What The API Does
The Leo King API is a business astrology intelligence layer: deterministic chart compute, relationship scoring, helio StarTypes background, audience intelligence, world signals, and premium AI experiences.
Build deterministic astrology infrastructure, premium AI experiences, dating-app intelligence, audience scoring, and Beyond The Veil world-signal workflows from one API surface. Start with server-to-server REST, OpenAPI, SDK source, async jobs, and usage-aware billing.
Major API docs make the shortest successful path obvious. This is the buyer-ready loop: workspace plan, scoped server key, low-cost first request, and request_id evidence.
Open billing, create or select the customer workspace, and choose Core Compute or higher before issuing live keys.
Generate a server-side key for only the endpoint families the product needs. Keep paid keys out of browsers and mobile apps.
Start with the no-AI natal chart route. It proves auth, idempotency, envelope shape, credits, and trace headers with low spend.
Check the console or buyer-path smoke for the exact request_id so billing, support, and procurement evidence match.
https://api.theleokingai.comUse the dedicated gateway for production apps, generated clients, Postman, and partner handoff docs.
/api/v1/openapiGenerate clients, validate payloads, inspect auth, and review endpoint metadata from the machine contract.
/api/v1/postmanImport the public collection with baseUrl and apiKey variables before partner implementation review.
sdk/node + sdk/pythonUse typed source now; package publication stays gated by SDK build, docs, and release approval.
Make the first server-side request with x-api-key, Idempotency-Key, and the standard request envelope.
Review every public route, plan gate, request shape, response shape, credits, and tool function.
Use the machine-readable contract for generated clients, validation, integration review, and AI-agent context.
Start from the Node and Python SDK source until npm and PyPI package publication is approved.
Run the live smoke that verifies auth, usage, credits, models, and Convex usage rows by request id.
Inspect security controls, data handling, subprocessors, observability, and onboarding proof like an enterprise buyer.
Review what is public today and what still requires signed enterprise terms: long-range audit packages, allowlists, and private contracts.
https://api.theleokingai.comCurrent production API host with clean /v1 routing.
https://theleokingai.com/apiBackward-compatible website host for existing alpha integrations.
http://localhost:3000/apiLocal Next.js development server.
The pro API standard is predictable integration behavior: versioned routes, scoped auth, retry-safe billing, traceable envelopes, and explicit output-quality failure states.
Public route names stay stable while alpha response fields continue to harden.
Keys are scoped by endpoint and validated through env-backed records or Convex.
Retry-safe usage and billing records are part of the public contract.
429 responses include limit details and rate-limit headers when limiter metadata is present.
Paid responses expose stable trace and version headers, and use no-store caching.
Every success response carries tracing, billing, and runtime metadata.
Errors are support-ready; unexpected server failures use sanitized public messages.
Fallback-looking or incomplete AI output is a failed response, not a successful billable result.
These docs are organized like a real developer platform: what the API is, how to connect, how to choose no-AI versus AI workflows, how async jobs work, what realtime is not yet, and which tools support production integration.
The Leo King API is a business astrology intelligence layer: deterministic chart compute, relationship scoring, helio StarTypes background, audience intelligence, world signals, and premium AI experiences.
The platform separates owned astrology math from model-backed interpretation. Partners can run no-AI infrastructure at scale, then add AI only where users pay for synthesis, forecasts, or finished experiences.
v1 is not a WebRTC/video SDK or a raw websocket agent stream. It is a server-to-server API with OpenAPI, SDK source, async jobs, usage metering, and a roadmap for partner callbacks and realtime products.
Partners should not have to guess how to integrate. The v1 platform supports REST calls, OpenAPI, SDK source, private console testing, and async jobs. Webhooks, streaming, WebSocket, and WebRTC are documented as explicit roadmap or non-v1 lanes so expectations stay clean.
Server-side product integrations, backend jobs, app features, and partner workflows.
POST JSON to /api/v1 routes with x-api-key and Idempotency-Key headers.
/v1/charts/natal/v1/charts/current-sky/v1/audience/insights/v1/experiences/love-revealGenerated clients, endpoint discovery, schema review, and AI-agent-readable integration context.
Fetch /api/v1/openapi and generate your preferred client or validation layer.
/v1/openapi/v1Teams that want typed helpers while the public packages are prepared.
Use sdk/node or sdk/python from the repo; preserve usage metadata in responses.
sdk/nodesdk/pythonTrying endpoints, inspecting payloads, testing helio/chart/world/experience routes, seeing credit behavior, and reviewing key audit events.
Use the customer console for keys, usage, audit trail, and plan state; use the API Lab for chatbot-style endpoint testing.
/api-console/api-console/labDeep forecasts and longer AI work where the partner app should not block a user request.
Create a job, store the job id, poll the status URL, and bill only after a complete quality-gated result.
/v1/world/signals/jobs/v1/world/signals/jobs/{jobId}Production callbacks for job completion, billing events, quality failures, and long-running reports.
Internal queue and drain worker sign callbacks now; partner-facing activation still needs endpoint approval, Convex deploy, and delivery smoke.
job.completedjob.failedusage.recordedGood integrations start with the right workflow. Choose no-AI compute for infrastructure, AI Intelligence for paid synthesis, async jobs for deep forecasts, and hybrid patterns for dating apps or other products that need both scale and premium reveals.
Return deterministic chart facts, compatibility scores, transits, or helio background data.
Collect birth data or event timing.
Call the core endpoint from your backend.
Cache the deterministic payload for repeated use.
Use the output to power matching, filters, badges, dashboards, or timing rules.
/v1/charts/natal/v1/charts/current-sky/v1/charts/transits/v1/lunar/phase/v1/compatibility/score/v1/helio/patternsReturn display-ready interpretation, guidance, prediction, campaign advice, or a premium spiritual product.
Start with a deterministic substrate when the endpoint needs chart context.
Call the AI route only for a paid or high-value moment.
Require quality gates before showing or billing output.
Store usage credits, provider, model, tokens, and request_id.
/v1/audience/insights/v1/experiences/future-partner-vision/v1/experiences/crystal-ballRun deep world-signal work without blocking the app request.
Create a forecast job with topic, window, and depth.
Show queued/running status in the partner app.
Poll the status URL until complete or failed.
Charge only after a complete quality-gated forecast is stored.
/v1/world/signals/jobs/v1/world/signals/jobs/{jobId}Use no-AI compute for match ranking and AI for premium reveal products.
Create a profile substrate from natal and optional helio background routes.
Precompute synastry and compatibility across candidate pairs.
Rank matches without AI spend.
Offer Love Reveal or Future Partner Vision as paid unlocks.
/v1/charts/synastry/v1/compatibility/score/v1/experiences/love-revealEvery request is server-to-server, authenticated with `x-api-key`, and tracked only after successful work. Use `Idempotency-Key` for retry-safe usage and billing records.
curl https://api.theleokingai.com/v1/charts/natal \
-X POST \
-H "Content-Type: application/json" \
-H "x-api-key: $LEOKING_API_KEY" \
-H "Idempotency-Key: natal-subject-123-2026-06-17" \
-d '{
"subject": {
"id": "subject_123",
"dob": "1990-07-23",
"tob": "14:30",
"pob": "New York, US"
}
}'const response = await fetch("https://api.theleokingai.com/v1/world/signals", {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-api-key": process.env.LEOKING_API_KEY!,
"Idempotency-Key": "world-signals-markets-2026-06-17"
},
body: JSON.stringify({
topic: "markets",
window_days: 14,
depth: "deep"
})
});
if (!response.ok) {
throw new Error(await response.text());
}
const payload = await response.json();# Create an async deep forecast job
curl https://api.theleokingai.com/v1/world/signals/jobs \
-X POST \
-H "Content-Type: application/json" \
-H "x-api-key: $LEOKING_API_KEY" \
-H "Idempotency-Key: world-signals-markets-2026-06-17" \
-d '{"topic":"markets","window_days":14,"depth":"deep"}'
# Poll until data.status is complete or failed
curl https://api.theleokingai.com/v1/world/signals/jobs/$JOB_ID \
-H "x-api-key: $LEOKING_API_KEY"A production-ready API is not proven by a pretty docs page. Before selling or demoing the buyer path, run the smoke that calls the live API with a real scoped key and confirms Convex recorded the usage row.
A real scoped key can call the production API from a server-side request.
POST /v1/charts/natal returns core credits and no token usage.
POST /v1/customer/profile returns AI credits, model, and positive token totals.
The smoke reads production usageEvents and matches the exact request_id after each call.
Console usage, billing economics, and docs are backed by the same ledger the API writes.
# Core/no-AI production proof on the dedicated gateway
npm run smoke:buyer-path -- --base-url https://api.theleokingai.com --output inference-smoke/buyer-path-gateway-core-YYYYMMDD.json
# Required paid-route contract on the dedicated gateway
npm run smoke:paid-routes -- --base-url https://api.theleokingai.com --output inference-smoke/paid-route-contract-YYYYMMDD.json
# The smoke fails unless the live API response and Convex usageEvents row match
# by request_id, endpoint, usage.lane, credits, billableUnits, model, and AI token totals.The profitable way to build on this API is not to call AI for everything. Core Compute should power high-volume infrastructure. AI Intelligence should be reserved for paid, display-ready experiences, business recommendations, and forecasts where the customer sees premium value.
Use this when your product needs scale, repeatability, chart facts, scores, or background profile data without paying for generated language on every request.
/v1/charts/natal/v1/charts/current-sky/v1/charts/transits/v1/charts/synastry/v1/lunar/phase/v1/compatibility/score/v1/helio/patternsUse this when the customer is paying for interpretation, recommendation, prediction, synthesis, story, coaching, or a finished feature your partner can display.
/v1/audience/insights/v1/experiences/future-partner-vision/v1/experiences/love-reveal/v1/world/signalsA dating app should not call a model every time it sorts a match stack. It should use Core Compute for profile substrate, pair scoring, and compatibility labels, then call AI only when the user asks for a deeper connection story, future-partner vision, or paid relationship explanation.
/v1/charts/natal/v1/helio/patternsUser enters birth date, time, and place. The app stores a normalized profile, natal chart payload, chart quality, and optional StarTypes background.
Only if the app wants profile copy, generate a short display bio or onboarding insight after the deterministic profile exists.
/v1/charts/synastry/v1/compatibility/scoreThe backend scores many possible pairs with synastry and compatibility routes, then ranks candidates by chemistry, partnership, intimacy, and risk flags.
No AI is required for normal ranking. Save AI for the user-selected match or a paid unlock.
/v1/compatibility/score/v1/experiences/love-revealShow score bands, strongest contacts, caution flags, and relationship categories from structured JSON.
Generate a readable connection summary only when the user opens a deeper explanation.
/v1/experiences/future-partner-vision/v1/experiences/love-revealUse the stored core scores to decide whether the reveal should be offered and what category it belongs to.
Generate Future Partner Vision, Love Reveal, or a cinematic compatibility read as the paid moment.
/v1/charts/current-sky/v1/charts/transits/v1/lunar/phase/v1/timing/windows/v1/audience/insightsUse timing windows and transits to schedule non-generated prompts, match reminders, and relationship check-ins.
Generate personalized notification copy only for high-value campaigns or subscription features.
Call Core Compute for chart facts, transit substrate, compatibility score, or helio background signal.
Cache the deterministic output in the partner app because the same request can power many screens.
Let the partner choose when a customer action deserves AI interpretation or a premium reveal.
Call the AI route, enforce quality gates, and return display-ready output only after success.
Expose `usage.lane`, credits, model, and tokens so the partner understands margin on every feature.
Every strong partner pitch should show the lower-cost deterministic route, the premium AI upgrade, and why the split makes the product easier to price.
Turns astrology into a matching layer: richer onboarding, better pair ranking, explainable chemistry, and premium reveal moments beyond a basic swipe interface.
Collect birth data once, precompute profile and pair scores, cache the results, then call AI only when the user asks for a paid relationship explanation or future-partner product.
Run synastry and compatibility scoring across many candidate pairs without model spend.
/v1/charts/synastry/v1/compatibility/scoreUnlock Future Partner Vision or Love Reveal only when the user taps a premium reveal.
/v1/experiences/future-partner-vision/v1/experiences/love-revealThe app can rank matches with lower-cost compute, then charge for a cinematic relationship product.
Helps creators and brands decide who should receive an offer, when to send it, and what angle should make the message feel personal.
Use core compute during signup or list import, store the segment metadata, then call AI during campaign planning instead of on every page view.
Calculate core profiles once, cache the chart basis, and segment the audience without generated copy.
/v1/charts/natal/v1/helio/patternsCall Audience Intelligence when a real campaign, offer, or send/no-send decision needs interpretation.
/v1/audience/insights/v1/timing/windowsThe partner avoids wasting AI credits on every subscriber while still selling smarter timing and messaging.
