> ## Documentation Index > Fetch the complete documentation index at: https://docs.mnemom.ai/llms.txt > Use this file to discover all available pages before exploring further. # What one subject holds in the organization, from grant. (owner/admin/auditor) > The org-admin Grants pane's read of one subject's holdings from grant. ## OpenAPI ````yaml GET /orgs/{org_id}/grants/holdings openapi: 3.1.0 info: title: Mnemom API description: >- Trust infrastructure for AI agents. Transparent alignment verification, behavioral drift detection, and accountability primitives. version: 1.0.0 contact: name: Mnemom url: https://mnemom.ai email: support@mnemom.ai license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0 servers: - url: https://api.mnemom.ai/v1 description: Production security: - BearerAuth: [] - ApiKeyAuth: [] tags: - name: A2A description: >- Public A2A AgentCard projection of the canonical alignment card, with embedded AAP attestation extension (cards-as-primitive Phase 5). - name: Agents description: Agent registration, lifecycle, and metadata. - name: Agent Containment description: Containment policies and quarantine controls. - name: Agent Groups description: >- Lightweight logical tags for bucketing an org's agents — the unscored counterpart to the scored Teams primitive. No cards, coherence, reputation, or feature gate. - name: Alignment description: >- Alignment manifest CRUD — canonical `/v1/alignment//` surface across platform / org / team / agent (cards-as-primitive Phase 4). - name: Analyze description: Behavioral analysis endpoints. - name: Aletheia Support description: >- In-product Aletheia assistant MVP (issue #2195) — chat + voice adapters over one shared answer core. Gated behind ALETHEIA_SUPPORT_MVP_ENABLED + the ALETHEIA_SUPPORT_ALLOWLIST identity allowlist (whose default is the whole @mnemom.ai domain, and which may be set to "*" to admit every authenticated identity), fail-closed 404 for every non-allowed caller. Dark by default; whether it is customer-facing depends on that env var per deployment. - name: Attestation description: >- AAP attestation token JWKS surface and platform-admin signing-key rotation (cards-as-primitive Phase 5). - name: Auth description: Authentication, sessions, and access management. - name: Billing description: Subscription, usage, and invoicing. - name: Blog description: Public blog content. - name: Card Templates description: Org-level alignment and protection card templates. - name: Catalog description: >- Discovery surface for the 25-entry Mnemom value catalog v1 (cards-as-primitive Phase 4). - name: Checkpoints description: Integrity checkpoints and proof artifacts. - name: Conscience Values description: Org-level conscience-value configuration. - name: Consent description: >- GDPR Art. 7(1) append-only consent audit log (MNE-477). Public write (banner POSTs each decision); admin-only read/export. Stores a pseudonymous subject id + truncated IP only — in addition to client-side enforcement. - name: Domains description: >- Domain ownership claims (DNS-TXT verified) + the public no-PII claim-status projection. - name: MCP Servers description: >- MCP-server ownership claims (DNS-TXT verified on the origin domain) + the public no-PII claim-status projection for the IITR MCP-readiness rubric. - name: Dojo description: >- Dojo demo shared contracts (MNE-517): SimEvent SSE narrative feed + ephemeral compute-key issuance. Internal/demo surface, not customer-facing. - name: Invite Message Template description: >- Admin-only (mnemom_staff) CRUD over the invite composer's saved, reusable invite copy (MNE-7094, 5/8 of the RG invite-permission-product epic MNE-7089). Internal/staff surface, not customer-facing. - name: Code description: >- Mnemom Agent — the governed agent launcher (`mnemom agent`). The per-org feature gate the CLI checks at startup; invites and access reuse the product-invite surface with product `code`. - name: Sponsorship description: >- Invite sponsorship (MNE-8193): a sponsor shares a personal link; a verified colleague redeems it for one of the sponsor's invite slots. Dark behind the dedicated `invite_sponsorship` flag (default off). No figures, currency or balance wording in any invitee/sponsor-facing field. Internal while dark. - name: Invites description: >- Invitee-facing product-invite redemption (MNE-7166, 6/8 of the RG invite-permission-product epic MNE-7089). Accepting a `pinv_…` token grants product access and forwards a server-owned starter grant; the grant amount is admin-only and never surfaced. - name: Coherence description: >- Coherence report-claim round-trip (MNE-1379): single-use claim-intent tickets that carry a report claim across the sign-up/email-confirm/return round-trip so no session token rides the URL — only the opaque `mci_…` ticket. - name: Drift description: Drift detection and resolution. - name: Enforcement description: Enforcement-mode