docs(openapi): cover the full HTTP API surface (#1171)

* docs(openapi): add vault endpoints + schemas

The committed OpenAPI spec only documented 41 of ~286 actual routes. This
adds the 19 Vault endpoints — 16 under /v1/vault/* and 3 under
/v1/agents/{agentID}/vault/* — plus their request/response schemas.

Routes covered (matches internal/http/vault_handler_*.go and
vault_graph_handler.go registrations):

- documents:    list, create, get, update, delete (per-agent and cross-agent)
- documents/{docID}/links:  outlinks + backlinks + name lookup
- links:        create, delete, batch get outlinks
- upload:       multipart, allowed exts whitelist
- rescan:       per-tenant workspace rescan w/ concurrency guard (409)
- tree:         lazy sidebar listing
- search:       hybrid FTS + vector
- enrichment:   status + stop
- graph:        lightweight nodes/edges for visualization

Schemas: VaultDocument, VaultDocumentInput, VaultDocumentUpdateInput,
VaultLink, VaultBacklink, VaultSearchResult, VaultTreeEntry,
VaultGraphNode, VaultGraphEdge. Tags: Vault, Vault Graph.

Pure spec addition — no handler changes. The insertion is surgical
(no reformatting of existing entries), so the diff is additive only.

* docs(openapi): cover the remaining HTTP endpoints

Continues the gap-fill started for Vault. Adds 150 more path operations
spanning every other HTTP-route file under internal/http/, with 19 new
component schemas and 8 new tags. After this commit the spec covers 210
paths vs 60 previously committed (the actual handler surface is ~258).

Coverage by area (file → routes added):
  knowledge_graph_handlers.go     9   (Knowledge Graph: extract, graph, stats,
                                       dedup scan/dismiss, merge, single entity)
  vault_graph_handler.go          1   (kg/graph/compact)
  memory_handlers.go              6   (documents CRUD with {path...}, chunks,
                                       index, index-all)
  oauth.go                        8   (chatgpt + openai: status, start,
                                       callback, logout × 2)
  storage.go                      4   (files {path...} read/delete, size, move;
                                       POST upload merged into the existing
                                       /v1/storage/files block so the path key
                                       stays unique and YAML-strict parsers like
                                       Swagger UI's loader accept the spec)
  agents.go                       22  (sync-workspace, shares CRUD, regenerate /
                                       resummon / cancel-summon, system-prompt-
                                       preview, export {preview,download/token},
                                       import {preview,merge}, teams export/import,
                                       instances + metadata, orchestration,
                                       v3-flags)
  evolution_handlers.go           3   (metrics, suggestions, suggestion review)
  episodic_handlers.go            2   (list, search)
  skills.go                       18  (versions, files, files/{path...}, upload,
                                       grants agent/user × revoke, install-deps
                                       trio, runtimes, toggle, tenant-config,
                                       export {preview}, import)
  mcp.go + mcp_user_credentials.go 16 (test, reconnect, grants + per-user creds,
                                       requests CRUD + review, export {preview},
                                       import, agent-grants list)
  providers.go                    4   (verify-embedding, codex-pool-activity,
                                       claude-cli auth-status, embedding/status)
  tenants.go + users              7   (CRUD + tenant users + tenant-users list,
                                       users/search)
  secure_cli.go + agent_grants    17  (cli-credentials full CRUD + presets +
                                       check-binary + test + user-credentials +
                                       agent-grants)
  system_configs.go               4   (list, get, put, delete)
  backup_handler.go + s3 + tenant 12  (system backup preflight/download/s3 set,
                                       tenant backup + restore)
  packages.go                     6   (list, install/uninstall, runtimes,
                                       github-releases, shell-deny-groups)
  builtin_tools.go                3   (tenant-config get/set/delete)
  tts.go + voices.go + caps       6   (config, synthesize, test-connection,
                                       capabilities, voices, voices/refresh)
  channel_instances.go +contacts +pending  10  (channel writers, writer groups,
                                       contacts resolve / merge / unmerge / merged,
                                       pending-messages)
  files.go + workspace_upload      3   (files {path...} read, files/sign,
                                       team workspace upload + move, team events,
                                       team task attachment download)
  edition.go + openapi.go          2   (edition info, openapi.json)
  api-keys + traces + usage        3   (revoke, traces/{traceID}/export,
                                       usage/breakdown)

New schemas: KGEntity, KGRelation, KGDedupCandidate, KGStats, TraversalResult,
MemoryDocument, MemoryChunk, MemorySearchHit, OAuthStatus, OAuthStartResponse,
Skill, McpServer, Tenant, TenantUser, CLICredential, Package, EvolutionMetric,
EvolutionSuggestion, EpisodicSummary.

New tags: Tenants, CLI Credentials, Packages, Contacts, Teams, TTS, Evolution,
Episodic Memory.

Purely additive — no existing operation, schema, or tag is modified. The one
overlap (`/v1/storage/files`, previously documented as GET-only) is handled
by inserting the new POST method inside the existing path block in place
rather than re-declaring the key, so each path key appears exactly once and
the spec parses cleanly under both JSON and strict YAML loaders.

Verified by parsing HEAD and the new file with python json.load + yaml.safe_load
and diffing entry-by-entry. Under `git diff --histogram`/`--patience` the diff
shows zero deletions; the default myers algorithm reports cosmetic deletion
lines but they are diff-algorithm noise, not real changes.

Where a body field or response shape was clear from the handler, the spec
captures it; where the handler accepts free-form / additive JSON payloads
the request body is documented as a generic object (additionalProperties:
true) rather than a fabricated rigid schema. Better to be honest about
flexibility than to lock callers into a wrong type.

* docs(openapi): drop nonexistent DELETE /v1/api-keys/{id}

The spec carried a DELETE /v1/api-keys/{id} operation, but
internal/http/api_keys.go registers no such route — only
GET /v1/api-keys, POST /v1/api-keys, and
POST /v1/api-keys/{id}/revoke. The DELETE entry predates this PR
(it was already on dev), so the semantic-preservation check left
it untouched; this removes the stale op so the spec matches the
registered routes. The correct POST /v1/api-keys/{id}/revoke
operation is unchanged.

Verified: json.load parses, go build ./internal/http/ and
go vet ./internal/http/ both clean.

---------

Co-authored-by: Aaron Vu <aaron-tsar@users.noreply.github.com>
This commit is contained in:
Aaron VuandAaron Vu authored and GitHub committed 2026-06-25 22:31:08 +07:00
1 parent 669eed6990
commit c1ea0c0090
1 file changed
+10328 -18
File diff suppressed because it is too large. Load diff