Gives editorial teams a repeatable world-signal workflow: verified astrology context first, then premium forecasts when a topic deserves a full read.
Run core ephemeris checks on a schedule, tag topics and windows, then use async AI jobs for deep subscriber reports or sponsor-grade briefs.
Use transits and mundane ephemeris context as the verified substrate for scheduled editorial planning.
/v1/charts/current-sky/v1/charts/transits/v1/lunar/phaseUse World Signals or async jobs for deep BTV-style forecasts, citations, analogs, and watch windows.
/v1/world/signals/v1/world/signals/jobs/v1/mundane/analyze-eventThe newsroom separates factual astrology context from high-value narrative intelligence.
Lets an app support daily utility, personal reflection, and premium spiritual experiences without making every session a costly AI call.
Use core routes for daily context, saved profiles, and lightweight personalization, then meter AI for paid readings, reveals, and generated guidance.
Use deterministic daily chart context, compatibility scores, tarot draws, or StarTypes background profile data.
/v1/charts/natal/v1/charts/current-sky/v1/lunar/phase/v1/helio/patternsOffer Oracle Ask, Crystal Ball, Past-Life Reading, or Daily Horoscope as metered premium experiences.
/v1/oracle/ask/v1/experiences/crystal-ball/v1/past-life/reading/v1/horoscope/dailyThe app can support free or low-cost utility while reserving AI spend for paid moments.
curl https://api.theleokingai.com/v1/compatibility/score \
-X POST \
-H "Content-Type: application/json" \
-H "x-api-key: $LEOKING_API_KEY" \
-H "Idempotency-Key: match-person-a-person-b-core-v1" \
-d '{
"subject": { "id": "person_a", "dob": "1990-07-23", "tob": "14:30", "pob": "New York, US" },
"partner": { "id": "person_b", "dob": "1992-11-08", "tob": "09:15", "pob": "Los Angeles, US" },
"context": { "relationship_type": "dating" },
"include_helio_background": false
}'
# Response shape to expect
# usage: { "lane": "core", "credits": 4, "billableUnits": 1 }
# tokens: not presentcurl https://api.theleokingai.com/v1/experiences/love-reveal \
-X POST \
-H "Content-Type: application/json" \
-H "x-api-key: $LEOKING_API_KEY" \
-H "Idempotency-Key: match-person-a-person-b-reveal-v1" \
-d '{
"question": "What is the real potential in this connection?",
"subject": { "id": "person_a", "dob": "1990-07-23" },
"context": {
"relationship_status": "new connection",
"desired_tone": "direct, premium, grounded"
}
}'
# Response shape to expect
# usage: { "lane": "ai", "credits": 5, "tokens": { "input": 1430, "output": 720 } }
# quality gates: required before billing is recordedThe current API is not a realtime media stack. v1 uses REST, async jobs, and polling. Partner callbacks, server-sent streaming, WebSocket, and WebRTC are separate product lanes with different infrastructure, billing, latency, and SDK requirements.
| Mode | Status | Use In This API |
|---|---|---|
| REST request/response | Live | Default v1 integration path for charts, intelligence, experiences, and knowledge routes. |
| Async jobs + polling | Live | Use for World Signals and longer-running AI reports. |
| Partner webhooks/callbacks | Release gate | Internal queue, signed delivery worker, retry, and dead-letter storage exist behind ops auth. |
| Server-sent streaming | Roadmap | Potential fit for long text generation, progressive forecasts, and API Lab responses. |
| WebSocket | Not v1 | Only needed if we ship live bidirectional chat sessions or streaming agent state. |
| WebRTC | Not v1 | Only needed for real-time voice/video/spatial sessions; this API is not a Telnyx/Tavus-style media transport today. |
If a partner wants a live AI companion, voice session, video avatar, or two-way streaming interface, that should become a separate realtime SDK/API product. The current business API should stay reliable: authenticated REST, async jobs, strict quality gates, and usage records that protect margin.
Developer docs should give teams a working loop: create a key, inspect OpenAPI, run a test request, check readiness, review usage, and debug errors. These are the tool surfaces for that loop.
/api-consoleManage keys, plan state, credit pools, endpoint access, audit trail, and organization billing.
/api-console/labRun real endpoints from a chatbot-style interface and inspect request/response JSON.
/api/v1/openapiMachine-readable endpoint contract for generated clients and agent-readable docs.
/api/v1Lightweight route catalog for discovery and integration checks.
/api/v1/statusPublic non-secret status component inventory for discovery and partner review.
/api/v1/slaPublished SLA targets, support boundaries, incident policy, and monitoring status.
/api/v1/incidentsPublic incident ledger and reporting policy for partner-impacting production issues.
/api/v1/securityPublic controls, data handling boundaries, subprocessor scope, and enterprise review notes.
/api/v1/access-controlAPI-key custody, scopes, environment boundaries, lifecycle, browser/CORS policy, and allowlist gates.
/.well-known/security.txtWell-known security contact and policy discovery for vulnerability reporting.
/api/v1/observabilityGateway smoke, env gate, buyer-path usage proof, readiness, and AI output-quality signals.
/api/v1/onboardingServer-key setup, first request, retry handling, usage proof, launch-readiness gates, handoff artifacts, and support packet guidance.
/api/v1/versioningCompatibility guarantees, deprecation windows, sunset rules, and rate-limit behavior.
/api/v1/migrationsLegacy alias moves, deprecation artifacts, before/after route guidance, and validation checks.
/api/v1/procurementBuyer-review checklist, legal/security/ops boundaries, signed-term gates, and durable trust links.
/api/v1/conformanceAcceptance suites, smoke commands, launch gates, pass criteria, and evidence artifacts.
/api/v1/data-processingProcessing purposes, minimization rules, restricted-data list, DSR policy, and DPA boundaries.
/api/v1/complianceFramework-style control mapping, public evidence artifacts, certification boundaries, and signed-term gates.
/api/v1/ai-governanceAcceptable-use boundaries, prohibited and restricted use cases, output-quality controls, human review, and escalation triggers.
/api/v1/examplesPublic request/response payloads, SDK snippets, and partner workflow recipes.
/api/v1/supportPublic support tiers, severity routing, required support packet, and enterprise escalation boundaries.
/api/v1/sdksPackage names, source paths, install commands, helper surface, generated-client policy, and release gates.
/api/v1/changelogPublic release notes for current docs work, alpha foundation, and next enterprise gates.
/api/v1/webhooksSigned callback contract plus release-gated worker, retry, and dead-letter behavior.
/api/v1/errorsSupport-grade error codes, retry behavior, partner actions, and escalation signals.
/api/v1/postmanImportable Postman collection generated from the public v1 endpoint catalog.
/api/v1/ops/readiness?deep=1Internal production health checks for auth, billing, usage logging, AI provider, and sidecars.
sdk/node + sdk/pythonTyped client source for Node and Python before public package release.
Major APIs make their platform state easy to inspect without a sales call. These public JSON surfaces give developers and AI coding tools the current status map, release history, and release-gated webhook contract.
/api/v1/statusComponent inventory, readiness boundary, and integration status.
/api/v1/slaAvailability targets, support boundaries, measurement state, and enterprise caveats.
/api/v1/incidentsIncident ledger, severity policy, public fields, and postmortem expectations.
/api/v1/securityControls, data handling boundaries, subprocessor scope, and enterprise review notes.
/api/v1/access-controlKey custody, scopes, environment boundaries, lifecycle, browser/CORS policy, and allowlist gates.
/.well-known/security.txtWell-known vulnerability contact, policy, canonical URL, and expiration metadata.
/api/v1/observabilityProduction env gate, gateway smoke, buyer-path proof, readiness, and output-quality signals.
/api/v1/onboardingServer-key setup, first request, retry handling, usage proof, launch-readiness gates, handoff artifacts, and support packet guidance.
/api/v1/versioningCompatibility guarantees, deprecation windows, sunset rules, and rate-limit behavior.
/api/v1/migrationsLegacy alias moves, deprecation artifacts, before/after route guidance, and validation checks.
/api/v1/procurementBuyer-review checklist, legal/security/ops boundaries, signed-term gates, and durable trust links.
/api/v1/conformanceAcceptance suites, smoke commands, launch gates, pass criteria, and evidence artifacts.
/api/v1/data-processingProcessing purposes, minimization rules, restricted-data list, DSR policy, and DPA boundaries.
/api/v1/complianceFramework-style mappings, public evidence artifacts, certification boundaries, and signed-term gates.
/api/v1/ai-governanceAcceptable-use boundaries, prohibited and restricted use cases, output-quality controls, human review, and escalation triggers.
/api/v1/examplesPublic request/response payloads, SDK snippets, and partner workflow recipes.
/api/v1/supportSupport tiers, severity routing, support packet requirements, and enterprise escalation boundaries.
/api/v1/sdksPackage names, install commands, helper surfaces, generated-client policy, and release gates.
/api/v1/changelogVersion history, current docs release, and next build gates.
/api/v1/webhooksSigned callback events, payload fields, idempotency, and retry policy.
/api/v1/errorsSupport-grade error codes, retry behavior, and partner actions.
/api/v1/postmanImportable API collection with baseUrl and apiKey variables.
Vulnerability reporting discovery is available at /.well-known/security.txt. The published contact is mailto:partners@theleokingai.com, and the canonical policy points back to the API security packet.
https://theleokingai.com/.well-known/security.txthttps://theleokingai.com/api/v1/securityenEnterprise buyers need the review packet before a custom deal moves forward. The public packet exposes what is ready for review, what needs partner evidence, and which commitments require signed terms.
Public procurement metadata is available at /api/v1/procurement. Reviewers should use these durable links instead of screenshots.
| Category | Owner | Requirement | Evidence |
|---|---|---|---|
Security Controls live | platform | Publish API-key handling, data minimization, rate-limit, and no-fallback-success controls. | Security packet exposes public controls and partner expectations. |
Data Handling live | shared | Review retention boundaries and restrict support packets to sanitized operational evidence. | Security and support routes publish data-retention categories plus never-include fields. |
Compliance Mapping live | shared | Map public controls to common enterprise review categories without claiming certifications that are not published. | Compliance map identifies current evidence, framework-style mappings, and signed-term boundaries. |
AI Governance live | shared | Review generated-output quality gates, acceptable-use boundaries, restricted use cases, and escalation triggers before production launch. | AI governance packet defines allowed, restricted, prohibited, human-review, and support-evidence boundaries. |
Subprocessor Review beta | platform | Expose current infrastructure, auth, billing, model, sidecar, rate-limit, and monitoring subprocessors. | Security packet lists current subprocessors and the data scope for each. |
SLA And Incidents live | platform | Publish current availability targets, measurement boundary, incident fields, and postmortem policy. | SLA and incidents routes expose public targets and current incident history status. |
Versioning And Migration live | platform | Document compatibility guarantees, breaking-change artifacts, migration guides, and sunset requirements. | Versioning and migrations routes publish lifecycle policy and route-specific migration guides. |
Operational Proof beta | shared | Run env gate, gateway smoke, buyer-path usage proof, and AI output-quality sampling before launch. | Observability route and onboarding route publish production proof requirements. |
Legal Terms enterprise | shared | Move DPA, custom retention, dedicated support, allowlists, and contractual SLA into signed terms. | Procurement packet identifies what public metadata does and does not contractually promise. |
Public metadata does not create a contractual SLA, DPA, or custom retention obligation.
Private readiness, env values, raw logs, raw prompts, and raw customer payloads require authenticated/internal process.
Production-ready APIs need an acceptance contract. These suites define what must pass before SDK release, enterprise review, custom limits, production launch, or a claim that AI output quality is healthy.
Public conformance metadata is available at /api/v1/conformance. Passing local tests is only one part of production readiness.
| Suite | Owner | Command | Proves |
|---|---|---|---|
Local Contract Suite live | platform | npm run test -- --run tests/api-v1.test.ts tests/api-reference-docs.test.ts tests/robots.test.ts tests/api-gateway-config.test.ts tests/sdk-contract.test.ts | Public API metadata, docs discovery, gateway rewrites, and SDK helpers agree before deploy. |
API Reference Discovery live | platform | npm run smoke:api-reference -- --base-url https://api.theleokingai.com | Every documented endpoint has parseable examples, stable reference links, SDK snippets where shipped, and matching discovery coverage across examples, Postman, OpenAPI, and docs. |
SDK Source And Dist live | platform | npm run smoke:sdk-release -- --skip-live | SDK public metadata helpers, authenticated route helpers, webhook helpers, package metadata, Python import behavior, and generated Node dist compile. |
Production Build live | platform | npm run build | The app compiles, route handlers type-check, and static public metadata routes are generated. |
Production Env Gate live | platform | npm run prod:env:production | Required production env surfaces exist before push/deploy and Clerk JWT template is configured. |
Dedicated Gateway Smoke live | platform | npm run smoke:api-gateway -- --mode final | Dedicated gateway DNS, root JSON, OpenAPI, Postman, status, and docs discovery work in production. |
Buyer Path Usage Smoke beta | shared | npm run smoke:paid-routes -- --base-url https://api.theleokingai.com --output inference-smoke/paid-route-contract-YYYYMMDD.json | A scoped key can call one Core Compute route and one AI Intelligence route, and each exact request_id appears in the usage ledger. |
GitHub Production Release Gate live | platform | GitHub Actions > API Production Release Gate | Production API readiness claims have a durable CI artifact with Core/no-AI, AI, and Convex usageEvents proof. |
AI Output Quality Sampling beta | shared | Inspect 1-3 fresh live outputs created after the deploy timestamp. | AI value quality is preserved, not merely that status codes and pipelines succeeded. |
Keep smoke outputs, request_id, endpoint, UTC timestamp, key prefix only, commit SHA, deployment URL, and sanitized payload shape for support and procurement review.
