REST API

The Manifest REST API serves the designer UI and external integrators under /api on each instance's own host (https://<instance>.manifest-ontology.co.za/api; the UI is served from the same origin). Every endpoint sends the same commands and queries the MCP agent surface dispatches — there is no REST-only capability and no agent-only capability.

The OpenAPI contract

• Document: GET /openapi/v1.json — the full machine contract: every endpoint, its real request and response shapes, and the security scheme. This is what client generators should consume.
• Interactive docs: /scalar — a browsable reference over the same document (enabled in development and staging; off in production).
• The document is also generated at build time into a committed snapshot, so contract drift is caught in CI, not by consumers.

Conventions

• Authentication is Authlink bearer tokens (the UI uses a cookie-backed login flow through the API's auth endpoints). Unauthenticated requests answer 401.
• Enums cross the wire by name in both directions ("Ontology", not 1) — positions are unstable across versions; names are the contract.
• Errors are RFC 7807 ProblemDetails. Domain and validation failures map to structured problem responses with stable error codes.
• Reason-required actions expect the X-Manifest-Reason header. A missing or too-short reason answers a structured challenge naming the requirement — supply the reason and retry.

Health

Endpoint	Answers
GET /health/live	Is the process serving? No dependency probes.
GET /health/ready	Full readiness: Postgres, hydrated registry, Service Bus, Authlink PDP.

SDK

A generated client SDK (from the OpenAPI document) is part of the platform; see the repository's docs/sdk notes for generation details.