occurrence — a request path, a run, a row.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for the message keyed by `code` — typed and allowlisted per code by its declaration. Never server-authored copy, never internal diagnostics.
`refusals`	array of HookBindingRefusalReason	yes	Every reason, never only the first: the kernel's admission codes and the registry's own.
`retry`	ProblemRetry	no	What a retry can achieve: `transient` (later, unchanged), `after-change` (only after someone changes something), `never` (a defect until a fixed version ships). ABSENT when not known.
`status`	number	yes	The HTTP status code, repeated in the body so a logged document is self-contained.
`title`	string	yes	Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`.
`traceId`	string	no	W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not.
`type`	string	yes	Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`.

HookBindingState

active bindings are served to the owner; dormant ones are withheld, with dormancy saying why.

Type: one of "active", "dormant"

HookBindingSuppressionAction

What this caller may do about the binding AT the viewed Space, judged by the same rules the suppression routes apply.

Type: one of "suppress", "unsuppress"

HookBindingSuppressionDto

Property	Type	Required	Description
`bindingId`	string	yes
`space`	SpaceRefDto	yes

HookBindingSuppressionDtoDataEnvelope

Property	Type	Required	Description
`data`	HookBindingSuppressionDto	yes

HookBindingSuppressionListDto

Property	Type	Required	Description
`suppressions`	array of HookBindingSuppressionDto	yes

HookBindingSuppressionListDtoDataEnvelope

Property	Type	Required	Description
`data`	HookBindingSuppressionListDto	yes

HookBindingSuppressionRequestDto

Property	Type	Required	Description
`bindingId`	string	yes
`space`	SpaceRefDto	yes	The Space (at or below the binding's) that suppresses it.

HookConcurrencyScope

What limits.maxConcurrency counts. Absent: tenant.

Type: one of "tenant", "lineage"

HookHandlerRefDto

Property	Type	Required	Description
`actionKind`	ActionCatalogKind	yes
`descriptor`	CapabilityDescriptorBindingDto	yes

HookMode

Type: one of "admit", "transform", "defer", "respond"

HookModeDeclarationDto

Property	Type	Required	Description
`actionKinds`	array of ActionCatalogKind	yes
`mode`	HookMode	yes

HookParticipation

Type: one of "required", "optional"

HookPointBindingRefusal

Type: one of "lineage-unsealed"

HookPointBindingsRefusedDeclarationDto

Property	Type	Required	Description
`refused`	HookPointBindingRefusal	yes

HookPointDeclarationDto

Property	Type	Required	Description
`bindingsRefused`	HookPointBindingsRefusedDeclarationDto	no	Present: the point admits no binding of any participation, for this reason.
`concurrencyScope`	HookConcurrencyScope	no	What `limits.maxConcurrency` counts. Absent: `tenant`.
`id`	string	yes
`inputProjection`	array of string	yes	The widest input projection any binding may be approved for (field pointers).
`limits`	HookPointLimitsDto	yes
`modes`	array of HookModeDeclarationDto	yes
`operation`	string	yes	Stable id of the owner's operation this point guards.
`participation`	array of HookParticipation	yes
`reentry`	HookReentryDeclarationDto	no	Absent: the point is never re-entered on its own synchronous chain.
`respond`	HookRespondDeclarationDto	no	Present iff the point declares a respond mode.
`writableFields`	array of string	yes	Fields a transform may write (field pointers); empty unless a transform mode is declared.

HookPointLimitsDto

Property	Type	Required	Description
`deadlineMs`	number	yes	The one overall deadline for an evaluation, in milliseconds.
`maxConcurrency`	number	yes	Maximum handlers in flight at once for one evaluation.
`maxFanOut`	number	yes	Maximum bindings fanned out per evaluation.
`maxPayloadBytes`	number	yes	Maximum bytes of one receiver's input projection.

HookPointListDto

Property	Type	Required	Description
`hookPoints`	array of HookPointSummaryDto	yes

HookPointListDtoDataEnvelope

Property	Type	Required	Description
`data`	HookPointListDto	yes

HookPointSummaryDto

Property	Type	Required	Description
`declaration`	HookPointDeclarationDto	yes
`serviceName`	string	yes	The workload that declares the point.
`withdrawn`	boolean	yes	True once the owner no longer declares it.

