> ## Documentation Index > Fetch the complete documentation index at: https://docs.mnemom.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get effective (composed) alignment with provenance > Returns the composed canonical alignment card (platform → org → team → agent cascade applied) with _composition.field_provenance always populated. ## OpenAPI ````yaml GET /alignment/agent/{agent_id}/effective openapi: 3.1.0 info: title: Mnemom API description: >- Trust infrastructure for AI agents. Transparent alignment verification, behavioral drift detection, and accountability primitives. version: 1.0.0 contact: name: Mnemom url: https://mnemom.ai email: support@mnemom.ai license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0 servers: - url: https://api.mnemom.ai/v1 description: Production security: - BearerAuth: [] - ApiKeyAuth: [] tags: - name: A2A description: >- Public A2A AgentCard projection of the canonical alignment card, with embedded AAP attestation extension (cards-as-primitive Phase 5). - name: Agents description: Agent registration, lifecycle, and metadata. - name: Agent Containment description: Containment policies and quarantine controls. - name: Alignment description: >- Alignment manifest CRUD — canonical `/v1/alignment//` surface across platform / org / team / agent (cards-as-primitive Phase 4). - name: Analyze description: Behavioral analysis endpoints. - name: Attestation description: >- AAP attestation token JWKS surface and platform-admin signing-key rotation (cards-as-primitive Phase 5). - name: Auth description: Authentication, sessions, and access management. - name: Billing description: Subscription, usage, and invoicing. - name: Blog description: Public blog content. - name: Card Templates description: Org-level alignment and protection card templates. - name: Catalog description: >- Discovery surface for the 25-entry Mnemom value catalog v1 (cards-as-primitive Phase 4). - name: Checkpoints description: Integrity checkpoints and proof artifacts. - name: Conscience Values description: Org-level conscience-value configuration. - name: Drift description: Drift detection and resolution. - name: Enforcement description: Enforcement-mode configuration and queries. - name: Governance description: Operator-actionable governance signals (ADR-048). - name: Integrity description: AIP integrity checkpoints and verdicts. - name: Intelligence description: Intelligence reports and queries. - name: Licensing description: License management. - name: Network description: >- Protection Network L4 thermometer read surface. Public-aggregate disclosure: any authenticated principal may read; rows carry no per-tenant identifiers. - name: OAuth description: >- OAuth 2.1 authorization-code + PKCE flow for MCP clients (MNE-328). Identity delegated to Supabase GoTrue; mnemom-api mints its own short-lived MCP-scoped tokens. Includes RFC 7591 dynamic client registration and RFC 7009 revocation. - name: On-Chain description: On-chain verification and proofs. - name: Organizations description: Org-level resources and management. - name: Policy description: Policy evaluation and configuration. - name: Postures description: Trust posture management (ADR-045). - name: Protection description: >- Protection manifest CRUD — canonical `/v1/protection//` surface across platform / org / team / agent (cards-as-primitive Phase 4). - name: Recipes description: >- Customer-facing detection-recipe surface — FN/FP reports. Distinct from the Admin recipe-promotion surface and the Internal seeding surface. - name: Reclassification description: Reclassification workflows. - name: Reputation description: Per-agent reputation scores. - name: Risk description: Risk assessment endpoints. - name: Safe House description: Safe House threat detection and quarantine. - name: Sideband description: Sideband detection queries (legacy; sunsetting). - name: Team Reputation description: Team-level reputation aggregates. - name: Teams description: Team-scope resources. - name: Tools description: >- Mnemom-side tools registry — per-tool class+domain+schema metadata (cards-as-primitive Phase 4). - name: Traces description: AP-Trace artifacts and queries. - name: Transparency description: >- Append-only public log of every canonical card identity ever composed. Signed Merkle root + per-row inclusion proofs (cards-as-primitive Phase 5). - name: Trust description: >- Protection Network L5 public-trust surface — security advisories, IoC feed (STIX 2.1), and platform-admin CMS for both. - name: Verification description: Trace verification endpoints. - name: Webhook Notifications description: Webhook event subscription management. - name: Webhooks description: Webhook delivery and lifecycle. - name: Misc description: >- Miscellaneous operator-facing endpoints (contact, enterprise inquiries, compliance). - name: Notifications description: >- Reactive notification channels — SSE stream + signed-webhook subscriptions for canonical card changes (cards-as-primitive Phase 5). paths: /alignment/agent/{agent_id}/effective: get: tags: - Alignment summary: Get effective (composed) alignment with provenance description: >- Returns the composed canonical alignment card (platform → org → team → agent cascade applied) with `_composition.field_provenance` always populated. The provenance map carries per-key `{layer, layer_id?, kind?}` entries showing which authoring scope contributed each leaf. Caller-aware redaction: layer labels (`platform` / `org` / `team` / `agent` / `derived`) are always visible; `layer_id` is only revealed to callers who can read that scope. cards-as-primitive Phase 4 W2.2. operationId: getAlignmentEffectiveByAgent parameters: - $ref: '#/components/parameters/AgentId' responses: '200': description: Composed effective card with per-key field_provenance. headers: ETag: description: '`"sha256:"` of the composed body.' schema: type: string X-Card-Version: description: Monotonic version counter. schema: type: integer minimum: 1 content: application/json: schema: $ref: '#/components/schemas/UnifiedAlignmentCard' text/yaml: schema: $ref: '#/components/schemas/UnifiedAlignmentCard' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalServerError' security: - BearerAuth: [] - ApiKeyAuth: [] - CookieAuth: [] components: parameters: AgentId: name: agent_id in: path required: true schema: type: string description: Agent identifier (e.g. smolt-abc123) schemas: UnifiedAlignmentCard: type: object description: >- Unified alignment card (ADR-008). