The REST API and its OpenAPI spec
Where the v1 REST API's OpenAPI document lives, how it is generated from the shipped code, and why it can never claim an endpoint that does not exist.
TENSOR's tenant-scoped REST API lives under /api/v1/{tenant}/… and authenticates
with Personal Access Tokens (Settings → API tokens): send the token as a
Bearer header; the token's scopes are intersected with your live permissions on
every request. Errors follow RFC 7807 (application/problem+json).
The machine-readable spec
The API describes itself at:
GET /api/v1/openapi.jsonThis returns an OpenAPI 3.1 document listing every shipped v1 path, its methods, path parameters, and the PAT bearer security scheme. The endpoint is unauthenticated — it is documentation, and contains no tenant data.
Why it stays honest
The document is not hand-written. It is generated from the deployed route tree itself, committed to the repository, and a merge-blocking check fails any change that would leave the spec claiming a path or method the code no longer ships. In other words: if it is in the spec, it exists. (New endpoints may briefly ship ahead of the spec; they are picked up on the next regeneration.)
Schema-level request/response detail is being layered on per endpoint as the REST surface grows; the paths and security model above are stable.
Sealed reports render read-only
Why opening a historical compliance report never re-generates it, and what the content hash on the report page is for.
SAP transport auto-sync — and why drift is recorded, not blocked
How a SAP transport request becomes a change in TENSOR, what the auto-create switch does, and why TENSOR records a mismatch instead of stopping SAP.