The schemas

One search of the whole workspace, or of one hub or collection. At least one of `q` and `filter` - a request with neither is refused by search.words_required, because "everything" is not a question this API answers. filter is the same grammar POST /items:query takes, with the same closed field vocabulary, the same operators and the same bounds. The difference between the two endpoints is not the grammar, it is the anchor: a query is anchored to a container because an unanchored one is a question authorisation cannot answer in one step, and a search is the one read where "where is this, anywhere" is the question - so it is read and then narrowed to what the caller may see, and its page may be short where a query's would be a refusal. It searches by words and, where the installation can, by meaning. The two are one ranked page with one cursor: a hit on the words somebody typed outranks one that is merely about the same subject, so an exact identifier is still found first, and an entry that shares no word with the query is found at all. mode says how much of that to use, and defaults to AUTO - the two halves where the installation has both. Semantic search is optional four times over: the database may not carry pgvector, the workspace may have configured no AI provider or not consented to it, and the provider may not answer in the second somebody is waiting. Every one of those is a lexical search rather than an error, which is why there is no SEMANTIC value to ask for - it would be a mode the server could not promise. /meta/capabilities answers semantic_search for a client that wants to say in its interface which it has.

How much of the search to use. AUTO is the default and searches by words and, where the installation has it, by meaning. LEXICAL searches by words only: it asks no provider, spends no budget and waits on nothing, which is what a caller in a loop - an automation, an import, a client's own type-ahead - wants. There is deliberately no SEMANTIC: an installation may not have it, and a mode the server cannot promise is a mode that would have to fail.

Extensible; /meta/capabilities returns the valid values.

Who did something. The label is not here: the account is one request away (GET /accounts/{accountId}) and the records that carry an actor are deleted with the thing they are about, so there is nothing for a copy of somebody's name to outlive. An identifier is absent where an account is: an automation and the system act without one, and the kind is what says so. ActivityEntry.actor is the same shape written inline - it keeps its own spelling rather than being pointed here, because changing it would rename a generated type for no behavioural gain.

An account as another member of the same tenant may see it: enough to render a name where a record carries an identifier, and nothing else. Deliberately not Account - that carries the email and the caller's own preferences, which are a different permission.

Every field is optional, and an empty string clears the preference rather than setting it to nothing — the workspace default applies again. The two the client writes for itself clear the same way, with null: celebrations back to the default, which is on; onboarding_completed_at back to "not taken", which runs the tour again.

A minted credential as it is listed afterwards. The token itself is not a member: it exists in the answer to the call that minted it and nowhere else.

Exactly one of identifier and email; neither, or both, is auth.identifier_one. A refusal of the shape, the same for everybody - nothing in it depends on who exists.

What the invitation card names before anything is typed.

A sign-in somebody can see and revoke. The client hint is what was recorded at sign-in - a user agent and an IP class, enough to recognise one's own devices and deliberately not a precise address.

The pair and its session, shown for the only time. What is stored of the refresh token is a hash under its own purpose label; the access token is not stored at all - it verifies by its signature.

How many active people of the workspace no provider switched on there signs in. A number, never a list.

What a sign-in through the identity provider needs to begin, which is almost nothing: the workspace comes from the subdomain or the tenant header, and the redirect URI is this installation's own. A caller with nothing to add may omit the body entirely.

Where to send the browser, and the handle to finish with.

What the provider's redirect carried back.

One thing AI proposed about one entry, with its provenance. It has changed nothing: what a suggestion is, is a record.

Which language to read the entry in.

The entry's title and notes as the provider rendered them in the target language, with the provenance every AI output carries. Not a record: it has no id, no status and nothing to accept, because it is not stored anywhere.

How to ask, which is one question — propose, or apply.

What the person changed or added before accepting. Merged over the proposal; every value is checked by the use case that performs the change, with the accepting person's rights.

What the suggestion is about. CONTAINER is a collection rather than an entry: a summary of how it stands is about the collection, and nothing accepts one — a collection has nowhere to put a status summary, so it is read and dismissed.

