API Overview

Implemented

71 REST endpoints plus query-only GraphQL, mounted in services/api/app/main.py. Browser traffic goes through /api/sita. OpenAPI is off in production.

Framework01 05 06 09

Why these boundaries

Geometry/viewer reads are separated from graph serialisation so the 3D client is not forced through a full project dump.

Decision writes are structured so HITL cannot be a boolean on a session row.

Project/model identity is the first argument on almost every new route because Phase 0 had none.

Public

GET /health only.

Clerk JWT

require_request_context.

Operator

SITA_OPERATOR_USER_IDS; others get 404.