Substratal Apps Substratal Apps Hub specs
GitHub

Docs 00-shared/API-SCREEN-MAP.csv

API → screen map

All 118 operations of the Substratal Apps Platform API and the screens that call them (100 % covered). Screen IDs link to the screen specs.

Download CSV
methodpathsummaryscreens
GET/v1/healthHealth checkGLB-03
POST/v1/auth/signupCreate an account with email and passwordAUTH-03
POST/v1/auth/loginExchange email and password for a session (or an MFA challenge)AUTH-01
POST/v1/auth/mfa/verifyComplete a login that returned an MFA challengeAUTH-02
POST/v1/auth/token/refreshRotate a platform refresh token for a new access tokenGLB-03
POST/v1/auth/logoutRevoke the current session, or every sessionACC-01 GLB-03
POST/v1/auth/app-tokensMint a per-app JWT from a platform session (embedded login)APP-03
POST/v1/auth/oauth/authorization-codesMint a one-time authorization code for a hosted launch (PKCE)APP-03
POST/v1/auth/oauth/tokenExchange an authorization code or app refresh token for an app token(called by the launched Application, not the Hub; see APP-03)
POST/v1/auth/email/verifyConfirm an email address from an emailed tokenAUTH-04
POST/v1/auth/email/verify/resendRe-send a verification email (always 202)AUTH-04
POST/v1/auth/password/forgotSend a password-reset email (always 202)AUTH-05
POST/v1/auth/password/resetSet a new password from a reset token (revokes every session)AUTH-06
POST/v1/auth/invitations/acceptSet a password on an invited account, activate it, and sign inAUTH-07
POST/v1/auth/sso/{provider}/callbackComplete an SSO login (reserved — 501 until the broker integration ships)AUTH-01
POST/v1/users/{id}/passwordChange password given the current one (self only)ACC-03
POST/v1/users/{id}/mfa/totpBegin TOTP enrollment (self only)ACC-05
DELETE/v1/users/{id}/mfa/totpSupport reset of a user's TOTP (requires users.manage)USR-03
POST/v1/users/{id}/mfa/totp/confirmConfirm TOTP enrollment with a first code; returns recovery codes onceACC-05
POST/v1/users/{id}/mfa/totp/disableTurn TOTP off given a current code or recovery code (self only)ACC-06
GET/v1/users/{id}/sessionsList active sessions (self or users.manage)ACC-04 USR-04
DELETE/v1/users/{id}/sessions/{sessionId}Revoke one sessionACC-04 USR-04
GET/v1/usersList or search usersUSR-01 NTF-06 GLB-01
POST/v1/usersCreate (invite) a userUSR-02
GET/v1/users/{id}Fetch one userACC-01 ACC-04 APP-01 USR-03
PATCH/v1/users/{id}Update email (self, pending verification) or status (users.manage)ACC-02 USR-03
DELETE/v1/users/{id}Soft-delete a user (self or users.manage)USR-03
POST/v1/users/{id}/suspendSuspend a user (users.manage)USR-05
POST/v1/users/{id}/invitationRe-send the invitation email to an invited user (users.manage)USR-03
GET/v1/users/{id}/exportExport everything this API holds about this userACC-07 USR-03
POST/v1/users/{id}/erasure-requestsRequest right-to-erasure (soft-delete now, hard-delete cascade in 7 days)ACC-08
DELETE/v1/users/{id}/erasure-requests/currentCancel a scheduled erasure inside its 7-day window (users.manage)USR-03
GET/v1/users/{id}/profileFetch global ProfileACC-01 USR-03
PATCH/v1/users/{id}/profileUpdate global Profile (self or users.manage)ACC-01
GET/v1/users/{id}/settingsFetch global Settings (self, or platform users.list)SET-01 NTF-03
PATCH/v1/users/{id}/settingsUpdate global Settings (self or users.manage)SET-01
GET/v1/users/{id}/apps/{appId}/profileFetch per-app AppProfile (self, the app's own key, or platform users.list; defaults if none written yet)APP-04
PATCH/v1/users/{id}/apps/{appId}/profileUpdate per-app AppProfile (custom is merged one level; null removes a key)APP-04
GET/v1/users/{id}/apps/{appId}/settingsFetch fully resolved per-app settings (self, the app's own key, or platform users.list)SET-02 SET-01
