{"ok":true,"data":{"apiAccessPackages":{"knife":{"total":84,"current":83,"remaining":1},"generatedAt":"2026-07-08T11:18:37.572Z","release":"343717c","status":"api-access-watch","score":100,"actor":null,"publicSafe":true,"summary":{"headline":"API access packages are api-access-watch at 100% with 5 package(s), 10 scope(s), 5 usage plan(s), 6 host key row(s), and 6 watch signal(s).","apiBaseUrl":"https://api.reits.tech","publicBaseUrl":"https://order.reits.tech","packageCount":5,"scopeCount":10,"usagePlanCount":5,"hostProductCount":6,"hostKeyCount":6,"readyHostKeyCount":3,"allowlistWatchCount":3,"writePackageCount":1,"publicPackageCount":4,"activeProjectCount":1,"activePriceCount":3,"developerCatalogStatus":"developer-catalog-watch","apiGatewayStatus":"api-gateway-watch","ownerEndpoint":"/api/ops/api-access-packages","publicEndpoint":"/api/developer/access-packages"},"readiness":{"done":10,"total":10,"percent":100,"blockers":[]},"watchSignals":["gateway-watch","developer-catalog-watch","im-mini-app:needs-allowlist","reits-official:needs-allowlist","bbs-community:needs-allowlist","host-keys-not-issued-by-design"],"accessPackages":[{"id":"public-discovery","label":"Public discovery","audience":"official-site, REITs, BBS, docs, status checks","keyRequirement":"none","scopes":["discovery:read","catalog:read"],"routes":["GET /api/health","GET /api/sdk/config","GET /api/official/entry","GET /api/developer/catalog","GET /api/developer/access-packages"],"usagePlan":"public-read","approval":"auto-public","liveWrites":false},{"id":"developer-sandbox","label":"Developer sandbox","audience":"partner developers, QA, frontend/backend integration","keyRequirement":"optional host key before production; Idempotency-Key required for sandbox POST","scopes":["catalog:read","sandbox:simulate"],"routes":["POST /api/developer/sandbox/custom-order","GET /api/orders/schema"],"usagePlan":"sandbox-build","approval":"self-serve until production write scope","liveWrites":false},{"id":"host-embed-standard","label":"Host embed standard","audience":"matrixantai.com, official site, REITs pages, BBS, partner landing pages","keyRequirement":"scoped host product key + allowed origin + OpenSDK signature","scopes":["tenant:read","sdk:session","routing:preview","calendar:read"],"routes":["GET /sdk.js","POST /api/sdk/session/exchange","GET /api/member-publish-kits/:publishHash","POST /api/routing/preview"],"usagePlan":"host-standard","approval":"owner approves host, origin, scopes, and callback event list","liveWrites":false},{"id":"custom-order-write","label":"Custom order write","audience":"approved host products, IM mini app, commercial pilots","keyRequirement":"restricted host key + Idempotency-Key + project/merchant attribution","scopes":["custom_order:write","sandbox:simulate","im_core:bridge"],"routes":["POST /api/custom-orders","POST /api/integrations/im-core/order"],"usagePlan":"write-controlled","approval":"manual owner/admin approval; finance/payment/trading remains out of scope","liveWrites":true},{"id":"owner-admin-ops","label":"Owner/admin operations","audience":"owner, admin, QA, architecture","keyRequirement":"login token only; no host key","scopes":["ops:read"],"routes":["GET /api/ops/api-access-packages","GET /api/ops/api-gateway-readiness","GET /api/ops/developer-api-catalog"],"usagePlan":"owner-admin","approval":"internal account permission","liveWrites":false}],"scopedPermissions":[{"scope":"discovery:read","lane":"public","description":"Read health, SDK config, official entry, manifest, and acceptance posture."},{"scope":"catalog:read","lane":"developer","description":"Read API catalog, docs pages, examples, smoke scripts, and error map."},{"scope":"sandbox:simulate","lane":"developer","description":"Call no-mutation custom_order sandbox with Idempotency-Key."},{"scope":"tenant:read","lane":"host","description":"Resolve public tenant hash pages, publish kits, and member-safe routing metadata."},{"scope":"sdk:session","lane":"host","description":"Exchange signed OpenSDK sessions for allowed hosts."