Agent-readable docs index: /llms.txt. Full docs in one file: /llms-full.txt. Download /docs.zip to grep all markdown files locally.

Guardian and service registry

/api/v1/owner/workspaceGET
Saved guardian drafts, immutable published policy references and installed service adapters. Single-installation scope; not a multi-tenant API.
Examples are synthetic and illustrate response shape; IDs, signatures, and credentials are not usable authority.
Authorization
ownerSession *cookie halfspan_session
Authenticated HttpOnly owner session. Not an executor credential.
Response
200 · Successful response. A paused run is an application outcome, not an HTTP error.
guardians *object[]
Show item properties
id *string
draft *object
Show properties
name *string
Min length: 2Max length: 100
serviceId?string | null
Default: null
environment?"demo" | "staging" | "production"
Default: "demo"
channels?"browser" | "http" | "mcp" | "webmcp"[]
Default: []Max items: 4
operations?string[]
Default: []Max items: 30
mode?"exact" | "bounded"
Default: "exact"
budgetCents?string
Default: "13700"Pattern: ^(0|[1-9]\d*)$Max length: 18
instructions?string
Default: ""Max length: 4000
provider?"openai" | "kimi" | "openrouter"
Default: "openai"
revision *integer
Min: -9007199254740991Max: 9007199254740991
publishedVersion *integer | null
published *object | null
Show options
Any of:
Option 1
name *string
Min length: 2Max length: 100
serviceId?string | null
Default: null
environment?"demo" | "staging" | "production"
Default: "demo"
channels?"browser" | "http" | "mcp" | "webmcp"[]
Default: []Max items: 4
operations?string[]
Default: []Max items: 30
mode?"exact" | "bounded"
Default: "exact"
budgetCents?string
Default: "13700"Pattern: ^(0|[1-9]\d*)$Max length: 18
instructions?string
Default: ""Max length: 4000
provider?"openai" | "kimi" | "openrouter"
Default: "openai"
Option 2
Type: null
verification *object | null
Show options
Any of:
Option 1
revision *integer
Min: -9007199254740991Max: 9007199254740991
checkedAt *string
passed *boolean
checks *object[]
Show item properties
name *string
passed *boolean
detail *string
Option 2
Type: null
publishedVerification *object | null
Show options
Any of:
Option 1
revision *integer
Min: -9007199254740991Max: 9007199254740991
checkedAt *string
passed *boolean
checks *object[]
Show item properties
name *string
passed *boolean
detail *string
Option 2
Type: null
updatedAt *string
services *object[]
Show item properties
id *string
name *string
environment *"demo" | "staging" | "production"
adapter *"merchant" | "bank" | "broker" | null
target *"local" | "hosted" | null
origin *stringnull
gateway *stringnull
channels *"browser" | "http" | "mcp" | "webmcp"[]
operations *object[]
Show item properties
id *string
label *string
endpoint *string
disclosure *string
effect *"read" | "write"
callerRequirement *string
integration *string
400 · Request validation failed.
error *string
reasonCode?string
401 · Sign in to the Halfspan workspace.
error *string
reasonCode?string
403 · Console requests must come from the local owner workspace.
error *string
reasonCode?string
500 · The local service could not complete this request.
error *string
reasonCode?string
Request example
curl -X GET "https://service.example.com/api/v1/owner/workspace" \
  -b "halfspan_session=<token>"
Response example
{
  "guardians": [
    {
      "id": "00000000-0000-4000-8000-000000000001",
      "draft": {
        "name": "Checkout guardian",
        "serviceId": "local-merchant",
        "environment": "demo",
        "channels": [
          "http"
        ],
        "operations": [
          "merchant.catalog",
          "merchant.prepare",
          "merchant.purchase",
          "merchant.status"
        ],
        "mode": "exact",
        "budgetCents": "13700",
        "instructions": "Review the approved keyboard purchase.",
        "provider": "openai"
      },
      "revision": 1,
      "publishedVersion": null,
      "published": null,
      "verification": null,
      "publishedVerification": null,
      "updatedAt": "2026-10-27T12:00:00Z"
    }
  ],
  "services": [
    {
      "id": "local-merchant",
      "name": "Fieldwork simulator",
      "environment": "demo",
      "adapter": "merchant",
      "target": "local",
      "origin": "http://127.0.0.1:4301",
      "gateway": "http://127.0.0.1:4301/api/v1/operation",
      "channels": [
        "browser",
        "http",
        "mcp",
        "webmcp"
      ],
      "callerRequirement": "Run-scoped service credential and single-use step permit. Owner-approved grants are required.",
      "integration": "Built-in synthetic adapter. Verify the boundary before activation.",
      "operations": [
        {
          "id": "merchant.catalog",
          "label": "Product catalog",
          "endpoint": "/api/v1/operation",
          "disclosure": "seller, product, price, destination",
          "effect": "read"
        },
        {
          "id": "merchant.prepare",