PATCH/v1/users/{id}/apps/{appId}/settingsWrite per-app overrides (validated against settings_schema; null clears)SET-02 SET-01
GET/v1/applicationsList the catalog (filtered by visibility rules)APP-01 ACX-01 APL-01 BIL-01 NTF-01
POST/v1/applicationsRegister an Application (applications.manage)APL-02
GET/v1/applications/{id}Fetch one ApplicationAPP-02 SET-02 APL-03
PATCH/v1/applications/{id}Update a catalog entry (owner — configuration; applications.manage — anything)APL-03 APL-04 APL-05 APL-06
GET/v1/users/{id}/entitlementsA user's entitlements, personal and org-sourcedAPP-01 APP-05 ACX-01
POST/v1/users/{id}/entitlementsGrant a personal EntitlementACX-02
GET/v1/entitlementsList entitlements across users (entitlements.manage or the Application's owner; app keys and owners confined)ACX-05
GET/v1/entitlements/{id}Fetch one entitlementACX-03
PATCH/v1/entitlements/{id}The toggle: change status, term, source (trial→purchase), order_id, or an org grant's member scopeORG-06 ORG-07 ACX-01 ACX-03
DELETE/v1/entitlements/{id}Hard-remove a grant made in error (no order_id, under 24 hours old)ACX-01
GET/v1/permissionsList every Permission key the caller can seeROL-01 ROL-02
GET/v1/rolesList RolesROL-01
POST/v1/rolesDefine a RoleROL-03
GET/v1/roles/{id}Fetch one RoleROL-02
PATCH/v1/roles/{id}Change a Role's permissions or descriptionROL-02
DELETE/v1/roles/{id}Delete an unassigned, non-seed RoleROL-02
GET/v1/users/{id}/rolesList a user's Role assignments (including implicit default_app_role)ROL-04
POST/v1/users/{id}/roles/{roleId}Assign a Role (idempotent — 200 if already held)ROL-04
DELETE/v1/users/{id}/roles/{roleId}Remove a Role assignment (idempotent)ROL-04
GET/v1/users/{id}/apps/{appId}/effective-permissionsThe live access check (always 200)APP-02 ACX-04
GET/v1/organizationsList your Organizations (all, with organizations.manage)APP-01 ORG-01
POST/v1/organizationsCreate an Organization (any active User; caller becomes org_admin)ORG-02
GET/v1/organizations/{id}Fetch one OrganizationORG-03
PATCH/v1/organizations/{id}Rename (org admin), or suspend/reactivate (organizations.manage)ORG-08
GET/v1/organizations/{id}/membersList membersORG-03 BIL-02
POST/v1/organizations/{id}/membersInvite a member by email (org admin), or add one directly by user_id (organizations.manage)ORG-04
POST/v1/organizations/{id}/members/me/acceptAccept a pending membership (the invited User's own token)ORG-09
PATCH/v1/organizations/{id}/members/{userId}Change a member's roleORG-05
DELETE/v1/organizations/{id}/members/{userId}Remove a member or withdraw an invitation; or leave or decline (userId = me)ORG-05 ORG-08 ORG-09
GET/v1/organizations/{id}/entitlementsList org-wide (seat) grantsORG-06
POST/v1/organizations/{id}/entitlementsGrant an app to the whole OrganizationORG-07
GET/v1/tenantsList Tenants (your own; all with tenants.manage)BIL-04
GET/v1/tenants/{id}Fetch one TenantBIL-04
GET/v1/tenants/{id}/tier-change-requestsList tier-change requests for a TenantBIL-04
POST/v1/tenants/{id}/tier-change-requestsOpen a tier-change request on a customer's behalf (tenants.manage)BIL-04
GET/v1/tenants/{id}/tier-change-requests/{requestId}Fetch one tier-change requestBIL-04
PATCH/v1/tenants/{id}/tier-change-requests/{requestId}Schedule, start, complete, or cancel a tier-change request (tenants.manage)BIL-04
GET/v1/users/{id}/subscriptionA User's plan, what covers it, and their own subscription (self or billing.manage)USR-03 BIL-01
POST/v1/users/me/billing/checkout-sessionsStart a Stripe Checkout to subscribe yourself to Standard (User token)BIL-03
POST/v1/users/me/billing/portal-sessionsOpen the Stripe Customer Portal for your own subscription (User token)BIL-03
GET/v1/organizations/{id}/subscriptionAn Organization's plan and Standard subscription (org admin or billing.manage)BIL-02
