> ## Documentation Index > Fetch the complete documentation index at: https://docs.mnemom.ai/llms.txt > Use this file to discover all available pages before exploring further. # Read a conversation's signed conduct record > Builds and returns one conversation's signed conduct record (AAP-ConductRecord/v1) from stored rows only: the lineage's cost totals (the same sums as record/... ## OpenAPI ````yaml GET /orgs/{org_id}/record/conduct openapi: 3.1.0 info: title: Mnemom API description: >- Trust infrastructure for AI agents. Transparent alignment verification, behavioral drift detection, and accountability primitives. version: 1.0.0 contact: name: Mnemom url: https://mnemom.ai email: support@mnemom.ai license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0 servers: - url: https://api.mnemom.ai/v1 description: Production security: - BearerAuth: [] - ApiKeyAuth: [] tags: - name: A2A description: >- Public A2A AgentCard projection of the canonical alignment card, with embedded AAP attestation extension (cards-as-primitive Phase 5). - name: Agents description: Agent registration, lifecycle, and metadata. - name: Agent Containment description: Containment policies and quarantine controls. - name: Agent Groups description: >- Lightweight logical tags for bucketing an org's agents — the unscored counterpart to the scored Teams primitive. No cards, coherence, reputation, or feature gate. - name: Alignment description: >- Alignment manifest CRUD — canonical `/v1/alignment//` surface across platform / org / team / agent (cards-as-primitive Phase 4). - name: Analyze description: Behavioral analysis endpoints. - name: Aletheia Support description: >- In-product Aletheia assistant MVP (issue #2195) — chat + voice adapters over one shared answer core. Gated behind ALETHEIA_SUPPORT_MVP_ENABLED + the ALETHEIA_SUPPORT_ALLOWLIST identity allowlist (whose default is the whole @mnemom.ai domain, and which may be set to "*" to admit every authenticated identity), fail-closed 404 for every non-allowed caller. Dark by default; whether it is customer-facing depends on that env var per deployment. - name: Attestation description: >- AAP attestation token JWKS surface and platform-admin signing-key rotation (cards-as-primitive Phase 5). - name: Auth description: Authentication, sessions, and access management. - name: Billing description: Subscription, usage, and invoicing. - name: Blog description: Public blog content. - name: Card Templates description: Org-level alignment and protection card templates. - name: Catalog description: >- Discovery surface for the 25-entry Mnemom value catalog v1 (cards-as-primitive Phase 4). - name: Checkpoints description: Integrity checkpoints and proof artifacts. - name: Conscience Values description: Org-level conscience-value configuration. - name: Consent description: >- GDPR Art. 7(1) append-only consent audit log (MNE-477). Public write (banner POSTs each decision); admin-only read/export. Stores a pseudonymous subject id + truncated IP only — in addition to client-side enforcement. - name: Domains description: >- Domain ownership claims (DNS-TXT verified) + the public no-PII claim-status projection. - name: MCP Servers description: >- MCP-server ownership claims (DNS-TXT verified on the origin domain) + the public no-PII claim-status projection for the IITR MCP-readiness rubric. - name: Dojo description: >- Dojo demo shared contracts (MNE-517): SimEvent SSE narrative feed + ephemeral compute-key issuance. Internal/demo surface, not customer-facing. - name: Invite Message Template description: >- Admin-only (mnemom_staff) CRUD over the invite composer's saved, reusable invite copy (MNE-7094, 5/8 of the RG invite-permission-product epic MNE-7089). Internal/staff surface, not customer-facing. - name: Code description: >- Mnemom Agent — the governed agent launcher (`mnemom agent`). The per-org feature gate the CLI checks at startup; invites and access reuse the product-invite surface with product `code`. - name: Sponsorship description: >- Invite sponsorship (MNE-8193): a sponsor shares a personal link; a verified colleague redeems it for one of the sponsor's invite slots. Dark behind the dedicated `invite_sponsorship` flag (default off). No figures, currency or balance wording in any invitee/sponsor-facing field. Internal while dark. - name: Invites description: >- Invitee-facing product-invite redemption (MNE-7166, 6/8 of the RG invite-permission-product epic MNE-7089). Accepting a `pinv_…` token grants product access and forwards a server-owned starter grant; the grant amount is admin-only and never surfaced. - name: Coherence description: >- Coherence report-claim round-trip (MNE-1379): single-use claim-intent tickets that carry a report claim across the sign-up/email-confirm/return round-trip so no session token rides the URL — only the opaque `mci_…` ticket. - name: Drift description: Drift detection and resolution. - name: Enforcement description: Enforcement-mode configuration and queries. - name: Governance description: Operator-actionable governance signals (ADR-048). - name: Integrity description: AIP integrity checkpoints and verdicts. - name: Intelligence description: Intelligence reports and queries. - name: Licensing description: License management. - name: Network description: >- Protection Network L4 thermometer read surface. Public-aggregate disclosure: any authenticated principal may read; rows carry no per-tenant identifiers. - name: OAuth description: >- OAuth 2.1 authorization-code + PKCE flow for MCP clients (MNE-328). Identity delegated to Supabase GoTrue; mnemom-api mints its own short-lived MCP-scoped tokens. Includes RFC 7591 dynamic client registration and RFC 7009 revocation. - name: On-Chain description: On-chain verification and proofs. - name: Onboarding description: >- Onboarding guidance generation (MNE-5508) — LLM-driven step guidance + bounded action