What accepting does, which is the only thing a kind has to say. FIELDS proposes values for the target entry; DECOMPOSITION proposes a tree of entries under it. A summary and a classification are FIELDS suggestions whose payload happens to be notes or labels — they are not kinds of their own, because accepting them is the same act. TEMPLATE proposes a template for the collection it targets: its payload is a TemplateInput, and accepting it is CreateTemplate performed by the accepting person. DUPLICATES is the one kind nothing accepts. It says which entries look like this one, and what to do about that is a person's decision through the ordinary use cases — :accept refuses it and :dismiss closes it. It is also the one kind no prompt produced, so its prompt_id and prompt_version are empty and its model names the embedding model whose vectors were compared.

DISMISSED is a state and not a deletion, so "what was proposed and turned down" has an answer; the retention engine ages both decided states out by rule.

How this workspace uses AI, if it does. The API key is not a member: it is sealed at configuration time and opened only by the adapter that makes the call.

The provider, set whole. A half-changed provider is one nobody can reason about, and the endpoint, the models and the key have to agree with each other.

An AI model the installation offers every workspace, as the operator reads it. A workspace is answered only its name, processor and jurisdiction (AiSource.offered).

An offered model, set whole. Consent is not here: switching an offered model on is each workspace's own act.

Which sources a workspace may use: none, only a model the installation offers, only its own (the default), or either.

Which source answers a workspace.

The least a workspace's own model must declare about where it processes content, further right being stricter.

OFFERED: each person may keep their own content out of AI. NOT_OFFERED: AI is part of everybody's work, on the legal basis the workspace named.

The legal basis a workspace names for making AI part of everybody's work.

Which adapter answers. OPENAI_COMPATIBLE covers OpenAI, Azure, Mistral, vLLM and LiteLLM, which agree on a wire format; OLLAMA is a local model; NOOP calls nothing and is what an installation has until somebody chooses otherwise.

Where the provider processes what is sent to it, as the operator declares it. It is a declaration rather than something this software can verify, and it exists so that the decision is documented rather than made by accident. SELF_HOSTED is a model this installation runs itself - no transfer to anybody. EEA and ADEQUACY are transfers Art. 45 covers. THIRD_COUNTRY is everything else and needs the operator's confirmation in the installation's configuration; the adequacy decision or the standard contractual clauses, and the transfer impact assessment, remain the operator's obligation.

A private hub as an administrator sees it: whose, how big, and when it goes if it is in the trash. Deliberately without a name.

One opening of a private hub by the workspace's owner (the emergency access): who, when, until when, and why.

A workspace as the people inside it see it. AdminTenant is the same row as the installation operator sees it, across workspaces; this one is answered to a member and carries what a member may act on.

One host a workspace answers at. The canonical one is derived from the slug under the installation's own domain and is verified by construction - the installation already answers at it - so it carries no verification mark to publish.

One numeric switch, at the three levels that decide it. Zero is off for every one of them.

One way into a workspace. A named schema, so that every reader of one shares a type.

Where a value in force came from: Hubtask's own default, the installation, the plan, or this workspace. A screen says it beside every rule, so nobody meets a value without learning who set it - and says nothing about an installation that decided nothing, which is what a private installation is.

Where a lock came from, or null where there is none. The origin is answered rather than a bare boolean because "ask your administrator" and "ask your provider" are different sentences, and a screen told the wrong one sends somebody to the wrong person.

The workspace's sign-in rule, every switch at the three levels that decide it: what is in force here, what the level above set, and whether a lock is on it. A locked switch is answered, not withheld. A setting that simply is not there is a setting somebody opens a support ticket about; one shown with its value, its reason and a control that is switched off is one they understand.

The thirteen switches about the password itself, each at its three levels.

The two bounds a session answers to beside its own expiry.

The four links, each with its own lock - B2C locks them, B2B leaves them open.

What the installation set as the default language, time zone and week start, so a workspace's screen can show it beside the workspace's own. Only what the installation decided: a key it left open is absent, and an installation that decided nothing answers an empty object. The language and time zone are what a new workspace starts with; the week start applies wherever a workspace decided none.

Every field optional; an omitted one is left alone, which is what merge-patch means. An explicit null is read as an absent key rather than as "clear it". The one field with an absent state, default_week_start, is cleared with the empty string instead; the others have none - a workspace always has a name, a locale, a zone and an answer to the enforcement question.