Enterprise review needs a clear answer to what data is processed, why it is processed, what should never be sent, and when a signed DPA is required. The public packet keeps that boundary explicit.
Public data-processing metadata is available at /api/v1/data-processing. The packet does not replace signed customer-specific DPA terms.
| Category | Status | Data | Partner Responsibility |
|---|---|---|---|
Core Astrology Compute Calculate deterministic chart, transit, compatibility, lunar, and helio background data for partner products. | beta | partner subject id, birth date, birth time when supplied, birth place or coordinates, event datetime/location | Store only the deterministic output needed for the product and avoid sending unrelated identity fields. |
AI Intelligence And Experiences Generate audience intelligence, premium spiritual experiences, oracle/tarot interpretation, and world-signal analysis. | beta | partner customer id, campaign context, route-specific prompt/context, generated output, model/provider metadata | Do not send private prompts, sensitive personal data, or regulated data unless the signed use case permits it. |
Billing And Entitlement Meter credits, plan state, scoped key access, request rate, subscription state, and usage reconciliation. | beta | organization id, API key hash/prefix, endpoint, credits, billing lane, subscription state, request_id | Never send payment card or bank account data to API routes or support channels. |
Support, Incident, And Conformance Evidence Triage integration issues, incidents, output-quality regressions, conformance evidence, and procurement review. | live | request_id, endpoint, UTC timestamp, key prefix only, idempotency key hash, sanitized payload shape, deployment metadata | Redact raw payloads, secrets, payment details, and complete birth data unless a signed support process requires them. |
Deletion/export requests should start from the partner system of record. Platform-side deletion/export assistance requires request_id, partner subject id, organization id, and signed support process when private payloads are involved.
Enterprise reviewers need a control map, but the API should not overclaim certifications. This section maps public evidence to common review categories while keeping SOC 2 reports, DPAs, regulated-data commitments, and private audit artifacts behind signed terms.
Public compliance metadata is available at /api/v1/compliance. This is a readiness map, not a certification report.
| Review Area | Status | Controls | Boundary |
|---|---|---|---|
SOC 2-Style Security Review Security, confidentiality, access control, change evidence, and incident review areas. | live | server-side API-key custody, scoped endpoint access, secret redaction boundaries, support packet minimization | Public docs are readiness evidence; formal SOC 2 report access requires separate availability and signed review terms. |
SOC 2-Style Availability Review Gateway availability, status publication, operational smoke, and support escalation readiness. | beta | public SLA targets, incident history policy, gateway smoke, production env gate | Contractual availability targets require signed customer terms and dedicated monitoring. |
GDPR/Data Processing Review Readiness Processing purposes, data minimization, restricted data, retention, subprocessors, and DSR support. | live | published processing purposes, restricted-data list, data-minimization rules, subprocessor scope | Public packet does not create a DPA, residency promise, or regulated-data authorization. |
OWASP API Security Review Readiness Authentication, authorization, rate limiting, input validation, error handling, and secret exposure boundaries. | beta | x-api-key auth, endpoint scope checks, rate-limit policy, standard error envelope | Custom network controls, mTLS-style controls, and allowlists require signed enterprise terms. |
Enterprise Procurement And Vendor Risk Buyer packet, legal/security/ops review, signed-term gates, support boundaries, and durable evidence links. | live | buyer packet, review checklist, legal boundary, operational proof | Public metadata accelerates vendor review but is not a master services agreement, DPA, or security exhibit. |
AI Output Quality Governance Generation quality, fallback prevention, output sampling, model/provider metadata, and incident escalation. | beta | no fallback success rule, fresh live output sampling, quality-gate failure handling, model/token visibility | Passing builds and HTTP status checks do not prove AI product quality. |
This public packet is a readiness and evidence map only. It does not claim SOC 2 or ISO 27001 certification, HIPAA or PCI eligibility, GDPR compliance determination, or regulated-data approval unless those artifacts are separately published in signed customer review materials.
Use these public artifacts as durable starting points. Private reports, raw logs, raw payloads, and customer-specific controls stay out of public docs.
| Artifact | Owner | Review Use | Public Link |
|---|---|---|---|
Security Packet Security controls, retention policy, subprocessor scope, security.txt, and enterprise review notes. | platform | Security and confidentiality review starter evidence. | /api/v1/security |
Access-Control Packet API-key custody, scope model, environment separation, rotation, revocation, and allowlist boundary. | shared | Authentication, authorization, and key-management review. | /api/v1/access-control |
Data-Processing Packet Processing purposes, minimization, restricted data, DSR policy, retention, subprocessors, and DPA boundary. | shared | Privacy, data-processing, and DPA scoping review. | /api/v1/data-processing |
Conformance Contract Local contract tests, SDK build, app build, env gate, gateway smoke, buyer-path proof, and AI quality sampling. | platform | Production readiness and acceptance evidence. | /api/v1/conformance |
Observability Proof Gateway smoke, production env gates, buyer-path proof, readiness boundary, and output-quality signals. | platform | Operational readiness and smoke-evidence review. | /api/v1/observability |
SLA And Incident Policy Availability targets, measurement boundary, incident fields, severity policy, and postmortem expectations. | platform | Availability and resilience review. | /api/v1/sla |
Procurement Packet Buyer checklist, legal/security/ops boundaries, signed-term gates, and durable trust links. | shared | Vendor-risk and legal handoff review. | /api/v1/procurement |
Model-backed API products need acceptable-use boundaries that buyers can review before launch. This packet documents what partners may build, what needs signed review, what is prohibited, and when output quality must fail instead of publishing degraded content.
Public AI governance metadata is available at /api/v1/ai-governance. Route output is interpretive guidance unless signed terms say otherwise.
| Use Case | Allowed | Restricted | Prohibited |
|---|---|---|---|
Entertainment, Wellness, And Personal Insight beta | Horoscope, tarot, oracle, love, timing, compatibility, and spiritual-experience products with clear interpretive framing. | Sensitive relationship, crisis, addiction, grief, fertility, medical, legal, or financial claims require product review and may need signed terms. | Do not present output as diagnosis, guaranteed prophecy, emergency guidance, or factual certainty about a person's future. |
Audience Intelligence And Campaign Strategy beta | Segment-level campaign-fit, tone, timing, and creative-angle guidance for marketing teams. | Individual pricing, eligibility, employment, credit, insurance, housing, political persuasion, or sensitive profiling requires signed review and may be disallowed. | Do not use outputs as the sole basis for consequential decisions about a person or protected class. |
World Signals, Markets, And Public Research beta | Editorial, research, scenario planning, media analysis, trend monitoring, and strategic briefing workflows. | Trading, investment, insurance, legal, public safety, emergency, or policy decisions require independent review and signed customer terms. | Do not present forecasts as investment advice, legal advice, guaranteed outcomes, or emergency instructions. |
Core Astrology Compute live | Deterministic chart, transit, lunar, compatibility, synastry, and helio background calculation for partner products. | High-volume, regulated, minors, or sensitive personalization should be reviewed for data minimization and consent. | Do not infer protected traits, medical states, legal status, or eligibility from chart data. |
The API may support entertainment, media, wellness, relationship, audience-intelligence, timing, and world-signal workflows when partners present output as guidance or analysis, not deterministic fact, diagnosis, legal advice, financial instruction, or emergency direction.
Model-backed routes must satisfy route-specific schemas, required sections, metadata, and no-fallback-looking language before a response is treated as successful or billable.
High-impact, public, paid, regulated, crisis, or strategic decisions should include partner-side human review before output is published or acted upon.
| Control | Owner | Requirement | Evidence |
|---|---|---|---|
No Fallback Success live | platform | Fallback-looking, malformed, thin, missing-section, or placeholder output must fail instead of publishing as success. | /api/v1/conformance |
Route-Specific Quality Gates beta | platform | Generated output must satisfy the route's schema, required sections, product depth, model metadata, and route-specific constraints. | /api/v1/openapi |
Human Review Boundary live | partner | Partner reviewers should inspect output before publication, customer delivery, or operational use where reliance risk is meaningful. | /api/v1/ai-governance |
Restricted Use Escalation enterprise | shared | Move restricted workflows into signed review or decline the use case before production traffic. | /api/v1/procurement |
Transparent Support Evidence live | shared | Use request_id, endpoint, UTC timestamp, key prefix only, model/provider metadata, and sanitized payload/output shape. | /api/v1/support |
Data Minimization live | shared | Send only route-required data and keep secrets, payment data, regulated data, and unnecessary identifiers out of prompts and support evidence. | /api/v1/data-processing |
The current API version is v1. Route names, auth headers, envelopes, billing lanes, and idempotency behavior are compatibility-sensitive.
90 days for beta/public metadata routes; 180 days target for paid production routes once enterprise terms are signed.
Sliding window backed by Upstash Redis or Vercel marketplace Redis aliases. Limits are measured over 60 seconds per organization, key, endpoint, and plan limit..
RateLimit-LimitRateLimit-RemainingRateLimit-ResetRetry-AfterX-RateLimit-Reset-AtEnterprise limits can be raised by signed contract after traffic shape, endpoint mix, output quality risk, and provider budget are reviewed.
Public migration metadata is available at /api/v1/migrations. Breaking changes require documented artifacts before removal.
| Guide | Status | From | To |
|---|---|---|---|
| Move From Website API Host To Dedicated Gateway | live | https://theleokingai.com/api/v1/* | https://api.theleokingai.com/v1/* |
| Move Customer Profile Alias To Audience Insights | beta | POST /v1/customer/profile | POST /v1/audience/insights |
| Move Mundane Forecast Alias To World Signals | beta | POST /v1/mundane/forecast | POST /v1/world/signals or POST /v1/world/signals/jobs |
Breaking changes require a changelog entry, OpenAPI update, migration guide, support path, and the notice window defined in /api/v1/versioning before removal.
This is the public procurement packet: what is live, what partners must do, and what evidence backs each claim.
| Control | Status | Partner Expectation | Evidence |
|---|---|---|---|
| Server-Side API Keys | live | Store keys in a backend secret manager or server env. Never ship keys in browser, mobile, or client-side code. | Auth middleware rejects missing or invalid keys and public docs show backend-only usage examples. |
| Dedicated HTTPS Gateway | live | Pin production clients to the dedicated gateway and keep the legacy website host only for alpha compatibility. | Gateway DNS, OpenAPI servers, Postman baseUrl, SDK defaults, and gateway smoke all target the dedicated host. |
| Scoped Endpoint Access | beta | Request only the lanes and endpoints needed for the customer workflow. | API-key validation checks endpoint scope, organization status, key status, and credit limit before paid route execution. |
| Retry-Safe Usage Records | beta | Send stable idempotency keys for retries and include request_id in support tickets. | Buyer-path smoke verifies live response usage and Convex `usageEvents` rows by exact request_id. |
| No Fallback Success For AI Output | live | Treat `INVALID_RESPONSE` or `UPSTREAM_FAILED` as retry/escalation conditions instead of rendering degraded content. | Quality checks fail fallback phrases, missing sections, malformed schemas, and local path leaks before success. |
| Data Minimization | live | Avoid sending names, payment data, unrelated profile fields, or freeform PII unless a route explicitly requires it. | Docs and trust page publish the collection boundary; request schemas keep required fields narrow. |
| Rate Limits And Abuse Guard | beta | Use backoff on 429 responses and coordinate enterprise limits before load tests. | Production env gate requires `API_RATE_LIMIT_MODE=enforce` and Redis credentials for remote production traffic. |
| Enterprise Security Review | enterprise | Request contract review before regulated, high-volume, or custom-data deployments. | Public security packet identifies current controls, console audit visibility, and remaining signed-contract work without exposing secret config. |
`npm run prod:env:production` verifies required Vercel production env names before push/deploy.
Before every production deploy or config change.
`npm run smoke:api-gateway -- --mode final` verifies DNS, root JSON, status, OpenAPI, and Postman on api.theleokingai.com.
