listings

Operations of the Xema Store API. Paths are relative to your deployment's API host.

GET /api/xema-store-api/listings

List catalog rows (paginated).

Filters by scope/orgId/trustTier/free-text. Gated on store:biome.list@1.

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/xema-store-api/listings

Create a new listing.

Admin / first-party authoring entry point. Gated on store:biome.submit@1; the per-version submission endpoint enforces the same ref. The publisher org (and, for scope = org, the owning org) is taken from the authenticated caller — it is not accepted from the body.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json CreateStoreListingDto

GET /api/xema-store-api/listings/{id}

Get a single listing.

Authentication: bearer token (Authorization: Bearer <token>)

PATCH /api/xema-store-api/listings/{id}

Update listing metadata (displayName / description).

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json UpdateStoreListingDto

POST /api/xema-store-api/listings/{id}/archive

Soft-archive a listing and its non-archived versions.

Authentication: bearer token (Authorization: Bearer <token>)

GET /api/xema-store-api/listings/{id}/versions

List versions of a listing.

Authentication: bearer token (Authorization: Bearer <token>)

GET /api/xema-store-api/listings/{id}/versions/{version}

Get a single version (includes the frozen manifest snapshot + permission digest).

Authentication: bearer token (Authorization: Bearer <token>)