PATCH/v1/organizations/{id}/subscriptionChoose which members the Organization's subscription covers (org admin)BIL-02
POST/v1/organizations/{id}/billing/checkout-sessionsStart a Stripe Checkout to subscribe the Organization to Standard (org admin, User token)BIL-03
POST/v1/organizations/{id}/billing/portal-sessionsOpen the Stripe Customer Portal for the Organization's subscription (org admin or billing.manage, User token)BIL-03
GET/v1/audit-eventsQuery the audit log (hot window only)KEY-04 AUD-01
GET/v1/audit-events/{id}Fetch one Audit EventAUD-02
GET/v1/webhooksList subscriptions visible to the callerWHK-01
POST/v1/webhooksSubscribe a URL to event typesWHK-02
GET/v1/webhooks/{id}Fetch one subscriptionWHK-03
PATCH/v1/webhooks/{id}Change url, events, description, api_version, or re-enableWHK-02
DELETE/v1/webhooks/{id}UnsubscribeWHK-03
POST/v1/webhooks/{id}/rotate-secretIssue a new signing secret (24-hour overlap)WHK-03
POST/v1/webhooks/{id}/testSend a webhook.test event nowWHK-03
GET/v1/webhooks/{id}/deliveriesRecent delivery attempts (30-day log)WHK-03
POST/v1/webhooks/{id}/deliveries/{deliveryId}/redeliverRe-send one past event (same event id)WHK-03
GET/v1/applications/{id}/push-credentialsList the push providers an Application has configured (the owner, the app's own key, or applications.manage)APL-07
POST/v1/applications/{id}/push-credentialsConfigure one push provider (the owner or applications.manage, User token only)APL-07
GET/v1/applications/{id}/push-credentials/{provider}Fetch one provider's configurationAPL-07
PATCH/v1/applications/{id}/push-credentials/{provider}Replace key material, change non-secret fields, or re-enable a failed credential (User token only)APL-07
DELETE/v1/applications/{id}/push-credentials/{provider}Remove a push provider (User token only)APL-07
GET/v1/users/{id}/devicesList a User's push devices (self, the app's own key, or users.list)NTF-03 NTF-05
POST/v1/users/{id}/devicesRegister a push device, or refresh an existing registration (self or the app's own key)NTF-04
GET/v1/users/{id}/devices/{deviceId}Fetch one deviceNTF-05
PATCH/v1/users/{id}/devices/{deviceId}Update a device's name, app version, environment, or rotated token (self or the app's own key)NTF-03 NTF-04
DELETE/v1/users/{id}/devices/{deviceId}Unregister a device (self, the app's own key, or users.manage)NTF-03 NTF-05
POST/v1/users/{id}/devices/{deviceId}/testSend a test push to one device and wait for the provider's answer (self or the app's own key)NTF-03
GET/v1/users/{id}/notificationsList a User's notification inbox (self, the app's own key, or users.list)NTF-01 NTF-05
POST/v1/users/{id}/notificationsSend one notification to one User (the app's own key with notifications.send, or platform notifications.send)NTF-06
GET/v1/users/{id}/notifications/unread-countCount unread notifications, in total and per Application (self or the app's own key)APP-01 NTF-01 GLB-03
POST/v1/users/{id}/notifications/mark-readMark every unread notification matching the filters as read (self or the app's own key)NTF-01
GET/v1/users/{id}/notifications/{notificationId}Fetch one notification, with its per-device deliveriesNTF-02 NTF-05
PATCH/v1/users/{id}/notifications/{notificationId}Mark one notification read, unread, or archived (self or the app's own key)NTF-01 NTF-02
GET/v1/api-keysList keys the caller may manageKEY-01
POST/v1/api-keysCreate a key (api_keys.manage, or the Application's owner for an app-scoped key)KEY-02
GET/v1/api-keys/{id}Fetch one key (never the secret)KEY-04
PATCH/v1/api-keys/{id}Change name, permissions, or restrict_destructiveKEY-04
DELETE/v1/api-keys/{id}Revoke permanentlyKEY-04
POST/v1/api-keys/{id}/rotateIssue a new secret, invalidating the old one immediately (no overlap)KEY-04