After gateway, OpenAPI, SDK, or docs deploys.
`npm run smoke:paid-routes` calls the live Core/no-AI and AI routes and confirms matching Convex usageEvents by request_id.
Before enterprise demos, after auth/billing/usage changes, and after production deploys that affect paid routes.
GET `/api/v1/ops/readiness?deep=1` checks provider env, usage logging, rate limits, sidecars, and AI provider state.
Before deploy and during incident triage.
Fresh live AI outputs must be inspected for required sections, metadata, depth, and no fallback-looking copy.
After any generation logic, prompt, RAG, model, or provider deploy.
GET `/api/v1/incidents` publishes partner-impacting incidents and reporting policy.
Within the public incident publication window after confirmed impact.
GET `/api/v1/errors` maps response codes to retry behavior, partner action, and support signals.
Reviewed with API contract changes.
Use `https://api.theleokingai.com` and `/v1/*` paths for new integrations.
OpenAPI, Postman, SDK examples, and gateway smoke all point to the dedicated gateway.
Generate a scoped API key from the customer console or approved internal smoke flow.
Keys are hashed/scoped by organization, endpoint access, and credit state before paid route execution.
Call `POST /v1/charts/natal` with `x-api-key`, `Idempotency-Key`, and a minimal subject payload.
Core endpoint should return `usage.lane = core`, credits, no token usage, and deterministic chart data.
Preserve idempotency keys across retries and branch on the public error catalog.
409, 429, 502, and 503 responses include partner action and support-ready request_id.
Run buyer-path smoke and confirm the Convex `usageEvents` row for the exact request_id.
Passing smoke proves response usage and billing ledger agree before a buyer demo.
For AI routes, inspect 1-3 fresh production outputs created after deploy.
Outputs must include required sections, model metadata, depth, no placeholder copy, and no fallback language.
Record request_id, endpoint, UTC timestamp, key prefix only, idempotency key hash, and sanitized payload shape.
Support can triage without raw secrets, complete private payloads, or payment data.
Move to signed terms for custom limits, private endpoints, allowlists, DPAs, audit exports, and dedicated incident contacts.
Enterprise terms are contract-specific and should not be assumed from public metadata.
| API Request Metadata | Do not include full secrets or raw payloads in support tickets; provide request_id and sanitized payload shape. |
| Birth Data Payloads | Use customer ids and only the birth fields needed for the route. Avoid names and unrelated personal profile data. |
| Generated AI Outputs | AI output must meet the same product contract after retries; fallback-shaped output should be escalated as a quality incident. |
| Billing And Entitlement Records | Payment instruments are handled by Clerk/Stripe rather than stored directly in this API surface. |
| Support Evidence | Never send raw API keys, bearer tokens, payment details, or complete private payloads in email or chat. |
| Raw Secrets | Rotate any exposed secret immediately and replace it with a managed environment variable. |
| Vercel | Next.js hosting, edge routing, logs, and deployment rollback. |
| Convex | API key validation, usage ledger, entitlement state, and billing/event records. |
| Clerk | Customer console authentication, organizations, billing state, and checkout integration. |
| Stripe | Payment processing through Clerk Billing and Stripe-connected checkout. |
| OpenAI Or RunPod | Model-backed generation for AI Intelligence routes when enabled by production config. |
| Render | Kerykeion sidecar hosting for deterministic astrology calculation. |
| Upstash | Distributed rate limit state and abuse protection. |
| Sentry | Error monitoring, release visibility, and source-map assisted debugging. |
Public onboarding metadata is available at /api/v1/onboarding. These gates define when an integration is ready for paid traffic, enterprise demo, or custom terms.
| Gate | Owner | Required Evidence | Blocker |
|---|---|---|---|
Dedicated Gateway Reachability live | platform | `npm run smoke:api-gateway -- --base-url https://api.theleokingai.com --final` passes and returns the current contractVersion. | Block launch if the dedicated gateway, OpenAPI, status, docs, or metadata aliases do not resolve through the public host. |
Partner Server Key Handling beta | shared | Partner confirms keys are stored server-side only, scoped to the expected organization/routes, and never shipped to browser/mobile clients. | Block production traffic if keys are exposed in client code, screenshots, support tickets, or analytics events. |
Usage Ledger Reconciliation beta | platform | Buyer-path smoke proves response `request_id`, usage lane, credits, and Convex usage event agree for the same call. | Block paid launch when usage response fields and ledger rows disagree or cannot be traced by request_id. |
AI Output Quality Sampling beta | shared | Inspect 1-3 fresh production AI outputs after deploy for required sections, model metadata, depth, and no fallback-looking copy. | Block publication or partner demo if output quality is unverified, generic, missing required sections, or fallback-looking. |
Support And Incident Drill live | shared | Partner can provide request_id, endpoint, UTC timestamp, key prefix only, idempotency hash, sanitized payload shape, and severity. | Block enterprise launch if support evidence requires raw secrets, complete private payloads, payment details, or a private DPA process that is not signed. |
Signed Enterprise Boundary enterprise | shared | Order form, DPA/addendum when applicable, custom SLA/support exhibit, limits, allowlists, and launch checklist are signed before custom commitments. | Do not promise custom retention, residency, allowlists, private endpoints, dedicated response windows, or audit export packages from public metadata alone. |
Gateway readiness, public metadata compatibility, OpenAPI freshness, and post-deploy release proof.
Include URL, status, contractVersion, deployment URL, commit SHA, and timestamps; do not include secrets or private payloads.
Mapping environments, server owners, endpoint scopes, expected volume, retry policy, and escalation contacts before traffic ramps.
Use role/team contacts and endpoint scopes; do not publish personal phone numbers, raw keys, or customer payload samples.
Confirming credits, lane, billable units, idempotency behavior, and ledger traceability before paid production use.
Use request_id, organization id, key prefix only, endpoint, credits, and timestamps; never expose key hashes or payment identifiers.
Proving generated-output routes meet product contract after deploy or generation-logic changes.
Use sanitized prompts/outputs or customer-approved examples; do not export complete private payloads without signed support terms.
Knowing how to pause keys, downgrade traffic, disable AI publication, roll back a deploy, and communicate incidents.
Include runbook names and owners; keep admin tokens, provider dashboards, and private incident contacts out of public packets.
Public support metadata is available at /api/v1/support. Signed response windows, dedicated contacts, audit exports, and allowlists require enterprise terms.
| Tier | Status | Audience | Response |
|---|---|---|---|
| Developer Metadata Support | live | Developers evaluating the public docs, OpenAPI, Postman, SDK source, examples, status, and errors catalog. | Best-effort while the API is in alpha. |
| Partner Beta Support | beta | Approved beta partners using scoped server-side keys and paid routes. | One business day for integration blockers; faster for production-impacting incidents. |
| Enterprise Contract Support | enterprise | Signed enterprise customers with custom limits, private terms, audit exports, or dedicated support windows. | Contract-specific after enterprise support terms are signed. |
Send only support-safe identifiers. Never include raw keys, webhook secrets, payment details, or full private payloads.
These targets are public review contracts, not a substitute for signed enterprise terms. External synthetic monitoring is the next ops gate.
| Target | Status | Availability | Measurement |
|---|---|---|---|
| Public Metadata Routes | live | Static/discovery routes should stay available with the marketing site and Vercel edge cache. | Validated by production smoke checks today; external synthetic monitoring is the next gate. |
| Core Compute Routes | beta | Production target is 99.5% for paid beta once sidecar probes and buyer-path smoke stay green. | Current route tests and production env gates exist; provider-side synthetic checks are still being added. |
| AI Intelligence Routes | beta | Production target is quality-preserved successful generation, not fallback-shaped continuity. | Fresh live outputs must satisfy required sections, metadata, depth, and quality gates after each generation-logic deploy. |
| Enterprise Contract SLA | enterprise | Negotiated per customer after dedicated monitoring, support window, limits, and escalation terms are signed. | Requires customer-specific probes, usage thresholds, incident comms, audit exports, and billing reconciliation. |
Public incidents recorded. Current history status is exposed at /api/v1/incidents.
Publish a public incident entry for confirmed partner-impacting production issues that last more than 15 minutes or affect billed output quality.
Public status is non-secret and safe for integration review. Deep provider readiness remains behind `x-ops-token` on the internal readiness route.
| Component | Status | Scope | Public Note |
|---|---|---|---|
| REST API Gateway | live | Server-to-server /api/v1 routes with API-key auth and standard envelopes. | Use https://api.theleokingai.com for clean /v1 production routing. The legacy https://theleokingai.com/api base remains backward compatible during alpha. |
| OpenAPI Contract | live | Machine-readable OpenAPI 3.1 contract for generated clients and review. | Public metadata routes are unauthenticated; paid routes require x-api-key. |
| Human Developer Docs | live | Discoverable docs page, quickstart, examples, endpoint reference, plans, and enterprise path. | Docs are the canonical human integration surface. |
| API Console And Lab | beta | Private console for keys, usage, billing, endpoint testing, workspace audit history, and paginated audit CSV export. | Console access is customer/workspace gated; signed audit export packages remain enterprise-contract work. |
| Core Compute | beta | No-AI chart, sky, transit, lunar, synastry, compatibility, and helio background routes. | Best for high-volume partner infrastructure where AI spend is not needed. |
| AI Intelligence | beta | Audience intelligence, premium experiences, oracle/tarot, horoscope, and world signals. | Fallback-looking AI output is treated as a failed product response. |
| Usage Ledger | beta | Request id, endpoint, credits, billing lane, model, token metadata, and idempotency tracking. | Run buyer-path smoke before live enterprise demos. |
| SDK Packages | release gate | Node and Python source exists; public npm/PyPI publication is still gated. | Use raw HTTP or source clients until package publication is approved and release smoke passes. |
| Partner Webhooks | release gate | Signed callbacks for async completion, usage, quality, billing, and entitlement events. | Partner-facing activation still requires approved endpoint configuration, Convex deployment, production env validation, and delivery smoke. |
| SLA And Incident History | live | Public SLA target and incident-history contract for discovery, procurement, and partner review. | Public targets are published now; external uptime monitoring and contractual enterprise SLA terms are the next ops gate. |
| Security And Trust Packet | live | Public security controls, well-known security contact, data handling boundaries, subprocessor notes, and enterprise review packet. | Public trust metadata plus console audit visibility/export are live beta; signed customer DPAs, audit export packages, and allowlists remain enterprise-contract work. |
| Access Control Packet | live | Public key custody, scope model, environment separation, rotation/revocation, browser boundary, and allowlist policy. | Server-side key custody is required today; IP allowlists, private endpoint terms, and custom network review remain signed enterprise work. |
| Observability Proof | beta | Gateway smoke, production env gates, buyer-path usage proof, readiness checks, and AI output quality sampling. | Public observability contract is live; automated external synthetic monitoring remains the next ops gate. |
| Buyer Onboarding | beta | Server-key setup, first request, idempotency, error handling, usage proof, launch-readiness gates, handoff artifacts, and escalation packet. | Self-serve docs are live; fully automated procurement and enterprise private onboarding remain sales-led, but launch evidence is now explicit. |
| Versioning And Limits | live | Public lifecycle, compatibility, deprecation, sunset, and rate-limit contract for v1 partners. | Standard rate-limit headers are now emitted on 429 responses when limiter metadata is available. |
| Migration Guides | live | Public route migration, deprecation artifact, legacy alias, validation, and partner checklist guidance. | No paid production route should be removed without a published migration guide, notice window, and support path. |
| Examples And Cookbooks | live | Public endpoint examples, SDK snippets, and partner workflow cookbooks generated from the API catalog. | Examples are safe to share publicly and should stay aligned with OpenAPI, Postman, SDKs, and endpoint reference pages. |
| Support And Escalation | live | Public support tiers, support packet requirements, severity routing, and enterprise escalation boundaries. | Public support metadata improves integration triage; contract-specific response windows require signed enterprise terms. |
| Procurement And Compliance Packet | live | Public buyer-review checklist, security/legal/ops review boundaries, signed-term gates, and durable trust links. | Public packet speeds enterprise review; DPA, custom retention, audit exports, allowlists, and contracted SLA remain signed-term work. |
| Conformance And Smoke Contract | live | Public acceptance suites, commands, pass criteria, evidence artifacts, and launch gates for partner and production readiness. | Passing tests alone is not enough for paid AI products; live gateway, usage ledger, and fresh output-quality evidence are part of readiness. |
| Data Processing Packet | live | Public data-use purposes, minimization rules, restricted-data boundary, DSR support policy, and signed-DPA gates. | Public data-processing metadata supports enterprise review; custom retention, residency, DPA, and private export commitments require signed terms. |
| Compliance Map | live | Public compliance-readiness mapping across SOC 2-style, GDPR/data-processing, OWASP API, procurement, resilience, and AI quality review areas. | The map is review evidence, not a certification claim; SOC 2 reports, DPAs, regulated-data approvals, and private audit evidence require signed terms. |
| AI Governance And Acceptable Use | live | Public generated-output governance, acceptable-use boundaries, restricted use cases, human-review policy, and escalation triggers. | Generated output is interpretive guidance; regulated, high-impact, crisis, medical, legal, financial, employment, housing, insurance, or eligibility use requires signed review or is prohibited. |
world_signal.job.completedrelease gateA long-running world-signal forecast job finished and passed quality gates.