HookReentryDeclarationDto

Property	Type	Required	Description
`maxDepth`	number	yes	Maximum enclosing evaluations of the point on one synchronous lineage.

HookRespondDeclarationDto

Property	Type	Required	Description
`maxResponseBytes`	number	yes	Maximum bytes of one response (UTF-8 JSON).
`responseSchemaId`	string	yes	The owner-named schema a response must satisfy.

HookScopeRefusalCode

Type: one of "required-binding-suppressed", "unknown-binding-suppressed"

HookScopeRefusalDto

Property	Type	Required	Description
`bindingId`	string	yes
`code`	HookScopeRefusalCode	yes
`space`	string	yes	The suppressing Space, as its canonical `xema://` URI.

HookScopeRefusedProblemDto

RFC 9457 problem document of a hook binding route. Extension members stay top-level and open, as on ProblemDetailsDto.

Property	Type	Required	Description
`actionableBy`	ProblemActionableBy	no	Who can act on this refusal: `user` (correct the input, sign in), `org-admin` (an administrator of the organisation), `platform` (the operators of this installation), `none` (nobody — it cannot succeed). ABSENT when not known; never guessed.
`code`	one of `"HOOK_SCOPE_REFUSED"`	yes	SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.
`detail`	string	no	Human-readable and specific to THIS occurrence.
`errors`	array of ProblemFieldIssueDto	no	Field-level issues, when the refusal is about the request body.
`instance`	string	no	URI reference identifying the occurrence — a request path, a run, a row.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for the message keyed by `code` — typed and allowlisted per code by its declaration. Never server-authored copy, never internal diagnostics.
`refusals`	array of HookScopeRefusalDto	yes
`retry`	ProblemRetry	no	What a retry can achieve: `transient` (later, unchanged), `after-change` (only after someone changes something), `never` (a defect until a fixed version ships). ABSENT when not known.
`status`	number	yes	The HTTP status code, repeated in the body so a logged document is self-contained.
`title`	string	yes	Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`.
`traceId`	string	no	W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not.
`type`	string	yes	Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`.

OrgRoleForbiddenProblemDto

RFC 9457 problem document of an org-role refusal. Extension members stay top-level and open, as on ProblemDetailsDto.

Property	Type	Required	Description
`actionableBy`	ProblemActionableBy	no	Who can act on this refusal: `user` (correct the input, sign in), `org-admin` (an administrator of the organisation), `platform` (the operators of this installation), `none` (nobody — it cannot succeed). ABSENT when not known; never guessed.
`code`	one of `"ORG_ROLE_NOT_PERMITTED"`	yes	SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.
`detail`	string	no	Human-readable and specific to THIS occurrence.
`errors`	array of ProblemFieldIssueDto	no	Field-level issues, when the refusal is about the request body.
`instance`	string	no	URI reference identifying the occurrence — a request path, a run, a row.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for the message keyed by `code` — typed and allowlisted per code by its declaration. Never server-authored copy, never internal diagnostics.
`retry`	ProblemRetry	no	What a retry can achieve: `transient` (later, unchanged), `after-change` (only after someone changes something), `never` (a defect until a fixed version ships). ABSENT when not known.
`status`	number	yes	The HTTP status code, repeated in the body so a logged document is self-contained.
`title`	string	yes	Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`.
`traceId`	string	no	W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not.
`type`	string	yes	Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`.

ProblemActionableBy

Who can act on this refusal: user (correct the input, sign in), org-admin (an administrator of the organisation), platform (the operators of this installation), none (nobody — it cannot succeed). ABSENT when not known; never guessed.

Type: one of "user", "org-admin", "platform", "none"

ProblemDetailsDto

RFC 9457 problem document. The declared members are the reserved core; extension members are TOP-LEVEL and OPEN, owned by the refusing plane.

