HTTP API overview

Use registered routes and credential contracts; OpenAPI is a candidate reference.

• Anonymous catalog: GET /api/open/v1/catalog/models
• Anonymous readiness: GET /api/open/v1/capabilities
• PAYG model calls: /api/open/v1/models/{id}/chat or /anthropic for supported profiles
• Standard compatibility: /v1/models, /v1/chat/completions, /v1/messages only after the shared gate passes
• Console own-account funds: /api/distribution/api-credit/balance, /bills/page, /usage/page, /bills/export, /usage/export
• Own order: /api/consumer/orders/{orderId}; checkout callbacks do not prove fulfillment

Member/business OAuth routes and open pool-3 routes differ; changing a token does not change the funding pool. Agent Run, signing, evidence and media require their own source/scopes/price/delivery gates. Legacy Bench, Session and Workspace prototypes are excluded from formal open navigation.

For pool-3 text, the effective max_tokens is a positive integer no greater than 1,048,576, and a lower configured model limit takes precedence. Omitted or zero max_tokens uses the model's output budget, then its maximum, with a 1,024 fallback; the same frozen limit bounds provider output and the reservation estimate. max_completion_tokens is unsupported; use max_tokens. Pool-3 supports one completion (n=1). When supplied, thinking.budget_tokens must be a finite, nonnegative integer no greater than the effective max_tokens; quoted numbers are rejected. The complete reservation estimate must remain an exact integer no greater than 9,007,199,254,740,991 (2^53−1). Member entitlement budgets retain their own contract.

The candidate Go text routes accept JSON bodies up to 32 MiB. The effective request limit is the minimum of Go, nginx/proxy and the selected upstream's limits; deployment configuration can impose a lower ceiling. This source contract does not prove that these changes are enabled in production.

Catalog profiles retain physical UUIDs and each profile's wire_format, compat_profile, effective capabilities and chat_runtime_supported. Choose the exact profile for the required wire and operation. The top-level capabilities describe only capabilities_profile_id (the first profile); they do not grant identical capabilities to every profile. pricing_status reports TEXT_OUTPUT, IMAGE and SECOND separately; only ready with an explicit valid price is eligible. Missing or unknown status is not ready, and a zero price requires the explicit free contract. Capability readiness does not replace real provider acceptance.

The candidate IMAGE flow generates one image and requires a canonical UUID Idempotency-Key. Reuse that key for the same request; a different payload conflicts. A 503 with taskId holds back the image URL/base64 while execution or settlement remains unresolved. Query GET /api/open/v1/models/{id}/images/tasks/{taskId} with the original owner and API key; model withdrawal does not block recovery of that original task. Never switch keys to retry an unknown provider execution.

UNKNOWN_IMAGE_V1 freezes a 24-hour platform responsibility deadline, checked against Java's original reservation time. After recovery cannot determine a result within that deadline, image_unknown_resolved releases the customer hold, retains UNKNOWN evidence, and still returns 503 when no artifact is available; it does not invent zero usage or call the provider again. A genuine late artifact is released only after the real IMAGE quantity-1 event is acknowledged with zero customer charge and the platform bearing the contractual cost; the original UNKNOWN remains. Confirmed rejection with a real release acknowledgment returns 400 failed. Java's imageUnknownReady is a prerequisite of the IMAGE financial capability, not a provider availability claim. These are candidate contracts, pending separate production enablement and real supplier acceptance.