Signed HTTPS POST
Exponential retry with dead-letter visibility after final failure.
world_signal.job.failedrelease gateA long-running world-signal forecast job failed before producing a billable result.
Signed HTTPS POST
Exponential retry with dead-letter visibility after final failure.
usage.recordedrelease gateA successful billable API call wrote usage metadata for partner reconciliation.
Signed HTTPS POST
Retry only after ledger write succeeds; failed partner delivery does not create duplicate usage.
quality.failedrelease gateA generative endpoint failed a quality or schema gate and should not be shown or billed.
Signed HTTPS POST
Low retry count because this is diagnostic, not a user deliverable.
entitlement.updatedenterpriseA workspace plan, scoped key, endpoint allowance, or custom limit changed.
Signed HTTPS POST
Retry until partner acknowledges or event moves to dead letter.
billing.subscription.updatedenterpriseA customer subscription, renewal, cancellation, or invoice state changed.
Signed HTTPS POST
Retry after internal billing state is consistent.
TheLeoKing-Signaturet=<unix_seconds>,v1=<hex_hmac_sha256>HMAC-SHA256300 secondsSign and verify the raw request body before JSON parsing. The signed payload is timestamp.raw_body. Store endpoint secrets server-side and deduplicate accepted event ids before side effects.
import { createHmac, timingSafeEqual } from "node:crypto";
export function verifyLeoKingWebhook({ rawBody, signatureHeader, secret }) {
const parts = signatureHeader.split(",").map((part) => part.trim());
const timestampPart = parts.find((part) => part.startsWith("t="));
const signatures = parts
.filter((part) => part.startsWith("v1="))
.map((part) => part.slice(3));
if (!timestampPart || signatures.length === 0) {
return false;
}
const timestamp = Number(timestampPart.slice(2));
const ageSeconds = Math.abs(Math.floor(Date.now() / 1000) - timestamp);
if (!Number.isSafeInteger(timestamp) || ageSeconds > 300) {
return false;
}
const expected = createHmac("sha256", secret)
.update(`${timestamp}.${rawBody}`, "utf8")
.digest("hex");
return signatures.some((signature) => {
if (!/^[a-f0-9]{64}$/i.test(signature)) {
return false;
}
return timingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expected, "hex"));
});
}Public security, observability, onboarding, SLA, and incident contracts are linked through the docs, OpenAPI, gateway, and trust page.
Docs were made easier to find from navigation, API product CTAs, redirects, sitemap, OpenAPI, and AI-readable docs files.
Business API routes, OpenAPI, console, API Lab, billing surface, usage ledger, async world-signal jobs, and SDK source are in place.
Publish SDK packages, generated endpoint pages, stronger examples, and buyer-path onboarding once release approval is complete.
Ship signed partner webhooks, public status/incident history, audit exports, private contracts, allowlists, and custom endpoint templates.
Clerk protects the customer console. Public API calls use scoped backend API keys so partner systems can call routes from trusted servers without exposing user sessions in browsers. The full access-control packet is available at /api/v1/access-control.
x-api-key: lk_live_...Idempotency-Key: stable-operation-idrequest_id, data, usage, metaAPI keys are server-side credentials. Public clients should call a partner backend, not paid API routes directly.
| Requirement | Scope | Partner Action | Platform Evidence |
|---|---|---|---|
Server-Side Custody live | All paid API routes. | Call API routes from a trusted backend and keep raw keys out of public clients, logs, screenshots, and support tickets. | Docs, SDKs, support packet rules, and auth errors all require `x-api-key` from server-controlled contexts. |
Endpoint Scope beta | Route access and monthly credit enforcement. | Request only the endpoints and traffic volume the key is scoped to use. | Key validation checks status, organization, endpoint access, credit state, and plan limits before execution. |
Environment Separation beta | Production, legacy compatibility, and local development. | Keep production keys and evidence separate from local fixtures and legacy-host compatibility testing. | Public metadata publishes canonical base URLs, key prefixes, and gateway smoke commands. |
Rotation And Revocation live | Key lifecycle, compromised credentials, and staff/offboarding changes. | Report exposed key prefixes only and rotate keys when custody changes or exposure is suspected. | Console audit trail and access-control packet define rotation triggers and non-billable failure behavior. |
Rate-Limit Cooperation live | Per organization, key, endpoint, and plan limit. | Respect 429 responses, back off with Retry-After, and coordinate load tests before traffic spikes. | Versioning and limits route publishes rate-limit algorithm, headers, and plan limits. |
Enterprise Network Controls enterprise | IP allowlists, private endpoints, custom network review, and dedicated security evidence. | Do not assume customer-specific network controls from public docs; include them in signed enterprise terms. | Procurement, security, access-control, and launch-readiness packets all mark allowlists as signed-term work. |
API keys are server-to-server credentials. Store them in a backend secret manager or server-only environment variable; never ship them to browser, mobile, analytics, screenshots, or client logs.
Browser and mobile clients must call a partner backend. Direct public-client calls to paid API routes are unsupported because keys, scopes, usage, and support evidence must stay server-controlled.
IP allowlists, private endpoint terms, mTLS-style controls, and dedicated network review require signed enterprise terms and launch-readiness evidence.
Production Gateway https://api.theleokingai.com | Paid production, buyer-path smoke, and customer-facing server integrations. | Use production-scoped keys only from trusted server environments and verify usage ledger evidence before enterprise demos. |
Legacy Website API Host https://theleokingai.com/api | Backward-compatible alpha integrations while clients migrate to the dedicated gateway host. | Do not create new public integrations on the legacy host unless compatibility testing requires it. |
Local Development http://localhost:3000/api | Local contract testing, SDK development, and smoke rehearsal with non-production data. | Local keys and fixture payloads must not be reused as production credentials or customer evidence. |
Create the key from the customer console, approved internal smoke flow, or signed enterprise onboarding path.
Key has organization id, key prefix, status, endpoint scope, plan/credit state, and creation audit event.
Put the raw key in a backend secret manager or server-only environment variable before making requests.
Partner confirms the key is absent from browser bundles, mobile clients, analytics events, source control, and support screenshots.
Run a scoped smoke request and verify the endpoint, usage lane, credit charge, and Convex ledger row match expectations.
Buyer-path smoke proves the same request_id in response and usageEvents before paid traffic ramps.
Rotate any key that appears outside server-only storage or after relevant operator/offboarding changes.
Audit trail shows old key revoked and replacement key created with equivalent intended scope.
Disable compromised, over-limit, expired, or out-of-contract keys before route execution.
Auth validation returns a non-billable auth/scope error and support packet uses key prefix only.
Move IP allowlists, private endpoint terms, dedicated network review, or audit export packages into signed terms.
Signed order form or security exhibit names the customer-specific controls and evidence cadence.
Customers can call raw HTTP immediately, use the OpenAPI contract for generated clients, or build from the repo SDK source. The Node and Python clients expose the live paid routes and preserve `usage` metadata so core compute and AI spend stay visible.
# Published package target after release approval
npm install @theleoking/ai-api
# Alpha source in this repo today
cd sdk/node
npm install
npm run buildimport { TheLeoKingApi } from "@theleoking/ai-api";
const api = new TheLeoKingApi({
apiKey: process.env.LEOKING_API_KEY!,
baseUrl: "https://api.theleokingai.com"
});
const result = await api.futurePartnerVision({
subject: {
id: "user_123",
dob: "1990-07-23",
tob: "14:30",
pob: "New York, US"
},
intent: "future long-term partner",
context: {
relationship_status: "single",
desired_tone: "direct, cinematic, grounded"
}
}, "future-partner-user-123-2026-06-17");
console.log(result.data.partner_archetype);
console.log(result.usage.credits, result.usage.tokens);# Published package target after release approval
pip install theleoking-ai-api
# Alpha source in this repo today
cd sdk/python
pip install -e .import os
from theleoking_ai_api import TheLeoKingApi
api = TheLeoKingApi(
api_key=os.environ["LEOKING_API_KEY"],
base_url="https://api.theleokingai.com",
)
result = api.compatibility_score({
"subject": {
"id": "person_a",
"dob": "1990-07-23",
"tob": "14:30",
"pob": "New York, US",
},
"partner": {
"id": "person_b",
"dob": "1992-11-08",
"tob": "09:15",
"pob": "Los Angeles, US",
},
"scoring_profile": "balanced",
}, idempotency_key="compat-person-a-person-b-2026-06-17")
print(result["data"]["score"])
print(result["usage"]["credits"])curl https://api.theleokingai.com/v1/openapi
# Machine-readable docs context
GET /api/v1
GET /api/v1/openapi
GET /api/v1/errors
GET /api/v1/postman
# SDK source in this repo
sdk/node
sdk/pythonimport { verifyLeoKingWebhookSignature } from "@theleoking/ai-api";
const rawBody = await request.text();
const isValid = await verifyLeoKingWebhookSignature({
payload: rawBody,
signatureHeader: request.headers.get("TheLeoKing-Signature"),
secret: process.env.LEOKING_WEBHOOK_SECRET!,
});
if (!isValid) {
throw new Error("Invalid The Leo King webhook signature");
}
const event = JSON.parse(rawBody);Public package metadata is available at /api/v1/sdks. Publication stays gated until package names, docs, production domain, support policy, and release approval are current.
| Package | Status | Source | Install |
|---|---|---|---|
| @theleoking/ai-api | release gate | sdk/node | npm install @theleoking/ai-api |
| theleoking-ai-api | release gate | sdk/python | pip install theleoking-ai-api |
npm and PyPI publication is gated until package names, production domain, support policy, docs, env readiness, SDK release smoke evidence, publication dry-run evidence, and Dave's explicit release approval are all current.
npm run smoke:sdk-release -- --base-url https://api.theleokingai.comnpm run smoke:sdk-publication -- --base-url https://api.theleokingai.comnpm --prefix sdk/node run buildpython -m compileall sdk\python\theleoking_ai_apinpm run smoke:sdk-release -- --skip-livenpm run smoke:sdk-publication -- --skip-livenpm run smoke:sdk-release -- --base-url https://api.theleokingai.com after deploynpm publication must use provenance from CI or an approved release machine; PyPI publication must use trusted publishing or a scoped token with no credentials committed to repo logs.
Create a signed sdk-vX.Y.Z tag only after SDK release smoke, publication dry-run, changelog link, and rollback note are committed.
For a bad SDK release, deprecate the npm version, yank the bad Python release, publish a patch version, keep source clients available, and add the rollback note to /api/v1/changelog.
Use this for high-volume chart workflows where customers need raw geocentric tropical data and no generated interpretation.
curl https://api.theleokingai.com/v1/charts/natal \
-X POST \
-H "Content-Type: application/json" \
-H "x-api-key: $LEOKING_API_KEY" \
-H "Idempotency-Key: natal-subject-123-v1" \
-d '{
"subject": {
"id": "subject_123",
"dob": "1990-07-23",
"tob": "14:30",
"pob": "New York, US"
}
}'Use this for app features that sell a completed experience instead of exposing raw astrology parts.
const response = await fetch("https://api.theleokingai.com/v1/experiences/future-partner-vision", {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-api-key": process.env.LEOKING_API_KEY,
"Idempotency-Key": "future-partner-user-123-v1"
},
body: JSON.stringify({
subject: {
id: "user_123",
dob: "1990-07-23",
tob: "14:30",
pob: "New York, US"
},
intent: "future long-term partner",
context: {
relationship_status: "single",
desired_tone: "direct, cinematic, grounded"
}
})
});
if (!response.ok) throw new Error(await response.text());
const result = await response.json();Use async jobs for deep BTV-style reports where a partner app can poll instead of blocking the customer request.
import os
import time
import requests
base_url = "https://api.theleokingai.com/v1"
headers = {
"Content-Type": "application/json",
"x-api-key": os.environ["LEOKING_API_KEY"],
"Idempotency-Key": "world-signals-markets-2026-06-18",
}
job = requests.post(
f"{base_url}/world/signals/jobs",
headers=headers,
json={"topic": "markets", "window_days": 14, "depth": "deep"},
timeout=30,
)
job.raise_for_status()
status_url = job.json()["data"]["status_url"]
while True:
status = requests.get(status_url, headers={"x-api-key": os.environ["LEOKING_API_KEY"]}, timeout=30)
status.raise_for_status()
payload = status.json()
if payload["data"]["status"] in {"complete", "failed"}:
break
time.sleep(payload["data"].get("poll_after_ms", 2000) / 1000)Not every route uses AI. The platform separates deterministic astrology compute from model-backed interpretation so customers can run high-volume chart, transit, compatibility, and helio endpoints without paying for generative AI on every request.
