AIR Projects
Per-project document uploads via presigned object storage (upload-init → PUT to returned URL → upload-complete) so bytes never cross the API process.
List project documents
Returns document sources (`kind === 'document'`) for the project. Pass `includeArchived: true` to include archived sources. Requires project access; returns 404 when `projectPid` is unknown or not visible.
List project document artifacts
Returns document-derived artifacts for the project. Includes archived artifacts when `includeArchived` is true. Requires project access; returns 404 when `projectPid` is unknown or not visible.
Get artifact details
Returns full artifact metadata for `artifactPid` scoped to `projectPid`. Requires project access; returns 404 when the project or artifact is unknown or not visible.
Hard-delete artifact
Permanently deletes the artifact row and cleans up its extracted-text media. Returns 409 when the artifact is cited by any assessment — cited evidence may only be archived via `archiveArtifact`, never destroyed. Requires project access; returns 404 when the project or artifact is unknown or not visible.
Get artifact extracted text
Returns the artifact's extracted text, truncated to the preview byte limit when stored in media. Requires project access; returns 404 when the project, artifact, or backing media is unknown or not visible.
List project sources
Returns all sources for the project. Filters by `kind` when the query parameter is set. Requires project access; returns 404 when `projectPid` is unknown or not visible.
Connect a source integration
Creates a connector-backed source (`github_repo`, `databricks_workspace`) for the project: validates `config` and `credentials` against the connector schemas, encrypts the credentials into the secrets store, then dispatches `IngestSourceWorkflow` to pull artifacts. Returns 400 when the kind has no registered connector or the config/credentials do not match its schema. Requires project access.
Look up project by slugs
Resolves a project by `orgSlug`, `domainSlug`, and `projectSlug` and returns its summary. Requires access to the org; returns 404 when any slug in the chain is unknown or not visible to the caller.
Start presigned document upload
Returns a presigned PUT `uploadUrl` and `s3Key` for uploading the original bytes directly to object storage. Caller must PUT the file to `uploadUrl`, then call `upload-complete` with the same `s3Key`. Requires project access; returns 404 when `projectPid` is unknown or not visible.
Complete presigned document upload
Finalizes a presigned upload after bytes are in storage: creates the media row and document source, then dispatches `ExtractDocumentArtifactsWorkflow`. Returns `sourcePid` and `workflowPid` for lifecycle tracking. Requires project access; returns 404 when `projectPid` is unknown or not visible.
Get presigned document download URL
Returns a time-limited `downloadUrl` and `filename` for the document's original blob. Requires project access; returns 404 when the source, project, or original media is unknown or not visible.
Delete document source
Hard-deletes the document source. Derived artifacts are archived (preserved as assessment evidence), not destroyed — there is no assessment-usage conflict on this route. Requires project access; returns 404 when the source or project is unknown or not visible.
Archive artifact
Archives `artifactPid` within `projectPid`, preserving it as assessment evidence without deleting the row. Requires project access; returns 404 when the project or artifact is unknown or not visible.
Archive document source
Archives the document source without deleting it. Archived sources are omitted from default list calls unless `includeArchived` is true. Requires project access; returns 404 when the source or project is unknown or not visible.
Unarchive document source
Restores an archived document source to active status. Requires project access; returns 404 when the source or project is unknown or not visible.
Re-run document extraction
Re-reads the stored original blob, re-parses, and idempotently replaces the artifact and chunks by dispatching `ExtractDocumentArtifactsWorkflow`. Returns `sourcePid` and `workflowPid` so the caller can resubscribe to lifecycle events. Returns 409 when the source is already `processing` or still has an active (non-archived) artifact. Requires project access; returns 404 when the source or project is unknown or not visible.
Re-sync a connector source
Re-runs ingestion for an existing connector source. Unchanged remote content is skipped via fingerprint dedup; new or changed content produces fresh artifacts. Returns 409 while a sync is already `processing`, 400 for sources without a registered connector (e.g. `document`). Requires project access.
Test connector credentials
Validates `config`/`credentials` against the connector schemas and performs a live connection check against the remote system without persisting anything. Returns the health status so the UI can confirm a token works before saving. Returns 400 when the kind has no registered connector or the shapes are invalid.
List saved answers for a project
Returns active developer choices for the project, each judged against the given assessment. Requires project access.
Save a developer choice
Records that a topic does not apply, or that one control gap is accepted. `accept_gap` requires `controlId`; `not_applicable` must not send one. The assessment must belong to the project. A later choice for the same topic or control replaces the earlier one. The choice remembers the evidence and the seriousness the scan showed for the topic. Later scans judge it; the scan it was recorded on does not. A 'does not apply' stands while the topic is raised on that same evidence, and comes back (`posture: conflicts` with `cameBackBecause`) when the topic is more serious, cites evidence not seen before, or is due for review after six months. Requires project write access.
List kept EU AI Act answers
Returns active answers kept on the project. Each value is the stored JSON. Superseded answers are omitted. Requires projects:read.
List the EU AI Act checklist to ask before a scan
Returns the checklist lines that open each EU AI Act check, and the question for each of their facts, without facts the project already holds an answer for. 'None of these' answers each fact no: false, or [] for a list fact. Save the answers with the prepared-answers endpoint once the scan has started. Requires projects:read.
Show whether the AIR rules have moved on
due is true when the latest completed scan used a different catalog or tier method than the current one, and nobody has said later to the current pair. lastCompleted carries the stored tier and the tier the same facts give under the current rules. postponed says who said later to the current rules, and when. No completed scan means not due. Requires projects:read.
Record a later on the current AIR rules
Records that the person chose not to update to the current AIR rules, with who and when. A second call keeps the first record. The notice is due again only when the rules move past this version. Returns 409 when the latest completed scan already uses the current rules. Requires projects:write.