There is no public base URL. A call uses the host serving this draft. Opening this panel does not create a token.

A session is the imma_session cookie or an Authorization Bearer session token. Agent bearer tokens are refused on customer and inventory writes. Health checks need no session.

The organization comes from the session. An organization id sent by the client is ignored.

A cookie session that writes must send the header x-imma-request with the value 1. A bearer session does not use that header. GET does not require it.

GET customers needs customers.read. POST customers needs customers.write. POST inventory needs inventory.adjust, held only by owner and admin. Library routes need a session. Agent capabilities need an agent token and return scopes only.

POST /api/v1/inventory repeats a count when the same idempotencyKey and the same content are sent again. A reused key with different content returns 409. Customer creation has no idempotency key.

Recovery allows 3 requests an hour for an address and does not say if it exists. Agent jobs stop at 30 an hour for that token. Other mounted routes have no HTTP rate limit.

No mounted route registers or receives callbacks. Signature checks exist in the server domain and are not opened by this button.

Issuing a service token and revoking one require an authenticated owner or admin and stay inside that organization. This header does not issue, show, or revoke a token. Rotation is not implemented.

POST /api/v1/agent/jobs is mounted for an agent token with jobs.write. The example bearer is synthetic and is not a live key. This panel does not create a token.

• GET /api/health · Database check. No session. No connection string.
• GET /api/v1/health · Database check and disabled flags. No session.
• GET /api/v1/openapi · Machine document. Incomplete. See the gap above.
• GET /api/v1/customers · Lists customers of the session organization.
• POST /api/v1/customers · Creates a customer. Fields code and name. organizationId in the body is ignored.
• POST /api/v1/inventory · Count adjustment. Fields warehouseId, productId, countedQty, date, idempotencyKey. Example values below are synthetic.
• GET /api/v1/library/search · Query q. Offline library. Not an operative statute.
• GET /api/v1/library/citation · Query q and optional locale. A miss returns the error code.
• GET /api/v1/library/coverage · Coverage counts. Not a legal clearance.
• GET /api/v1/agent/capabilities · Returns the scopes of the calling agent token. It does not mint one.
• GET /api/v1/agent/jobs · Enqueue a local job for an agent token with jobs.write. Quota is 30 an hour. A session token is refused.
• POST /api/v1/agent/jobs · Enqueue a local job for an agent token with jobs.write. Quota is 30 an hour. A session token is refused.

Synthetic example. Not a live credential.

SYNTHETIC
Authorization: Bearer imma_sess_EXAMPLE
x-imma-request: 1
{"code":"C-EXAMPLE","name":"Example","organizationId":"ignored"}
{"warehouseId":"00000000-0000-0000-0000-000000000000","productId":"00000000-0000-0000-0000-000000000000","countedQty":"1","date":"2026-11-08","idempotencyKey":"example-count-1"}