Property	Type	Required	Description
`actionableBy`	ProblemActionableBy	no	Who can act on this refusal: `user` (correct the input, sign in), `org-admin` (an administrator of the organisation), `platform` (the operators of this installation), `none` (nobody — it cannot succeed). ABSENT when not known; never guessed.
`code`	string	yes	SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name.
`detail`	string	no	Human-readable and specific to THIS occurrence.
`errors`	array of ProblemFieldIssueDto	no	Field-level issues, when the refusal is about the request body.
`instance`	string	no	URI reference identifying the occurrence — a request path, a run, a row.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for the message keyed by `code` — typed and allowlisted per code by its declaration. Never server-authored copy, never internal diagnostics.
`retry`	ProblemRetry	no	What a retry can achieve: `transient` (later, unchanged), `after-change` (only after someone changes something), `never` (a defect until a fixed version ships). ABSENT when not known.
`status`	number	yes	The HTTP status code, repeated in the body so a logged document is self-contained.
`title`	string	yes	Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`.
`traceId`	string	no	W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not.
`type`	string	yes	Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`.

ProblemFieldIssueDto

Property	Type	Required	Description
`code`	string	no	SCREAMING_SNAKE_CASE code of THIS issue, for a frontend i18n key. Present when the issue was minted by a declared problem.
`detail`	string	yes	Prose for logs and developers. A frontend localises from `code` + `params` instead.
`params`	map of string or number or boolean	no	Safe i18n interpolation values for this issue's `code`.
`pointer`	string	yes	RFC 6901 JSON Pointer into the request body. Root is "/".

ProblemRetry

What a retry can achieve: transient (later, unchanged), after-change (only after someone changes something), never (a defect until a fixed version ships). ABSENT when not known.

Type: one of "transient", "after-change", "never"

ProviderBindingNotReadyReasonDto

Property	Type	Required	Description
`code`	one of `"output-mapping-invalid"`, `"output-schema-root-not-object"`, `"capability-output-schema-missing"`, `"capability-missing"`, `"provider-config-invalid"`, `"operation-missing"`, `"operation-not-declarative"`, `"operation-effect-exceeds-capability"`	yes
`issues`	array of ProviderBindingOutputMappingIssueDto	no	For `output-mapping-invalid`: the mapping issues against the CURRENT outputSchema.

ProviderBindingOutputMappingIssueDto

Property	Type	Required	Description
`code`	one of `"target-undeclared"`, `"target-duplicate"`, `"target-overlap"`, `"required-uncovered"`, `"type-incompatible"`, `"enum-incompatible"`, `"each-target-not-array"`, `"unmappable-schema"`	yes
`entryPath`	array of string or number	yes	Path inside the mapping document.
`message`	string	yes
`pointer`	string	yes	The offending target pointer.

ProviderBindingReadinessDto

Property	Type	Required	Description
`reasons`	array of ProviderBindingNotReadyReasonDto	yes
`state`	one of `"ready"`, `"not-ready"`	yes

RemoveRequiredHookBindingDto

Property	Type	Required	Description
`reason`	string	yes	Why a REQUIRED binding is being removed. Recorded in the audit journal.

SpaceKind

The tier the binding is resolved FOR. Resolution walks UP from here, so a requirement declared at project is satisfied by an org binding. system, app and session are refused at the service seam: the first is a deployment invariant no tenant can act on, and the other two are runtime containers a binding must not outlive.

Type: one of "system", "org", "project", "app", "session", "biome", "user"

SpaceRefDto

Property	Type	Required	Description
`appId`	string	no
`biomeId`	string	no
`classification`	DataClassification	no
`orgId`	string	no
`path`	string	no	The canonical `xema://` URI of this Space. Always present on a response; it is the value a `space` query parameter takes. Optional on a request.
`projectId`	string	no
`sessionId`	string	no
`tier`	SpaceKind	yes
`userId`	string	no

SubjectKind

Type: string (12 values)

SubjectRefDto

Property	Type	Required	Description
`id`	string	yes
`kind`	SubjectKind	yes

UpdateCapabilityProviderBindingDto

Property	Type	Required	Description
`credentialBindingId`	string	no
`isDefault`	boolean	no
`providerConfig`	object	no
`providerKind`	one of `"model_modality"`, `"http_endpoint"`, `"worker"`, `"integration"`, `"platform_service"`	no
`targetCapabilities`	array of string	no	Capabilities the binding's target needs of its own to serve the ref (e.g. `credential:resolve@1` for a connector operation that reads its connection's credential). A delegated caller lends them separately and the target is lent exactly these. Empty ⇒ the target needs nothing.