The switches, flat: the thirteen the password has, the two about factors and methods, the two session bounds, the four legal links, and the rotation as an action.

One provider people can sign in through. The client secret is not a member: it is sealed at configuration time and read only by the token exchange.

The preset a provider was configured from, which decides the mark its button draws GENERIC draws the letter tile - the honest answer rather than a borrowed logo. A stated kind the issuer does not belong to is refused: a Google mark over somebody else's issuer is borrowed trust on a sign-in screen.

Who this provider may admit, and what happens to whoever it admitted - the one axis with a security answer, because creating an account gives somebody an empty desk and claiming one gives them somebody else's. INVITED_ONLY admits anyone the provider vouched for and creates nothing: a verified address that meets no account here is refused. DOMAINS admits only addresses inside allowed_email_domains, and creates an account for one that meets none - so an empty list admits nobody, because the list is the mode. ANY admits every address the provider says it verified and creates what is missing, which is for a provider that is the workspace's directory. An address the provider did not vouch for is admitted by none of the three.

The provider, set whole. Discovery is performed before anything is stored, so an issuer that cannot be reached or that disagrees with its own metadata is refused here rather than by the first person who tries to sign in.

When an offered provider is withdrawn, and for Withdraw now the count confirmed.

What follows from which provider a workspace picked: the scopes its registration has to permit, whether it may sign in people nobody invited, the one thing about it that is not like the others, and the instructions for registering with it.

Whether the caller may reach the level above the workspaces, and nothing about anybody else. It answers about the account asking; it is not a directory of operators and cannot be asked about one.

The installation at a glance. Counts and states; the contents of a workspace are behind a database policy this answer does not reach through.

One act the installation recorded. The workspace is named by a bare identifier and its slug: the row it names is usually gone, which is the reason the journal exists.

How long this session carries the control plane's scope.

The ten codes, shown once and stored only as hashes.

The candidate, and the proof that the caller is entitled to an answer about it. Exactly one proof is needed; a signed-in caller's bearer is one.

One rule the candidate breaks, as an identifier and its parameters.

One switch of the installation's level: whether it decided anything, what it set, and whether a workspace may tighten it. Every switch is answered, decided or not. A reader has to be able to see that a switch exists and that this installation has left it to each workspace — which is a different fact from the switch not existing, and the only way a screen can draw the whole level without keeping a list of its own that would be wrong the day one is added.

The installation's own level: the sign-in switches, the legal links, the localisation defaults, the quota ceilings and which AI workspaces may use. Every key of every area is answered, decided or not, with set saying which. A reader has to be able to see that a setting exists and that this installation has left it to each workspace — a different fact from the setting not existing, and the only way a screen can draw the level without keeping a list that would be wrong the day one is added.

One row of the register: an account of some workspace that operates this installation.

One account, named either way. By identifier where the caller has one — a script, an automation. The workspace it lives in is read from it rather than named: a pair that could disagree is a pair somebody eventually gets wrong. By workspace and address otherwise, which is every screen. An account id is not something an operator can look up: account is behind row level security, so the control plane cannot list accounts across workspaces and therefore cannot show one. A workspace's address and the address somebody signs in with are what a person knows. The pair resolves through the register's own narrow door and answers one account or nothing — never a list, and never more than trying the identifier form already tells a caller. Exactly one of the two forms. Neither is refused as incomplete.

What a password has to meet, as data rather than as a sentence. Each switch becomes a message code with parameters in the client, and the same codes travel in field_errors[] when a password is refused - so one fact has one sentence whether the client saw the refusal coming or the server sent it. Zero is off for every count. The rules a client can decide itself are the arithmetic ones; common_passwords, breach_check, history_count and not_current name what only the server can answer, and /auth/password:check is where it does.

One way into this workspace, as a sign-in card needs it.

The links this installation's operator is obliged to show, resolved workspace -> instance -> nothing. A link that is set nowhere is absent rather than empty: a private installation owes nobody an imprint, and a footer of four links pointing nowhere is worse than no footer.

The least a sign-in screen needs, and deliberately no more.

The second step a two-step sign-in owes. The pending credential is a row with the session machinery's discipline - short-lived, single-use, revoked by the clock - and it can do nothing but complete this sign-in.

The terms of use a person is asked to agree to.