configuration and queries. - name: Governance description: Operator-actionable governance signals (ADR-048). - name: Integrity description: AIP integrity checkpoints and verdicts. - name: Intelligence description: Intelligence reports and queries. - name: Licensing description: License management. - name: Network description: >- Protection Network L4 thermometer read surface. Public-aggregate disclosure: any authenticated principal may read; rows carry no per-tenant identifiers. - name: OAuth description: >- OAuth 2.1 authorization-code + PKCE flow for MCP clients (MNE-328). Identity delegated to Supabase GoTrue; mnemom-api mints its own short-lived MCP-scoped tokens. Includes RFC 7591 dynamic client registration and RFC 7009 revocation. - name: On-Chain description: On-chain verification and proofs. - name: Onboarding description: >- Onboarding guidance generation (MNE-5508) — LLM-driven step guidance + bounded action suggestions for customers completing onboarding checklists. - name: Organizations description: Org-level resources and management. - name: Policy description: Policy evaluation and configuration. - name: Postures description: Trust posture management (ADR-045). - name: Protection description: >- Protection manifest CRUD — canonical `/v1/protection//` surface across platform / org / team / agent (cards-as-primitive Phase 4). - name: Recipes description: >- Customer-facing detection-recipe surface — FN/FP reports. Distinct from the Admin recipe-promotion surface and the Internal seeding surface. - name: Reclassification description: Reclassification workflows. - name: Reputation description: Per-agent reputation scores. - name: Risk description: Risk assessment endpoints. - name: Safe House description: Safe House threat detection and quarantine. - name: Sideband description: Sideband detection queries (legacy; sunsetting). - name: Team Reputation description: Team-level reputation aggregates. - name: Teams description: Team-scope resources. - name: Tools description: >- Mnemom-side tools registry — per-tool class+domain+schema metadata (cards-as-primitive Phase 4). - name: Telemetry description: >- Public browser-RUM ingest (Core Web Vitals). Anon-eligible by design, rate-limited, closed-enum dimensions only — emits spans, persists nothing. - name: Traces description: AP-Trace artifacts and queries. - name: Transparency description: >- Append-only public log of every canonical card identity ever composed. Signed Merkle root + per-row inclusion proofs (cards-as-primitive Phase 5). - name: Trust description: >- Protection Network L5 public-trust surface — security advisories, IoC feed (STIX 2.1), and platform-admin CMS for both. - name: Mu description: >- mu-engine ledger proxy — thin pass-through to the mnemom-mu Worker (balances, budgets, staff reads). api owns auth/RBAC/org-context; the ledger lives in mnemom-mu (issue #2357). - name: Verification description: Trace verification endpoints. - name: Webhook Notifications description: Webhook event subscription management. - name: Webhooks description: Webhook delivery and lifecycle. - name: Misc description: >- Miscellaneous operator-facing endpoints (contact, enterprise inquiries, compliance). - name: Feedback description: >- Authenticated in-product feedback ingest (Aletheia Customer Voice). Redacted + consent-gated + idempotent. - name: Notifications description: >- Reactive notification channels — SSE stream + signed-webhook subscriptions for canonical card changes (cards-as-primitive Phase 5). - name: Presentations description: >- Investor/data-room presentations + per-viewer grants (MNE-1428, "Inside Mnemom"). Admin create/invite/revoke; authed-user read scoped to active grants. Internal/demo surface, not customer-facing. - name: Aletheia description: >- Aletheia grounded Q&A answer core (MNE-1937). Internal/preview surface, not customer-facing. - name: AletheiaVoice description: >- In-product Aletheia voice register (MNE-1944), the customer/anon sibling of the Presentations deck voice register. DARK: feature-flag + allowlist gated, zero customer exposure until promoted; cookie/bearer-authed like any other customer route. paths: /orgs/{org_id}/grants/holdings: get: tags: - Organizations summary: >- What one subject holds in the organization, from grant. (owner/admin/auditor) description: >- The org-admin Grants pane's read of one subject's holdings from grant. (canon mn-c0amqk, mn-9rzonp v23), proxied read-only with this API's own grant. credential: class counts of every holding by type, role, route and environment, and the holdings themselves only for resources the calling admin may read by grant.'s own standing. Owner, admin or auditor. Answers `404` exactly as an unknown route while the organization's effective `grant` capability flag is off. `400 invalid_subject` when `subject` is not exactly one id in grant.'s typed subject grammar (grant. is not called). `503 