},{"scope":"routing:preview","lane":"host","description":"Preview non-PII smart-routing answers before redirecting users."},{"scope":"custom_order:write","lane":"partner-write","description":"Create idempotent custom_order rows for approved host products."},{"scope":"im_core:bridge","lane":"im","description":"Bridge IM mini app custom_order writes with the same idempotency contract."},{"scope":"calendar:read","lane":"host","description":"Read approved-booking .ics feed metadata and calendar publish posture."},{"scope":"ops:read","lane":"owner-admin","description":"Read owner/admin readiness boards; never available in public host keys."}],"usagePlans":[{"id":"public-read","label":"Public read","ratePerMinute":120,"burst":40,"monthlyQuota":100000,"routes":["GET discovery/catalog"],"keyRequired":false},{"id":"sandbox-build","label":"Sandbox build","ratePerMinute":60,"burst":20,"monthlyQuota":20000,"routes":["GET docs","POST sandbox"],"keyRequired":false},{"id":"host-standard","label":"Host standard","ratePerMinute":90,"burst":30,"monthlyQuota":50000,"routes":["OpenSDK session","routing preview","publish kit"],"keyRequired":true},{"id":"write-controlled","label":"Write controlled","ratePerMinute":30,"burst":10,"monthlyQuota":8000,"routes":["custom_order write","IM bridge"],"keyRequired":true},{"id":"owner-admin","label":"Owner/admin","ratePerMinute":120,"burst":40,"monthlyQuota":100000,"routes":["ops read models"],"keyRequired":false}],"hostProducts":[{"id":"matrixantai-home","label":"MatrixAntai official home","owner":"Official Site","origin":"https://matrixantai.com","packageId":"host-embed-standard","scopes":["tenant:read","sdk:session","routing:preview","calendar:read"],"channel":"official-site"},{"id":"order-official","label":"Matrix Order official app","owner":"Order Platform","origin":"https://order.reits.tech","packageId":"public-discovery","scopes":["discovery:read","catalog:read"],"channel":"order-home"},{"id":"im-mini-app","label":"IM Core mini app","owner":"IM Core","origin":"https://api.reits.tech","packageId":"custom-order-write","scopes":["sandbox:simulate","custom_order:write","im_core:bridge"],"channel":"im"},{"id":"reits-official","label":"REITs official portal","owner":"REITs","origin":"https://reits.tech","packageId":"host-embed-standard","scopes":["tenant:read","sdk:session","routing:preview"],"channel":"reits"},{"id":"bbs-community","label":"BBS community","owner":"BBS","origin":"https://bbs.reits.tech","packageId":"developer-sandbox","scopes":["catalog:read","sandbox:simulate","routing:preview"],"channel":"bbs"},{"id":"partner-member-pages","label":"Third-party member pages","owner":"Member Success","origin":"member-owned HTTPS origins","packageId":"host-embed-standard","scopes":["tenant:read","sdk:session","calendar:read"],"channel":"partner"}],"hostProductKeys":[{"id":"hpk_host-key:matrixant","hostId":"matrixantai-home","hostLabel":"MatrixAntai official home","owner":"Official Site","channel":"official-site","packageId":"host-embed-standard","packageLabel":"Host embed standard","origin":"https://matrixantai.com","allowedHost":"allowed","status":"ready-for-scoped-key","scopes":["tenant:read","sdk:session","routing:preview","calendar:read"],"keyPrefix":"mk_host_","fingerprintPreview":"sha256:fingerprint:matrixantai-","keyMaterial":"not-generated-public-safe","rotationCadenceDays":180,"lastRotatedAt":null,"nextRotationDue":"manual-before-production-share","usagePlan":"host-standard"},{"id":"hpk_host-key:order-off","hostId":"order-official","hostLabel":"Matrix Order official app","owner":"Order Platform","channel":"order-home","packageId":"public-discovery","packageLabel":"Public discovery","origin":"https://order.reits.tech","allowedHost":"allowed","status":"ready-for-scoped-key","scopes":["discovery:read","catalog:read"],"keyPrefix":"mk_host_","fingerprintPreview":"sha256:fingerprint:order-offici","keyMaterial":"not-generated-public-safe","rotationCadenceDays":180,"lastRotatedAt":null,"nextRotationDue":"manual-before-production-share","usagePlan":"public-read"},{"id":"hpk_host-key:im-mini-a","hostId":"im-mini-app","hostLabel":"IM