API Specification

Fetched live from the acceptance API, so it always shows what the service declares right now. Test Request calls acceptance and never production, on purpose.

113 of 131 operations are described. The remaining 18 are the /v1/m2m surface, pending #214; until then they are listed in openapi/pending.json and documented on API Endpoints. A backend test (src/openapi/coverage.test.ts) fails when a served operation is neither described nor pending, and the pending list may only shrink.

Two security schemes are declared: bearerAuth, a Keycloak-issued JWT that applies by default, and mediaAggregatorKey, which the media-aggregator search requires only when the service is configured with a key. The document is linted with Spectral against the NL API Design Rules 2.2.1 ruleset, with its deviations recorded rather than hidden: nlgov:semver is off because releases are CalVer, and the problem-details rules are off because the API answers its own { success, error } envelope rather than application/problem+json.

For versioning, the response envelope and error handling, see API Design.