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. required: - card_version - agent_id - values - autonomy - audit properties: card_version: type: string description: Card schema version (e.g. `0.5.0`). card_id: type: string description: Card row id. Server-assigned on PUT (`ac-{uuid}`). agent_id: type: string description: Target agent id. On PUT, server overwrites to match the URL path. issued_at: type: string format: date-time expires_at: type: - string - 'null' format: date-time principal: type: object properties: type: type: string enum: - human - organization - agent - unspecified identifier: type: string relationship: type: string enum: - delegated_authority - advisory - autonomous escalation_contact: type: string required: - type - relationship values: type: object required: - declared properties: declared: type: array minItems: 1 items: oneOf: - type: string minLength: 1 - type: object required: - id properties: id: type: string minLength: 1 additionalProperties: type: string description: >- Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`). definitions: type: object additionalProperties: type: object properties: description: type: string priority: type: integer conflicts_with: type: array items: type: string hierarchy: type: string enum: - lexicographic - weighted - contextual conscience: type: object properties: mode: type: string enum: - augment - replace values: type: array items: type: object required: - type - content properties: type: type: string enum: - BOUNDARY - FEAR - COMMITMENT - BELIEF - HOPE content: type: string id: type: string severity: type: string enum: - advisory - mandatory required: - mode - values integrity: type: object properties: enforcement_mode: type: string enum: - observe - nudge - enforce autonomy: type: object required: - bounded_actions - escalation_triggers properties: bounded_actions: type: array items: type: string forbidden_actions: type: array items: type: string escalation_triggers: type: array items: type: object required: - condition - action - reason properties: condition: type: string action: type: string enum: - escalate - deny - log reason: type: string max_autonomous_value: type: object properties: amount: type: number currency: type: string capabilities: type: object additionalProperties: type: object properties: description: type: string tools: type: array items: type: string required_actions: type: array items: type: string enforcement: type: object properties: forbidden_tools: type: array items: type: object required: - pattern - reason - severity properties: pattern: type: string reason: type: string severity: type: string enum: - critical - high - medium - low unmapped_tool_action: type: string enum: - allow - deny - warn fail_open: type: boolean mode: type: string enum: - 'off' - warn - enforce grace_period_hours: type: integer audit: type: object required: - retention_days - queryable properties: trace_format: type: string retention_days: type: integer queryable: type: boolean query_endpoint: type: string tamper_evidence: type: - string - 'null' enum: - append_only - signed - merkle - null storage: type: object properties: type: type: string enum: - local - remote - distributed location: type: string extensions: type: object additionalProperties: true _composition: $ref: '#/components/schemas/CompositionMetadata' CompositionMetadata: type: object description: >- System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`. properties: canonical_id: type: string composed_at: type: string format: date-time scopes_applied: type: array items: type: object properties: scope: type: string description: '`platform`, `org:`, or `agent:`.' version: type: integer template_version: type: integer card_id: type: string exemptions_applied: type: array items: type: string source_card_id: type: string source_policy_id: type: string Error: type: object description: >- Canonical error envelope (ADR-API-001 conv 1). `error` is always an object — never a bare string. Every 4xx/5xx response across the API conforms to this shape; the runtime helper is `src/http-errors.ts::buildErrorBody`. required: - error properties: error: type: object required: - code - message properties: code: type: string pattern: ^[a-z][a-z0-9_]*$ description: >- Stable, machine-matchable failure identifier (lowercase snake_case). Clients may branch on this; the string is part of the contract. **Status-class defaults** — emitted when no caller code is supplied (`errorCodeForStatus(status)`): `bad_request` (400), `unauthorized` (401), `forbidden` (403), `not_found` (404), `method_not_allowed` (405), `conflict` (409), `gone` (410), `precondition_failed` (412), `payload_too_large` (413), `unsupported_media_type` (415), `unprocessable_entity` (422), `precondition_required` (428), `rate_limited` (429), `internal_error` (500), `not_implemented` (501), `bad_gateway` (502), `service_unavailable` (503), `gateway_timeout` (504). Fallback `error` for unmapped statuses. **Caller-supplied codes** — handlers may pass an explicit `code` for a specific failure class. Examples: `agent_not_found`, `invalid_hash_proof`, `already_linked`, `idempotency_conflict`, `feature_gated`, `schema_validation_failed`, `no_token`, `bad_canonical_payload`. **Care-framed sub-resource codes** — the cards-as-primitive surface passes its stable care code-string straight through as `error.code`. Examples: `if_match_absent`, `if_match_stale`, `if_match_malformed`, `primitive_validation_failed`. message: type: string description: Human-readable, care-framed explanation of the failure. details: description: >- Optional structured context for the failure (any JSON value: object, array, or primitive). Common shapes: validation findings list, idempotency-conflict diff, `{presented_etag, current_etag}` on a stale `If-Match`, etc. Mirrors the helper's `details?: unknown`. responses: BadRequest: description: Bad request content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Authentication required content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' TooManyRequests: description: >- Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 X-RateLimit-Limit: description: Requests permitted per window. schema: type: integer X-RateLimit-Remaining: description: Requests remaining in the current window (0 on a 429). schema: type: integer minimum: 0 X-RateLimit-Reset: description: Unix epoch seconds at which the current window resets. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: >- Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: 'Supabase JWT token in Authorization: Bearer header' ApiKeyAuth: type: apiKey in: header name: X-Mnemom-Api-Key description: Mnemom API key (mnm_... format) CookieAuth: type: apiKey in: cookie name: mnemom_session description: >- HttpOnly, Secure, SameSite=Lax cookie issued by /v1/auth/sign-in (or the SSO / email-callback flows). The value is an AES-256-GCM-encrypted blob of {access_token, refresh_token, issued_at, auth_method}. Browser clients include this automatically with `credentials: "include"`. ````