No-AI astrology infrastructure: geocentric tropical chart math, transit tables, synastry scoring, compatibility scoring, and helio tropical StarTypes lookup.
Lowest-cost path for high-volume chart facts, compatibility checks, timing context, and product workflows that do not need generated interpretation.
1-4 core credits per request. Usage tracks endpoint, request id, and credit spend without generative AI token charges.
/v1/charts/natal/v1/charts/current-sky/v1/charts/transits/v1/charts/synastry/v1/lunar/phase/v1/compatibility/score/v1/helio/patternsPremium interpretation routes that combine owned astrology math, curated spiritual context, product-specific prompts, and polished synthesis.
Premium path for polished, display-ready spiritual products and partner experiences.
4-10 AI credits per completed response. Incomplete or rejected responses are not treated as successful billable output.
/v1/audience/insights/v1/experiences/future-partner-vision/v1/experiences/love-reveal/v1/experiences/crystal-ball/v1/oracle/ask/v1/tarot/draw/v1/past-life/reading/v1/horoscope/daily/v1/timing/windowsHigh-value mundane astrology and BTV intelligence for markets, culture, geopolitics, and timing windows.
Premium forecast path with world-event context, timing intelligence, citations, freshness checks, and reviewed output contracts.
5+ AI credits per forecast, higher for deep async jobs. Only completed, structured forecast outputs are billed as successful results.
/v1/world/signals/v1/world/signals/jobs/v1/mundane/hot-zones/v1/mundane/analyze-eventCustom API bundles, private model/data contracts, dedicated evals, partner-specific endpoint design, and negotiated usage minimums.
Sales-led margin model with committed usage, separate high-cost media AI terms, and partner-specific observability.
Custom credit blocks, SLA, overage terms, and private deployment options.
/v1/custom/*/v1/enterprise/*Teams that want the lowest-cost production astrology compute lane without AI spend.
No generative AI is included. Core routes record core credits only and avoid token-based usage charges.
Small apps, creators, and pilot integrations.
Core routes avoid generative AI. Light AI routes are opt-in and consume 4-8 AI credits per completed response.
Paid apps, agencies, dating/wellness products, and media workflows.
Designed for regular AI endpoint use with usage reviewed by endpoint and product lane.
B2B platforms, commerce datasets, large newsletters, and enterprise pilots.
Built for heavy AI usage with cost review before custom content generation expansion.
Strategic partners, AI platforms, dating networks, media networks, and licensing deals.
Custom credit pricing, committed usage, and separate terms for high-cost media generation products.
The buyer path is organization-based: sign in, select or create a workspace, choose a plan in Clerk checkout, then manage keys and usage in the API console.
These access rules are shared by the public docs, customer console, and Convex API-key validation. Core Compute is the no-AI entry plan. Basic adds light AI. Pro unlocks premium experiences and World Signals.
| Endpoint | Lane | Minimum Plan | Access Rule |
|---|---|---|---|
Audience Insights /v1/audience/insights | Light AI | Basic+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Customer Profile /v1/customer/profile | Light AI | Basic+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Oracle Ask /v1/oracle/ask | Light AI | Basic+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Tarot Draw /v1/tarot/draw | Light AI | Basic+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Daily Horoscope /v1/horoscope/daily | Light AI | Basic+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Timing Windows /v1/timing/windows | Light AI | Basic+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Natal Chart /v1/charts/natal | No AI core | Core Compute+ | No model call required; safe for high-volume deterministic workflows. |
Current Sky /v1/charts/current-sky | No AI core | Core Compute+ | No model call required; safe for high-volume deterministic workflows. |
Transit Chart /v1/charts/transits | No AI core | Core Compute+ | No model call required; safe for high-volume deterministic workflows. |
Synastry Chart /v1/charts/synastry | No AI core | Core Compute+ | No model call required; safe for high-volume deterministic workflows. |
Lunar Phase /v1/lunar/phase | No AI core | Core Compute+ | No model call required; safe for high-volume deterministic workflows. |
Compatibility Score /v1/compatibility/score | No AI core | Core Compute+ | No model call required; safe for high-volume deterministic workflows. |
Helio StarTypes /v1/helio/patterns | No AI core | Core Compute+ | No model call required; safe for high-volume deterministic workflows. |
Future Partner Vision /v1/experiences/future-partner-vision | Premium AI | Pro+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Love Reveal /v1/experiences/love-reveal | Premium AI | Pro+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Crystal Ball /v1/experiences/crystal-ball | Premium AI | Pro+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Past-Life Reading /v1/past-life/reading | Premium AI | Pro+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
World Signals /v1/world/signals | World Signals | Pro+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
World Signals Async Jobs /v1/world/signals/jobs | World Signals | Pro+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Mundane Hot Zones /v1/mundane/hot-zones | World Signals | Pro+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Mundane Event Analysis /v1/mundane/analyze-event | World Signals | Pro+ | Model-backed usage records provider, model, tokens, credits, and quality gates. |
Buyers need to know what works now, what the beta gate requires, and where the enterprise product is going. This roadmap keeps the public API, docs, billing, and internal build path aligned.
Start with Core Compute when the product needs high-volume astrology infrastructure. Add AI Intelligence only for paid, display-ready moments.
Sign in, create or select the company workspace, and attach the subscription to the account that will own keys and usage.
Generate API keys for the selected product surface, keep endpoints scoped by plan, and use idempotency keys for retry-safe billing.
Review live usage, response quality, support needs, and upgrade timing before moving a partner into production volume.
The public API, checkout route, customer console, usage dashboard, API Lab, and no-AI core routes are in place.
The helio tropical StarTypes endpoint now uses the full packaged Michael Erlewine short ephemeris lookup instead of the old pilot slice.
The next commercial gate is making a buyer able to discover plans, check out, create keys, run examples, and see usage without hand-holding.
The strongest roadmap is deeper business functions around dating apps, creator funnels, media intelligence, world signals, and premium spiritual products.
Large partners need private contracts, committed usage, custom endpoints, stronger observability, and optional realtime or callback products.
The commercial surface is organized into product families. This keeps geocentric chart math, heliocentric StarTypes, business intelligence, and source-backed forecasting from getting mixed together.
Productized spiritual experiences that partners can drop into apps, creator platforms, membership funnels, and media workflows.
/v1/experiences/future-partner-vision/v1/experiences/love-reveal/v1/experiences/crystal-ball/v1/tarot/draw/v1/oracle/ask/v1/past-life/readingDating, compatibility, synastry, and 5-7-8 love intelligence built on owned chart math plus David Palmer's relationship frameworks.
/v1/charts/synastry/v1/compatibility/score/v1/experiences/love-reveal/v1/experiences/future-partner-visionOwned geocentric tropical calculations for natal, transits, synastry, composite, solar return, progressions, geo, and timezone workflows.
/v1/charts/natal/v1/charts/current-sky/v1/charts/transits/v1/charts/synastry/v1/lunar/phaseBeyond The Veil style mundane forecasting, hot zones, timing windows, and event analysis with deterministic ephemeris context.
/v1/world/signals/jobs/v1/world/signals/v1/mundane/hot-zones/v1/mundane/analyze-event/v1/timing/windowsMichael Erlewine StarTypes, source attribution, spiritual knowledge, love frameworks, and retrieval-backed interpretation layers.
/v1/helio/patterns| Capability | Route | Status | Notes |
|---|---|---|---|
| Natal chart | POST /v1/charts/natal | Live alpha | Owned western tropical sidecar calculation |
| Current sky | POST /v1/charts/current-sky | Live alpha | Owned current positions, house cusps, aspects, and lunar phase |
| Transit chart | POST /v1/charts/transits | Live alpha | Owned western transit positions and transit-to-natal aspects |
| Lunar phase | POST /v1/lunar/phase | Live alpha | Owned Sun-Moon phase context for a supplied moment and location |
| Audience intelligence | POST /v1/audience/insights | Live | Business scoring and campaign fit |
| Mundane forecasting | POST /v1/world/signals | Live | BTV-style forecasts with RAG and quality gates |
| Helio StarTypes | POST /v1/helio/patterns | Background | Heliocentric tropical Michael Erlewine lookup |
| Erlewine source context | Embedded in intelligence routes | Live | RAG metadata and attribution |
These are the function-level capabilities customers can build around. They map to the live endpoints instead of calling a third-party astrology API.
Future Partner Vision, Love Reveal, Crystal Ball, tarot, and oracle experiences as product APIs.
oracle.ask.generatepartner.vision.generatelove.reveal.generatevision.crystal.generatepastlife.reading.generatetarot.spread.drawtarot.symbols.attachquality.experience.enforceGeocentric tropical natal, transits, synastry, composite, solar return, progressions, geo, and timezone functions.
chart.natal.calculatechart.current_sky.calculatechart.transits.calculatechart.synastry.calculatelunar.phase.calculatechart.composite.calculatechart.solar_return.calculatechart.progressions.calculategeo.timezone.resolveCompatibility scoring built from synastry, 5-7-8 house overlays, love planets, and risk flags.
compatibility.score.calculatelove.578.evaluatesynastry.signals.weightrelationship.signals.extracthelio.background.compareAudience, campaign, and partner intelligence functions built on chart context plus controlled generation.
customer.profile.scorecampaign.fit.evaluatemessage.angle.generatechart.quality.reporttiming.windows.generatequality.gates.enforceBeyond The Veil style world-signal functions with deterministic ephemeris and RAG controls.
mundane.forecast.generatemundane.event.analyzeephemeris.transits.ranksignature.stack.applyhistorical.analog.selecthotzones.scorewatch.items.generateHeliocentric tropical Michael Erlewine StarTypes lookup as a background experimental signal.
startypes.lookuphelio.pattern.componentserlewine.source.creditbackground.signal.guardCurated spiritual, love, mundane, past-life, and Erlewine source context for endpoint-specific synthesis.
erlewine.context.searchspiritual.kb.searchlove.framework.retrievebtv.article.retrievesource.credit.formatEach endpoint now has a standalone reference page with credit model, plan gate, supported inputs, outputs, function names, curl, Node, Python, errors, Postman, and realistic request/response examples.
/v1/audience/insightsliveLight AIBasic+Generate customer-level buyer archetypes, campaign fit, timing notes, and message angles from birth data and campaign context.
/v1/audience/insightscustomer.profile.scoreScores each customer against a campaign context.
campaign.fit.evaluateReturns send/no-send guidance with reasoning.
message.angle.generateProduces positioning language for the audience segment.
chart.quality.reportReports whether the request used a full chart or limited birth data.
erlewine.context.attachAdds authorized Michael Erlewine context when local RAG is enabled.
{
"customers": [
{
"id": "cust_123",
"dob": "1990-07-23",
"tob": "14:30",
"pob": "New York, US"
}
],
"campaign_context": {
"product_category": "relationship coaching membership",
"tone": "warm direct",
"channel": "email"
}
}{
"request_id": "req_...",
"data": {
"results": [
{
"customer_id": "cust_123",
"personality": {
"sun_sign": "Leo",
"buyer_archetype": "premium loyalist"
},
"campaign_fit": {
"score": 0.86,
"send": true,
"reasoning": "High receptivity window"
}
}
]
},
"usage": { "lane": "ai", "credits": 2, "billableUnits": 1 },
"meta": { "chartQuality": [{ "customer_id": "cust_123", "quality": "full_chart" }] }
}/v1/experiences/future-partner-visionalphaPremium AIPro+Generate a structured future partner profile, relationship scene, attraction pattern, timing window, and optional image prompt from birth data and love context.
/v1/experiences/future-partner-visionpartner.vision.generateCreates a structured future partner profile and scene.
love.signature.extractReads Moon, Venus, Mars, 5th, 7th, and 8th house signals when available.
timing.romance.windowUses owned transits and relationship timing rules for timing windows.
image.prompt.partnerReturns a safe visual prompt for partner-vision image generation.
quality.experience.enforceBlocks generic, thin, or fallback-looking outputs.
{
"subject": {
"id": "user_123",
"dob": "1990-07-23",
"tob": "14:30",
"pob": "New York, US"
},
"intent": "future long-term partner",
"context": {
"relationship_status": "single",
"desired_tone": "direct, cinematic, grounded"
}
}{
"request_id": "req_...",
"data": {
"partner_archetype": "magnetic builder with public confidence and private loyalty",
"meeting_scene": {
"setting": "a work-adjacent creative event",
"signal": "conversation starts through a practical offer, then turns intimate"
},
"timing_windows": [
{ "start": "2026-08-04", "end": "2026-09-12", "confidence": 0.72 }
],
"image_prompt": "premium cinematic future partner portrait..."