          "label": "Prepare transaction",
          "endpoint": "/api/v1/operation",
          "disclosure": "Exact terms, total, revision and expiry",
          "effect": "write"
        },
        {
          "id": "merchant.purchase",
          "label": "Purchase keyboard",
          "endpoint": "/api/v1/operation",
          "disclosure": "Execution receipt",
          "effect": "write"
        },
        {
          "id": "merchant.status",
          "label": "Verify result",
          "endpoint": "/api/v1/operation",
          "disclosure": "Transaction status",
          "effect": "read"
        }
      ]
    },
    {
      "id": "local-bank",
      "name": "Bank simulator",
      "environment": "demo",
      "adapter": "bank",
      "target": "local",
      "origin": "http://127.0.0.1:4302",
      "gateway": "http://127.0.0.1:4302/api/v1/operation",
      "channels": [
        "browser",
        "http",
        "mcp",
        "webmcp"
      ],
      "callerRequirement": "Run-scoped service credential and single-use step permit. Owner-approved grants are required.",
      "integration": "Built-in synthetic adapter. Verify the boundary before activation.",
      "operations": [
        {
          "id": "bank.beneficiary",
          "label": "Beneficiary",
          "endpoint": "/api/v1/operation",
          "disclosure": "source, beneficiary, amount, fee",
          "effect": "read"
        },
        {
          "id": "bank.prepare",
          "label": "Prepare transaction",
          "endpoint": "/api/v1/operation",
          "disclosure": "Exact terms, total, revision and expiry",
          "effect": "write"
        },
        {
          "id": "bank.transfer",
          "label": "Submit transfer",
          "endpoint": "/api/v1/operation",
          "disclosure": "Execution receipt",
          "effect": "write"
        },
        {
          "id": "bank.status",
          "label": "Verify result",
          "endpoint": "/api/v1/operation",
          "disclosure": "Transaction status",
          "effect": "read"
        }
      ]
    },
    {
      "id": "local-broker",
      "name": "Broker simulator",
      "environment": "demo",
      "adapter": "broker",
      "target": "local",
      "origin": "http://127.0.0.1:4303",
      "gateway": "http://127.0.0.1:4303/api/v1/operation",
      "channels": [
        "browser",
        "http",
        "mcp",
        "webmcp"
      ],
      "callerRequirement": "Run-scoped service credential and single-use step permit. Owner-approved grants are required.",
      "integration": "Built-in synthetic adapter. Verify the boundary before activation.",
      "operations": [
        {
          "id": "broker.quote",
          "label": "Quote",
          "endpoint": "/api/v1/operation",
          "disclosure": "account, instrument, quantity, limit price",
          "effect": "read"
        },
        {
          "id": "broker.prepare",
          "label": "Prepare transaction",
          "endpoint": "/api/v1/operation",
          "disclosure": "Exact terms, total, revision and expiry",
          "effect": "write"
        },
        {
          "id": "broker.order",
          "label": "Place limit order",
          "endpoint": "/api/v1/operation",
          "disclosure": "Execution receipt",
          "effect": "write"
        },
        {
          "id": "broker.status",
          "label": "Verify result",
          "endpoint": "/api/v1/operation",
          "disclosure": "Transaction status",
          "effect": "read"
        }
      ]
    },
    {
      "id": "hosted-fieldwork",
      "name": "Fieldwork Store · Cloudflare",
      "environment": "demo",
      "adapter": "merchant",
      "target": "hosted",
      "origin": "https://crossexample-storefront-demo-773s46d3ngpkzraz.shapes-app.workers.dev",
      "gateway": null,
      "channels": [
        "browser"
      ],
      "callerRequirement": "Signed session plus exact single-use request permit.",
      "integration": "Existing hosted demo adapter. Automated remote boundary verification is not connected to guardian activation.",
      "operations": [
        {
          "id": "merchant.catalog",
          "label": "Product catalog",
          "endpoint": "/api/session",
          "disclosure": "seller, product, price, destination",
          "effect": "read"
        },
        {
          "id": "merchant.prepare",
          "label": "Prepare transaction",
          "endpoint": "/api/cart",
          "disclosure": "Exact terms, total, revision and expiry",
          "effect": "write"
        },
        {
          "id": "merchant.purchase",
          "label": "Purchase keyboard",
          "endpoint": "/api/checkout",
          "disclosure": "Execution receipt",
          "effect": "write"
        },
        {
          "id": "merchant.status",
          "label": "Verify result",
          "endpoint": "/api/session",
          "disclosure": "Transaction status",
          "effect": "read"
        }
      ]
    }
  ]
}