grant_unavailable` when grant. is not configured or does not answer; `403 grant_subject_unavailable` when the caller has no Zitadel subject to send. operationId: getOrgGrantHoldings parameters: - $ref: '#/components/parameters/OrgId' - name: subject in: query required: true description: >- The subject whose holdings are read, as a grant. typed id: `user:` or `service:` then `[A-Za-z0-9_-]{1,128}`, or `agent:mnm-` then `[a-z0-9-]{1,120}`. schema: type: string maxLength: 136 pattern: >- ^(?:(?:user|service):[A-Za-z0-9_-]{1,128}|agent:mnm-[a-z0-9-]{1,120})$ responses: '200': description: The subject's holdings in the organization content: application/json: schema: type: object required: - counts - holdings - approximate properties: counts: type: array items: type: object required: - type - role - route - environment - 'n' properties: type: type: string role: type: string route: type: string enum: - creator - direct - inherited environment: type: string 'n': type: integer minimum: 0 holdings: type: array items: type: object required: - resource - role - route - environment properties: resource: type: object required: - type - id properties: type: type: string id: type: string role: type: string route: type: string enum: - creator - direct - inherited environment: type: string expires_at: type: string format: date-time approximate: type: boolean '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalServerError' '503': $ref: '#/components/responses/ServiceUnavailable' security: - BearerAuth: [] components: parameters: OrgId: name: org_id in: path required: true schema: type: string description: Organization identifier (e.g. org-abc12345) responses: BadRequest: description: Bad request content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Authentication required content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' TooManyRequests: description: >- Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 X-RateLimit-Limit: description: Requests permitted per window. schema: type: integer X-RateLimit-Remaining: description: Requests remaining in the current window (0 on a 429). schema: type: integer minimum: 0 X-RateLimit-Reset: description: Unix epoch seconds at which the current window resets. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: >- Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error. content: application/json: schema: $ref: '#/components/schemas/Error' ServiceUnavailable: description: >- An upstream dependency is currently unavailable. The request was not processed; retry after the cooldown window. content: application/json: schema: $ref: '#/components/schemas/Error' schemas: Error: type: object description: >- Canonical error envelope (ADR-API-001 conv 1). `error` is always an object — never a bare string. Every 4xx/5xx response across the API conforms to this shape; the runtime helper is `src/http-errors.ts::buildErrorBody`. required: - error properties: error: type: object required: - code - message properties: code: type: string pattern: ^[a-z][a-z0-9_]*$ description: >- Stable, machine-matchable failure identifier (lowercase snake_case). Clients may branch on this; the string is part of the contract. **Status-class defaults** — emitted when no caller code is supplied (`errorCodeForStatus(status)`): `bad_request` (400), `unauthorized` (401), `forbidden` (403), `not_found` (404), `method_not_allowed` (405), `conflict` (409), `gone` (410), `precondition_failed` (412), `payload_too_large` (413), `unsupported_media_type` (415), `unprocessable_entity` (422), `precondition_required` (428), `rate_limited` (429), `internal_error` (500), `not_implemented` (501), `bad_gateway` (502), `service_unavailable` (503), `gateway_timeout` (504). Fallback `error` for unmapped statuses. **Caller-supplied codes** — handlers may pass an explicit `code` for a specific failure class. Examples: `agent_not_found`, `invalid_hash_proof`, `already_linked`, `idempotency_conflict`, `feature_gated`, `schema_validation_failed`, `no_token`, `bad_canonical_payload`. **Care-framed sub-resource codes** — the cards-as-primitive surface passes its stable care code-string straight through as `error.code`. Examples: `if_match_absent`, `if_match_stale`, `if_match_malformed`, `primitive_validation_failed`. message: type: string description: Human-readable, care-framed explanation of the failure. details: description: >- Optional structured context for the failure (any JSON value: object, array, or primitive). Common shapes: validation findings list, idempotency-conflict diff, `{presented_etag, current_etag}` on a stale `If-Match`, etc. Mirrors the helper's `details?: unknown`. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: 'Supabase JWT token in Authorization: Bearer header' ApiKeyAuth: type: apiKey in: header name: X-Mnemom-Api-Key description: Mnemom API key (mnm_... format) ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.