Core mini app","owner":"IM Core","channel":"im","packageId":"custom-order-write","packageLabel":"Custom order write","origin":"https://api.reits.tech","allowedHost":"needs-allowlist","status":"needs-host-allowlist","scopes":["sandbox:simulate","custom_order:write","im_core:bridge"],"keyPrefix":"mk_live_restricted_","fingerprintPreview":"sha256:fingerprint:im-mini-app:","keyMaterial":"not-generated-public-safe","rotationCadenceDays":90,"lastRotatedAt":null,"nextRotationDue":"manual-before-live-write","usagePlan":"write-controlled"},{"id":"hpk_host-key:reits-off","hostId":"reits-official","hostLabel":"REITs official portal","owner":"REITs","channel":"reits","packageId":"host-embed-standard","packageLabel":"Host embed standard","origin":"https://reits.tech","allowedHost":"needs-allowlist","status":"needs-host-allowlist","scopes":["tenant:read","sdk:session","routing:preview"],"keyPrefix":"mk_host_","fingerprintPreview":"sha256:fingerprint:reits-offici","keyMaterial":"not-generated-public-safe","rotationCadenceDays":180,"lastRotatedAt":null,"nextRotationDue":"manual-before-production-share","usagePlan":"host-standard"},{"id":"hpk_host-key:bbs-commu","hostId":"bbs-community","hostLabel":"BBS community","owner":"BBS","channel":"bbs","packageId":"developer-sandbox","packageLabel":"Developer sandbox","origin":"https://bbs.reits.tech","allowedHost":"needs-allowlist","status":"needs-host-allowlist","scopes":["catalog:read","sandbox:simulate","routing:preview"],"keyPrefix":"mk_host_","fingerprintPreview":"sha256:fingerprint:bbs-communit","keyMaterial":"not-generated-public-safe","rotationCadenceDays":180,"lastRotatedAt":null,"nextRotationDue":"manual-before-production-share","usagePlan":"sandbox-build"},{"id":"hpk_host-key:partner-m","hostId":"partner-member-pages","hostLabel":"Third-party member pages","owner":"Member Success","channel":"partner","packageId":"host-embed-standard","packageLabel":"Host embed standard","origin":"member-owned HTTPS origins","allowedHost":"per-member-approval","status":"ready-for-scoped-key","scopes":["tenant:read","sdk:session","calendar:read"],"keyPrefix":"mk_host_","fingerprintPreview":"sha256:fingerprint:partner-memb","keyMaterial":"not-generated-public-safe","rotationCadenceDays":180,"lastRotatedAt":null,"nextRotationDue":"manual-before-production-share","usagePlan":"host-standard"}],"approvalWorkflow":[{"id":"request","label":"Request package","owner":"Developer / Member Success","evidence":"host product, origin, packageId, scopes, callback URL, support owner"},{"id":"review-origin","label":"Review origin and product boundary","owner":"Architecture / Security","evidence":"HTTPS origin, allowed host, CORS/CSP, no payment/trading scope"},{"id":"approve-scopes","label":"Approve least-privilege scopes","owner":"Owner/Admin","evidence":"package scopes match routes and audience"},{"id":"issue-key","label":"Issue key out-of-band","owner":"Owner/Admin","evidence":"key shown once in secure channel; store only fingerprint/metadata"},{"id":"smoke","label":"Run host smoke","owner":"QA","evidence":"health, catalog, sandbox, SDK config, manifest, optional custom_order write dry-run"},{"id":"rotate-revoke","label":"Rotate or revoke","owner":"Operations","evidence":"rotation cadence, incident revoke, disabled host origin"}],"keyLifecycle":[{"id":"never-commit","label":"Never commit host keys","status":"required","evidence":"keys are not generated by this read model and are never included in public payloads"},{"id":"prefix-fingerprint-only","label":"Store prefix and fingerprint only","status":"planned","evidence":"hostProductKeys expose prefix/fingerprintPreview, not material"},{"id":"mode-separation","label":"Sandbox vs live separation","status":"required","evidence":"sandbox calls use no-mutation endpoint; live writes require restricted key and Idempotency-Key"},{"id":"rotate","label":"Rotate keys","status":"planned","evidence":"90 days for write-controlled, 180 days for host-standard"},{"id":"revoke","label":"Revoke by