},
"usage": { "lane": "ai", "credits": 8, "billableUnits": 1 },
"meta": { "status": "alpha", "requiredSystems": ["geocentric_tropical", "love_5_7_8"] }
}/v1/experiences/love-revealalphaPremium AIPro+Generate a high-specificity love reading that can blend psychic interpretation, tarot symbolism, owned astrology context, and 5-7-8 relationship logic.
/v1/experiences/love-reveallove.reveal.generateCreates the final structured love reveal experience.
question.intent.classifyClassifies breakup, crush, commitment, return, or future-love intent.
tarot.symbols.attachAdds tarot structure only when it sharpens the answer.
relationship.context.groundPrevents generic love output by anchoring to the provided situation.
{
"question": "Is this connection coming back or should I move on?",
"subject": { "id": "user_123", "dob": "1990-07-23" },
"context": {
"relationship_status": "separated",
"desired_tone": "clear and compassionate"
}
}{
"request_id": "req_...",
"data": {
"answer": "This connection is not fully closed, but the return depends on whether accountability replaces silence.",
"dynamic": "strong chemistry with weak consistency",
"next_action": "Do not chase. Ask one direct question and watch behavior, not emotion."
},
"usage": { "lane": "ai", "credits": 5, "billableUnits": 1 },
"meta": { "status": "alpha", "persona": "lady-avalon" }
}/v1/experiences/crystal-ballalphaPremium AIPro+Generate a cinematic symbolic vision with concrete interpretation, action guidance, and optional image-generation direction.
/v1/experiences/crystal-ballvision.crystal.generateCreates a vivid but grounded symbolic vision.
symbols.interpretMaps visual symbols to practical meaning using owned spiritual knowledge.
image.prompt.crystalReturns a premium image-generation prompt for campaign or app use.
{
"question": "What is the hidden opportunity around this career change?",
"topic": "career",
"style": "cinematic, concise, grounded"
}{
"request_id": "req_...",
"data": {
"vision": "A black door opens into a violet-lit room where a desk is already waiting.",
"meaning": "The opportunity is not more searching. It is accepting a role that asks you to be seen.",
"action": "Say yes to the serious invitation, not the familiar backup plan."
},
"usage": { "lane": "ai", "credits": 4, "billableUnits": 1 },
"meta": { "status": "alpha", "knowledge": ["psychic", "symbols"] }
}/v1/oracle/askalphaLight AIBasic+Answer a direct spiritual question through the paid Lady Avalon API path with strict JSON output, usage metering, and no legacy MCP dependency.
/v1/oracle/askoracle.ask.generateGenerates a direct display-ready answer.
sun.sign.deriveDerives sun sign when birth_date is supplied.
quality.experience.enforceBlocks malformed or fallback-looking JSON.
{
"question": "What is the real opportunity in front of me right now?",
"birth_date": "1990-07-23",
"topic": "career",
"context": { "desired_tone": "direct and grounded" }
}{
"request_id": "req_...",
"data": {
"answer": "The opportunity is to take the visible role instead of staying behind the buildout.",
"insight": "The pattern is asking for leadership with cleaner boundaries.",
"next_action": "Make the direct offer this week and remove the backup option."
},
"usage": { "lane": "ai", "credits": 2, "billableUnits": 1 }
}/v1/tarot/drawalphaLight AIBasic+Draw and interpret tarot spreads from the local 78-card Rider-Waite-Smith corpus with deterministic seed support and paid API metering.
/v1/tarot/drawtarot.spread.drawDraws cards deterministically from the local 78-card corpus.
tarot.meanings.applyUses local card meanings as interpretation context.
tarot.output.lockLocks the final response to the actual drawn cards.
{
"question": "What do I need to know about this relationship?",
"spread_type": "three_card",
"topic": "love",
"seed": "partner-reading-001"
}{
"request_id": "req_...",
"data": {
"spread": {
"type": "three_card",
"cards": [
{ "name": "The Lovers", "position": "situation", "orientation": "upright" }
]
},
"answer": "The connection is real, but the choice must become conscious."
},
"usage": { "lane": "ai", "credits": 2, "billableUnits": 1 }
}/v1/past-life/readingalphaPremium AIPro+Generate an AstraGate-style past-life reading with structured scene, karmic pattern, present-life echo, healing action, and empowerment.
/v1/past-life/readingpastlife.reading.generateCreates a structured past-life reading.
astragate.persona.applyUses the AstraGate persona contract and past-life knowledge.
quality.experience.enforceRequires complete structured output before billing is recorded.
{
"subject": { "id": "user_123", "dob": "1990-07-23" },
"focus": "soul_mission",
"question": "What old pattern am I here to complete?"
}{
"request_id": "req_...",
"data": {
"lifetime_theme": "A life of carrying sacred knowledge while hiding your public voice.",
"healing_action": "Choose one truth and speak it plainly this week."
},
"usage": { "lane": "ai", "credits": 10, "billableUnits": 1 }
}/v1/charts/synastryalphaNo AI coreCore Compute+Return owned geocentric tropical synastry data and relationship aspect overlays without calling an external astrology API.
/v1/charts/synastrychart.synastry.calculateComputes interchart aspects through the owned sidecar path.
interchart.aspects.rankRanks conjunctions, oppositions, trines, squares, sextiles, and tight orbs.
relationship.signals.extractExtracts Moon, Venus, Mars, Saturn, and Pluto relationship signals.
calculation.basis.reportReports geocentric tropical calculation basis.
{
"subject": {
"id": "person_a",
"dob": "1990-07-23",
"tob": "14:30",
"pob": "New York, US"
},
"partner": {
"id": "person_b",
"dob": "1992-11-08",
"tob": "09:15",
"pob": "Los Angeles, US"
},
"max_aspects": 40
}{
"request_id": "req_...",
"data": {
"pair_id": "person_a:person_b",
"calculation_basis": {
"frame": "geocentric",
"zodiac": "tropical",
"system": "owned sidecar"
},
"aspects": [],
"relationship_signals": []
},
"usage": { "lane": "core", "credits": 3, "billableUnits": 1 }
}/v1/compatibility/scorealphaNo AI coreCore Compute+Score relationship compatibility using synastry, 5-7-8 house activation, love-planet frameworks, and optional StarTypes background comparison.
/v1/compatibility/scorecompatibility.score.calculateCreates the numeric compatibility score and tier.
love.578.evaluateEvaluates 5th, 7th, and 8th house activation patterns.
synastry.signals.weightWeights personal planet, Saturn, Pluto, Node, Vertex, and Chiron contacts.
helio.background.compareOptionally compares StarTypes as background context only.
{
"subject": { "id": "person_a", "dob": "1990-07-23", "tob": "14:30", "pob": "New York, US" },
"partner": { "id": "person_b", "dob": "1992-11-08", "tob": "09:15", "pob": "Los Angeles, US" },
"context": { "relationship_type": "dating" },
"include_helio_background": false
}{
"request_id": "req_...",
"data": {
"score": 87,
"tier": "high",
"subscores": {
"romance_5th": 0.82,
"partnership_7th": 0.9,
"intimacy_8th": 0.78
},
"risk_flags": ["strong attraction requires direct communication"]
},
"usage": { "lane": "core", "credits": 4, "billableUnits": 1 }
}/v1/charts/natalalphaNo AI coreCore Compute+Return a geocentric tropical natal chart from the Kerykeion/Swiss sidecar for partners that need raw chart data, not generated interpretation.
/v1/charts/natalchart.natal.calculateComputes a full geocentric tropical natal chart.
planet.positions.listReturns the sidecar planet/sign/degree payload when provided by the sidecar.
houses.resolveReturns house data when provided by the configured sidecar response.
aspects.listReturns natal aspect data when provided by the configured sidecar response.
birth.input.validateRejects requests missing time plus place or coordinates.
{
"subject": {
"id": "subject_123",
"dob": "1990-07-23",
"tob": "14:30",
"pob": "New York, US"
}
}{
"request_id": "req_...",
"data": {
"subject_id": "subject_123",
"calculation_basis": {
"frame": "geocentric",
"zodiac": "tropical",
"system": "Kerykeion sidecar"
},
"sun_sign": "Leo",
"chart": { "planets": [], "houses": [], "aspects": [] }
},
"usage": { "lane": "core", "credits": 2, "billableUnits": 1 }
}/v1/charts/transitsalphaNo AI coreCore Compute+Return geocentric tropical transit positions and aspects from the owned sidecar for timing, daily horoscope, and ephemeris workflows.
/v1/charts/transitschart.transits.calculateComputes the current or requested transit chart.
transit.positions.listReturns planet positions when provided by the sidecar.
transit.aspects.rankReturns sidecar aspect data up to the requested cap.
mundane.signal.seedSupplies verified ephemeris context for world signal forecasts.
daily.horoscope.seedSupplies owned transit substrate for daily horoscope products.
{
"transit_datetime": "2026-06-17T12:00:00.000Z",
"transit_location": "Greenwich, GB",
"max_aspects": 30
}{
"request_id": "req_...",
"data": {
"transit_datetime": "2026-06-17T12:00:00.000Z",
"transit_location": "Greenwich, GB",
"calculation_basis": {
"frame": "geocentric",
"zodiac": "tropical",
"system": "Kerykeion sidecar"
},
"chart": { "planets": [], "aspects": [] },
"aspects": []
},
"usage": { "lane": "core", "credits": 2, "billableUnits": 1 }
}/v1/charts/current-skyalphaNo AI coreCore Compute+Return the owned geocentric tropical current-sky chart for a supplied moment and location without calling external astrology APIs.
/v1/charts/current-skychart.current_sky.calculateComputes the live or requested sky through the owned sidecar path.
planet.positions.listReturns selected point positions with sign, degree, house, and retrograde data.
houses.resolveReturns owned house cusps for the selected house system.
lunar.phase.extractReturns the Sun-Moon phase context from the same owned chart.
{
"datetime": "2026-06-17T12:00:00.000Z",
"location": "Greenwich, GB",
"options": {
"house_system": "placidus",
"zodiac": "tropical"
}
}{
"request_id": "req_...",
"data": {
"datetime": "2026-06-17T12:00:00.000Z",
"calculation_basis": {
"provider": "owned_western",
"frame": "geocentric",
"zodiac": "tropical"
},
"chart": { "planets": [], "house_cusps": [], "aspects": [] },
"lunar_phase": {}
},
"usage": { "lane": "core", "credits": 1, "billableUnits": 1 }
}/v1/lunar/phasealphaNo AI coreCore Compute+Return first-party Sun-Moon lunar phase context for a supplied moment and location without horoscope prose or third-party fallback.
/v1/lunar/phaselunar.phase.calculateCalculates lunar phase from owned Sun and Moon positions.
planet.positions.listReturns the Sun and Moon positions that produced the phase.
calculation.basis.reportReports the owned western calculation basis and unsupported lanes.
{
"datetime": "2026-06-17T12:00:00.000Z",
"location": "Greenwich, GB"
}{
"request_id": "req_...",
"data": {
"datetime": "2026-06-17T12:00:00.000Z",
"calculation_basis": {
"provider": "owned_western",
"frame": "geocentric",
"zodiac": "tropical"
},
"lunar_phase": {},
"chart": { "sun": {}, "moon": {} }
},
"usage": { "lane": "core", "credits": 1, "billableUnits": 1 }
}/v1/horoscope/dailyalphaLight AIBasic+Generate personalized daily horoscope output from owned transit substrate, zodiac knowledge, and optional birth profile context.
/v1/horoscope/dailyhoroscope.daily.generateGenerates a daily horoscope without calling external horoscope APIs.
transit.daily.seedUses owned transits as the calculation substrate.
zodiac.knowledge.applyApplies local zodiac knowledge without generic filler.
{
"sign": "leo",
"date": "2026-06-17",
"tone": "premium concise",
"sections": ["theme", "love", "work", "action"]
}{
"request_id": "req_...",
"data": {
"sign": "leo",
"theme": "Choose the room that lets your confidence become useful.",
"drivers": ["Moon phase", "active Venus-Mars relationship tone"],
"action": "Make the direct offer instead of waiting for permission."
},
"usage": { "lane": "ai", "credits": 1, "billableUnits": 1 }
}/v1/timing/windowsalphaLight AIBasic+Generate practical timing windows for launches, love, career, money, content, and spiritual work using owned transit substrate.
/v1/timing/windowstiming.windows.generateGenerates date-bounded timing windows.
transit.window.seedUses owned transit context at the start of the range.
strategy.timing.applyConverts astrology into operational strategy.
{
"topic": "launch",
"start_date": "2026-06-17",
"end_date": "2026-07-17",
"objective": "Find the best window to announce a paid API beta",
"max_windows": 3
}{
"request_id": "req_...",
"data": {
"topic": "launch",
"windows": [
{ "start": "2026-06-21", "end": "2026-06-24", "title": "Visibility push", "confidence": 0.74 }
],
"strategy": "Lead with the strongest proof and keep the offer narrow."
