Reference
REST API resource catalog
The route families mounted under the CALIBER management API, grouped by the domains developers actually integrate with.
This page is the domain map for the CALIBER management API. It answers "where does this capability live?" before you drop into per-route details.
Platform and bootstrap
| Route family | Purpose |
|---|---|
/health, /readiness | Liveness and dependency posture |
/auth, /csrf, /me | Authentication, token/session plumbing, caller identity |
/capabilities, /openapi.json, /settings | Surface discovery, stability metadata, runtime configuration |
/dashboard/summary | Overview aggregates used by the UI |
Authoring and runtime assets
| Route family | Purpose |
|---|---|
/prompts | Prompt registry, aliases, versions, and refinement-related authoring |
/tools | Tool registry, tests, calibration, and policy |
/skills | Skill registry, versions, packaging, tests, and calibration |
/mcp-servers | Managed MCP definitions, inventories, connection tests, and governed tool invocation |
/workflows, /workflow-components, /workflow-templates | Workflow registry, composition, and templates |
/workflow-versions, /workflow-runs, /workflows/{id}/deployments | Version lifecycle, execution, approvals, and deployment |
/services and /workflows/{id}/service | Publish a workflow as an external HTTP service, invoke it, and inspect service tokens/OpenAPI |
/workflow-files, /workflow-cron-preview, /workflow-promotions, /workflow-benchmark-reports | Run-workspace files, schedule preview, promotion approval/rejection, and benchmark reports |
/agents | Agent records that verification items, refinement jobs, and approvals hang off |
/openapi-integrations | Governed import of external OpenAPI contracts: pinned snapshots, operation classification, dependency detection, curated tool drafts, and publication into the tool registry |
Data, knowledge, and evidence
| Route family | Purpose |
|---|---|
/projects and project file routes | Workspace/project inventory, effective access metadata, membership management, and managed file registry |
/object-store/* | Raw bucket/object storage operations |
/knowledge-bases, /knowledge-base-versions, /knowledge/query | RAG corpora, versions, graph state, and retrieval |
/eval-datasets | Datasets, examples, trace import, sync, and restore |
/evaluations | Scored evaluation runs |
/judges | Model-backed graders and alignment |
/review-queues | Human review queues and adjudication outputs |
/verification-queue | Stage ① Verify: manually-flagged concerns, list/create/verify/dismiss/mark-duplicate/batch. Does not create a refinement job — see the SDK reference |
/knowledge-runs/{id}/events | Live build-progress events for a knowledge-base run |
/playground-runs/{id}/files | Files produced by an ad-hoc playground run |
/memory | Long-term agent memory: add, search, list, and delete, always scoped by agent/user/run |
Operations and governance
| Route family | Purpose |
|---|---|
/jobs | Durable background jobs, apply targets, request-changes (send a candidate_ready job back for another pass), and quality-reviews (a human go/no-go on the candidate, distinct from the machine eval gate) |
/rework-tasks and /projects/{id}/rework-tasks | Owned, recoverable work auto-created when a refinement job is terminally rejected: list/get/claim/resolve/reassign; project routes enforce workspace visibility and role policy |
/releases | Candidates, evaluation, waivers, signoff, reporting, and reconcile operations |
/rollback | Shared rollback helpers where an asset family exposes them |
/observability/*, /metrics, /events/stream | Traces, experiments, metrics, and SSE |
/audit-log | Read-only audit explorer and export |
/gateway/* and /llm-pricing | Gateway discovery, guardrails, usage, and pricing overrides |
/system/services, /system/incidents, /system/effects, /system/webhook-dead-letters | Runtime health and operational recovery surfaces |
/gate-verdicts/{artifact_type}/{version_key} | Version-addressable advisory evaluation-gate verdicts read before a promotion |
/secrets | Write-only secret references and lifecycle |
Assistant and agentic surfaces
| Route family | Purpose |
|---|---|
/assistant/* | Session-based assistant interactions, drafts, queue, and attachments |
/aria/plans, /aria/interactions, /aria/capabilities | Goal-plan decomposition, approval, execution, polling, and human questions |
/cookbooks | Cookbook catalog and installation |
How this maps to the SDK
The SDK guide and SDK API reference wrap the same route families above with typed models, error translation, automatic CSRF handling, and polling helpers. The SDK docs should explain the Python abstraction; this page is the raw route inventory.
Project access routes
Project responses include the caller's effective access_role and a sorted permissions list. The membership endpoints return members objects with the member id, user id, role, active status, and audit timestamps:
| Route | Purpose | Required project role |
|---|---|---|
GET /projects/{project_id}/members | List active members | any visible member |
POST /projects/{project_id}/members | Add or reactivate a member | owner |
PATCH /projects/{project_id}/members/{user_id} | Change role or status | owner |
DELETE /projects/{project_id}/members/{user_id} | Deactivate a member | owner |
Project roles are owner, editor, reviewer, and viewer. These roles are project-level decisions; the caller's bearer-token scope remains a separate global ceiling.