host/product/scope","status":"planned","evidence":"owner/admin route tracks revoke runbook before active key issuance"}],"headerContract":[{"header":"Authorization","value":"Bearer <host-product-key>","requiredFor":["host-standard","write-controlled"],"publicSafe":false},{"header":"Idempotency-Key","value":"<stable-unique-request-key>","requiredFor":["developer-sandbox","custom-order-write"],"publicSafe":true},{"header":"X-Matrix-Host","value":"<origin or host product id>","requiredFor":["host-standard","write-controlled"],"publicSafe":true},{"header":"X-Matrix-Signature","value":"<HMAC over canonical payload>","requiredFor":["OpenSDK session"],"publicSafe":false}],"smokeScripts":[{"id":"access-packages","command":"curl -fsS https://api.reits.tech/api/developer/access-packages","purpose":"Confirm public package, scope, usage plan, and host-key contract."},{"id":"catalog","command":"curl -fsS https://api.reits.tech/api/developer/catalog","purpose":"Confirm catalog links to access package docs."},{"id":"sandbox","command":"curl -fsS -X POST https://api.reits.tech/api/developer/sandbox/custom-order -H 'Idempotency-Key: package-smoke-001' -H 'Content-Type: application/json' -d '{\"projectSlug\":\"matrix-public-appointment\",\"customCategory\":\"quote\"}'","purpose":"Confirm no-mutation package smoke path."},{"id":"manifest","command":"curl -fsS https://api.reits.tech/api/launch/manifest","purpose":"Confirm access packages are discoverable by host products."},{"id":"im-core","command":"curl -fsS https://api.reits.tech/healthz","purpose":"Confirm IM routes coexist with the order API host-key plan."}],"linkedSurfaces":{"apiAccessPackages":"/api/developer/access-packages","apiAccessPackagesOps":"/api/ops/api-access-packages","developerApiCatalog":"/api/developer/catalog","developerSandboxCustomOrder":"/api/developer/sandbox/custom-order","apiGatewayReadiness":"/api/ops/api-gateway-readiness","sdkConfig":"/api/sdk/config","launchManifest":"/api/launch/manifest","launchAcceptance":"/api/launch/acceptance"},"designPatterns":[{"id":"aws-usage-plans","label":"AWS API Gateway usage plans and API keys","adaptation":"Model package-level rate, burst, quota, and key requirement before real gateway policy enforcement."},{"id":"apigee-developer-apps","label":"Apigee API products and developer apps","adaptation":"Attach host products to API-product bundles, approve/revoke keys by product, and track app attributes."},{"id":"azure-apim-subscriptions","label":"Azure API Management products/subscriptions","adaptation":"Treat each host product as a subscription to product-scoped APIs with subscription-key style governance."},{"id":"stripe-restricted-keys","label":"Stripe restricted/test/live keys","adaptation":"Separate sandbox/live modes, keep least-privilege restricted scopes, rotate, revoke, and never expose key material twice."}],"guardrails":["API Access Packages is public-safe and returns only package metadata, allowed scopes, usage plans, key prefixes, and fingerprint previews; no plaintext host key material is generated or exposed.","Host product keys are scoped by package, route, origin, and permission; public discovery and sandbox stay separate from write-controlled custom_order access.","Write-controlled packages still require Idempotency-Key, merchant attribution, no payment/trading behavior, and owner/admin approval before any live key is issued.","Owner/admin ops can review package posture and host key rows, but this knife does not mutate DNS, Nginx, CloudFront, S3, bookings, orders, billing, IM, OpenSDK sessions, or external SaaS state."],"references":["AWS API Gateway usage plans: API keys identify clients and map them to deployed stages/methods with throttling and quotas.","Google Apigee API products: keys are provisioned for product bundles in developer apps, not isolated endpoint guesses.","Azure API Management subscriptions: API consumers call product APIs with subscription keys and product-scoped access.","Stripe restricted keys: use sandbox/live separation, limited permissions, secure storage, rotation, and revocation."]}}}