},
"usage": { "lane": "ai", "credits": 3, "billableUnits": 1 }
}/v1/world/signalsliveWorld SignalsPro+Generate Beyond The Veil style mundane intelligence with deterministic ephemeris context, BTV RAG metadata, and quality controls.
/v1/world/signalsmundane.forecast.generateGenerates a source-constrained world signal forecast.
ephemeris.transits.rankRanks live transits when sidecar mode is enabled.
signature.stack.applyOverwrites model-supplied signatures with verified classes.
historical.analog.selectSelects deterministic analog metadata by topic.
quality.gates.enforceBlocks fallback-looking or under-specified forecast output.
{
"topic": "markets",
"window_days": 14,
"depth": "deep"
}{
"request_id": "req_...",
"data": {
"forecasts": [
{
"headline": "Markets hold a volatile repricing window",
"forecast_window": {
"start": "2026-06-17",
"end": "2026-07-01",
"specificity": "two-week operational window"
},
"confidence": 8
}
]
},
"usage": { "lane": "ai", "credits": 5, "billableUnits": 1 },
"meta": { "ephemeris": { "enabled": true } }
}/v1/world/signals/jobsliveWorld SignalsPro+Create an asynchronous Beyond The Veil world signal forecast job for deep production use, then poll the job URL until the quality-gated forecast is complete.
/v1/world/signals/jobsmundane.forecast.job.createCreates an async forecast job without blocking the customer request.
credits.reserveCounts queued and running jobs against available monthly credits.
job.status.pollReturns queued, running, failed, or complete job state without extra billing.
mundane.forecast.generateRuns the existing quality-gated world signal engine in the worker.
usage.bill.on_successWrites usage only after the worker produces a valid forecast.
{
"topic": "markets",
"window_days": 14,
"depth": "deep"
}{
"request_id": "req_...",
"data": {
"job_id": "j57...",
"status": "queued",
"status_url": "https://api.theleokingai.com/v1/world/signals/jobs/j57...",
"reserved_credits": 5,
"poll_after_ms": 2000
},
"usage": { "lane": "ai", "credits": 0, "billableUnits": 0 },
"meta": {
"billing": "reserved_not_charged_until_complete",
"worker": "scheduled"
}
}/v1/mundane/hot-zonesalphaWorld SignalsPro+Rank supplied regions as Beyond The Veil style hot zones for a topic and time window using owned transit context and structured generation.
/v1/mundane/hot-zoneshotzones.scoreScores supplied regions on a 0-100 hot-zone scale.
mundane.region.rankRanks likely pressure regions for a topic.
watch.items.generateCreates concrete monitoring items.
{
"topic": "markets",
"regions": ["United States", "Europe", "China", "Middle East"],
"window_days": 30
}{
"request_id": "req_...",
"data": {
"topic": "markets",
"hot_zones": [
{ "region": "United States", "score": 82, "signal": "Policy and liquidity stress cluster." }
]
},
"usage": { "lane": "ai", "credits": 5, "billableUnits": 1 }
}/v1/mundane/analyze-eventalphaWorld SignalsPro+Analyze a supplied world event through mundane astrology and return forward-looking implications, analogs, watch windows, and action guidance.
/v1/mundane/analyze-eventmundane.event.analyzeAnalyzes a specific supplied event.
event.signature.extractMaps the event to astrology and mundane signal language.
forecast.implications.generateReturns forward-looking implications.
{
"event": "A central bank unexpectedly signals a policy reversal while markets are fragile.",
"event_date": "2026-06-17",
"topic": "markets",
"window_days": 30
}{
"request_id": "req_...",
"data": {
"event_summary": "A policy signal changed market expectations before liquidity stabilized.",
"confidence": 7,
"action": "Watch the second reaction, not the first headline."
},
"usage": { "lane": "ai", "credits": 4, "billableUnits": 1 }
}/v1/helio/patternsbackgroundNo AI coreCore Compute+Lookup heliocentric tropical StarTypes patterns with attribution to Michael Erlewine's contributions, source work, and interpretations as a background/evaluation signal.
/v1/helio/patternsstartypes.lookupLooks up the date-level helio tropical StarTypes row.
helio.pattern.componentsReturns pattern components, color code, and geometry labels.
erlewine.source.creditReturns public source credit and rights bucket metadata.
background.signal.guardLabels StarTypes as experimental background context only.
{
"subjects": [
{ "id": "subject_123", "dob": "1990-07-23" }
],
"context": {
"use_case": "audience segmentation experiment"
}
}{
"request_id": "req_...",
"data": {
"profiles": [
{
"subject_id": "subject_123",
"calculation_basis": {
"frame": "heliocentric",
"zodiac": "tropical",
"prediction_role": "background_evaluation"
},
"startype": {
"pattern_code": "82",
"pattern_signature": "8-B-TRINESQUARE/18-G-TRINE"
}
}
]
},
"usage": { "lane": "core", "credits": 1, "billableUnits": 1 }
}/v1/knowledge/erlewine/contextplannedsales reviewRetrieve rights-cleared Michael Erlewine context for controlled interpretation workflows without exposing raw archive internals.
erlewine.context.searchSearches curated Erlewine chunks by endpoint target and source family.
source.credit.formatReturns public-safe credit lines and source labels.
rights.bucket.filterFilters retrieval to approved rights buckets.
{
"query": "relationship vocation StarTypes pattern",
"endpoint_target": "compatibility",
"top_k": 5,
"rights_bucket": "approved"
}{
"request_id": "req_...",
"data": {
"chunks": [],
"credit_line": "Includes interpretive context from Michael Erlewine source materials.",
"use_policy": "supporting context only"
},
"usage": { "lane": "core", "credits": 1, "billableUnits": 1 }
}The same contract works for raw chart calculation, business scoring, world signal generation, and background helio lookup. Use OpenAPI for generated clients and these examples for implementation review.
Fetch request/response examples, SDK snippets, and cookbook workflows generated from the endpoint catalog.
Generate clients, validate payloads, and inspect `x-tool-functions` metadata.
Manage keys, credits, billing state, and customer-level usage tracking.
Calculate deterministic chart, transit, lunar, synastry, compatibility, or helio background data and store it for repeated product use.
/v1/charts/natal/v1/charts/current-sky/v1/charts/transits/v1/lunar/phaseScore customer fit, message angle, and timing against a product or campaign context.
/v1/audience/insights/v1/customer/profileCreate a deep forecast job, poll until complete, and bill only after a quality-gated result is stored.
/v1/world/signals/jobs/v1/world/signals/jobs/{jobId}/v1/world/signalsRun no-AI synastry and compatibility first, then offer premium love products only when the user pays for interpretation.
/v1/charts/synastry/v1/compatibility/score/v1/experiences/love-reveal/v1/experiences/future-partner-visionErrors return JSON envelopes with `request_id` so partner support and usage logs can trace failures without exposing secrets or internal source paths.
| HTTP | Code | Meaning |
|---|---|---|
| 400 | INVALID_REQUEST | The request body failed schema validation, JSON parsing, or endpoint-specific preconditions. |
| 401 | AUTH_REQUIRED | The request did not include an API key. |
| 401 | AUTH_INVALID | The supplied API key could not be validated. |
| 402 | CREDITS_EXHAUSTED | The key or workspace does not have enough credits for the requested endpoint. |
| 403 | AUTH_FORBIDDEN | The key is valid but is not allowed to call this endpoint or billing lane. |
| 404 | NOT_FOUND | The requested resource, usually an async job id, was not found for this key. |
| 409 | IDEMPOTENCY_CONFLICT | The same Idempotency-Key was reused with a different request body. |
| 429 | RATE_LIMITED | The request exceeded the current key, plan, endpoint, or environment rate limit. |
| 502 | INVALID_RESPONSE | A model, sidecar, RAG, or generation path failed the response contract or quality gate. |
| 502 | UPSTREAM_FAILED | A required upstream provider, sidecar, or internal service failed before a valid API response was produced. |
| 503 | SERVER_MISCONFIGURED | A required production environment variable, provider mode, or internal integration is missing or malformed. |
{
"request_id": "req_...",
"error": {
"code": "CREDITS_EXHAUSTED",
"message": "Not enough credits for this request",
"details": {
"requiredCredits": 10,
"creditsRemaining": 4
}
}
}Credits are checked before work starts and recorded after successful calculation or generation. Core compute credits and AI credits stay visible in usage records. Failed requests do not create billable usage events. Async world-signal jobs reserve credits while queued or running, then charge only after the worker stores a complete quality-gated forecast.
1-4 core credits
No model call or token spend
4-8 AI credits
5+ AI credits per forecast
1 core credit per subject
Provider, model, and tokens logged
Enterprise buyers need more than endpoints. They need package stability, signed callbacks, status reporting, auditability, custom contracts, and proof that AI routes preserve output quality under real traffic.
| Capability | Status | Enterprise Requirement |
|---|---|---|
| API reference | Live | OpenAPI JSON, human docs, endpoint catalog, examples, and console links exist. |
| Self-serve console | Live beta | Customer console covers keys, plans, usage, API Lab, billing surfaces, audit trail visibility, and paginated audit CSV export. |
| Usage ledger | Live beta | Successful calls write Convex usage events with request id, endpoint, credits, lane, and model metadata. |
| Audit trail | Live beta | Authenticated console shows org-bound, redacted key/workspace audit events and exports retained rows as a paginated CSV workflow. |
| SDK packages | Release gate | Node and Python source exists; public SDK metadata, install commands, helper surface, and release gates are documented. |
| Partner webhooks | Release gate | Signed callback contract, internal delivery worker, retry queue, and dead-letter storage are implemented behind ops auth. |
| Status and SLA | Live | Public status, SLA targets, incident history, publication policy, and support boundary are documented. |
| Security and trust | Live | Public security controls, data retention, subprocessor scope, and trust page links exist. |
| Access control | Live | Public API-key custody, scope model, lifecycle, environment boundaries, browser/CORS policy, and enterprise allowlist gates are documented. |
| Observability proof | Live beta | Gateway smoke, production env gate, buyer-path usage proof, readiness, and output-quality sampling are documented. |
| Buyer onboarding | Live beta | Customer setup path covers base URL, server key, first request, retries, usage proof, output sampling, and support packet. |
| Versioning and limits | Live | Public compatibility policy, deprecation windows, sunset rules, and rate-limit response headers are documented. |
| Migration guides | Live | Public migration policy, legacy alias guidance, before/after route moves, and validation checklists are documented. |
| Examples and cookbooks | Live | Public examples expose request/response payloads, SDK snippets, and partner workflow recipes from the endpoint catalog. |
| Support escalation | Live | Public support tiers, support packet requirements, severity routing, and enterprise escalation boundaries are documented. |
| Procurement packet | Live | Public procurement checklist, buyer evidence requirements, legal/security boundaries, and signed-term gates are documented. |
| Conformance contract | Live | Public contract tests, SDK/build/env/gateway smoke checks, buyer-path proof, AI quality sampling, and evidence artifacts are documented. |
| Data processing packet | Live | Public processing purposes, data minimization rules, DSR boundaries, restricted-data list, and DPA gates are documented. |
| Compliance map | Live | Public compliance-readiness mappings connect evidence links to SOC 2-style, GDPR/data-processing, OWASP API, procurement, resilience, and AI quality review areas without certification overclaim. |
| AI governance | Live | Public acceptable-use boundaries, output-quality controls, restricted-use escalation, human-review requirements, and prohibited-use categories are documented. |
| Audit export packages and custom allowlists | Enterprise | Public access-control policy is documented; signed DPA terms, long-range audit export packages, IP allowlists, and dedicated security review packets remain customer-specific. |
| Private contracts | Enterprise | Add custom limits, private model/data terms, dedicated evals, and negotiated committed usage. |
Signed partner callbacks for async job completion, quality failures, usage records, and entitlement changes.
Public status page, public SLA targets, incident-history contract, private readiness probes, and support tiers.
Authenticated console view and paginated CSV export for retained org-bound key/workspace events, with secret-looking metadata redacted.
Public compatibility guarantees, deprecation policy, sunset requirements, and rate-limit headers for partner clients.
DPA, retention policy, subprocessors, long-range audit export packages, IP allowlist, and enterprise data-handling terms.
Major API docs make change management visible. Keep alpha changes explicit now, then formalize deprecations, migration guides, package versions, and breaking-change windows before paid enterprise scale.
Public security, observability, onboarding, SLA, and incident contracts are linked through the docs, OpenAPI, gateway, and trust page.
Docs were made easier to find from navigation, API product CTAs, redirects, sitemap, OpenAPI, and AI-readable docs files.
Business API routes, OpenAPI, console, API Lab, billing surface, usage ledger, async world-signal jobs, and SDK source are in place.