Published API
What this company allows to leave it, and who may come and get it. Nothing is reachable from outside until somebody publishes it: one screen, its columns and the rows of it that may travel. Software is then registered, given a key, granted specific exposures and pinned to the addresses it may be used from. The same publication serves a REST API, an OpenAPI document generated per key, and an MCP server for an AI agent.
12 steps · 10 questions · 6 screens on this shelf
The screens on this shelf
Workspace
API Studio
One board for the whole of the published API: what is exposed, who holds a key, what each key could not actually do, and every call made in the last few days with the reason for each refusal.
Open
Records
Exposures
A decision, taken once, that one screen may leave this company — which columns of it, which rows of it, and whether anything may be written back. Nothing is reachable from outside until it is published here, and there is no "publish everything".
Open
Records
API Clients
The outside software that holds a key to this company. Every call it makes runs as a named user here, so nothing it can reach is anything that user could not already reach. The key is shown once when it is issued and never again.
Open
Records
API Grants
Which software may reach which exposure, and with which verbs. Two partners can hold keys to this company and reach entirely different data; withdrawing one changes nothing for the other.
Open
Records
Allowed Software
Where a key may be presented from: a browser origin, a host, an address or a network. A key that requires an allowlist and has no entries reaches nothing — "no addresses named" reads as "not reachable yet", never as "anywhere".
Open
Records
API Call Log
Every call made with an API key, allowed or refused, with the reason for each refusal. This is not the audit log — that records what the record actually did, because a published call goes through the ordinary route and the ordinary route audits itself. This records what was asked, from where, and by which key.
Open
Progress is kept in this browser only — it is not sent anywhere and nobody else can see it.