suggestions for customers completing onboarding checklists. - name: Organizations description: Org-level resources and management. - name: Policy description: Policy evaluation and configuration. - name: Postures description: Trust posture management (ADR-045). - name: Protection description: >- Protection manifest CRUD — canonical `/v1/protection//` surface across platform / org / team / agent (cards-as-primitive Phase 4). - name: Recipes description: >- Customer-facing detection-recipe surface — FN/FP reports. Distinct from the Admin recipe-promotion surface and the Internal seeding surface. - name: Reclassification description: Reclassification workflows. - name: Reputation description: Per-agent reputation scores. - name: Risk description: Risk assessment endpoints. - name: Safe House description: Safe House threat detection and quarantine. - name: Sideband description: Sideband detection queries (legacy; sunsetting). - name: Team Reputation description: Team-level reputation aggregates. - name: Teams description: Team-scope resources. - name: Tools description: >- Mnemom-side tools registry — per-tool class+domain+schema metadata (cards-as-primitive Phase 4). - name: Telemetry description: >- Public browser-RUM ingest (Core Web Vitals). Anon-eligible by design, rate-limited, closed-enum dimensions only — emits spans, persists nothing. - name: Traces description: AP-Trace artifacts and queries. - name: Transparency description: >- Append-only public log of every canonical card identity ever composed. Signed Merkle root + per-row inclusion proofs (cards-as-primitive Phase 5). - name: Trust description: >- Protection Network L5 public-trust surface — security advisories, IoC feed (STIX 2.1), and platform-admin CMS for both. - name: Mu description: >- mu-engine ledger proxy — thin pass-through to the mnemom-mu Worker (balances, budgets, staff reads). api owns auth/RBAC/org-context; the ledger lives in mnemom-mu (issue #2357). - name: Verification description: Trace verification endpoints. - name: Webhook Notifications description: Webhook event subscription management. - name: Webhooks description: Webhook delivery and lifecycle. - name: Misc description: >- Miscellaneous operator-facing endpoints (contact, enterprise inquiries, compliance). - name: Feedback description: >- Authenticated in-product feedback ingest (Aletheia Customer Voice). Redacted + consent-gated + idempotent. - name: Notifications description: >- Reactive notification channels — SSE stream + signed-webhook subscriptions for canonical card changes (cards-as-primitive Phase 5). - name: Presentations description: >- Investor/data-room presentations + per-viewer grants (MNE-1428, "Inside Mnemom"). Admin create/invite/revoke; authed-user read scoped to active grants. Internal/demo surface, not customer-facing. - name: Aletheia description: >- Aletheia grounded Q&A answer core (MNE-1937). Internal/preview surface, not customer-facing. - name: Agent Setup description: >- Single-use agent setup links into the add-agent page, started from MCP (MNE-8920). DARK: gated by AGENT_ONBOARDING_MCP, internal until promoted. - name: Org Scan Runs description: >- Server-side org scan run started from the onboarding page (MNE-9743). DARK: gated per org by org_onboarding_v2, internal until promoted. - name: AletheiaVoice description: >- In-product Aletheia voice register (MNE-1944), the customer/anon sibling of the Presentations deck voice register. DARK: feature-flag + allowlist gated, zero customer exposure until promoted; cookie/bearer-authed like any other customer route. paths: /orgs/{org_id}/record/conduct: get: tags: - Organizations summary: Read a conversation's signed conduct record description: >- Builds and returns one conversation's signed conduct record (`AAP-ConductRecord/v1`) from stored rows only: the lineage's cost totals (the same sums as `record/totals`), its protection acts with the mode and verdict stored at each act (never the mode now), and its checkpoint citations (id, signed commitment, certificate signature, card hash when recorded). The detached `signature` is Ed25519 over the canonical JSON of the record minus `signature`, verifiable against the AAP JWKS key named by `signing_key_id`; `digest` is the sha256 of those same bytes. Claim lines carry exactly one class each and never the words safe, correct or prevented. When an input the record needs is not stored yet for the lineage (goal mode at the act, seal, compactions, messages from a person), the route answers 409 `record_inputs_incomplete` naming the missing inputs rather than build a record with a defaulted goal. A lineage that holds more rows than a record can be built from (over 100,000 in one of its stores) is 422 `record_lineage_too_large`: it is terminal and is not retried. An org reads only its own lineages; an unknown lineage or another org's is 404. Billing-shaped — `owner`, `admin`, and `auditor` only. Behind `RECORD_BUILDER_MODE` and the builder cohort: unless the mode is exactly `on` and the org is in the cohort, this returns 404 to every authenticated caller (before the role check); a request with no credential is 401, as on every secured route. operationId: getRecordConduct parameters: - $ref: '#/components/parameters/OrgId' - name: lineage_key in: query required: true schema: type: string minLength: 1 maxLength: 256 description: The conversation's lineage key. responses: '200': description: The lineage's signed conduct record and its digest. content: application/json: schema: type: object required: - record - digest properties: record: type: object description: >- The signed `AAP-ConductRecord/v1` statement. Every field but `signature` is inside the signed bytes. required: - typ - unit_kind - org_id - lineage_key - built_at - previous_digest - signing_key_id - cost - goal - protection - people - checkpoints - lines - signature properties: typ: type: string enum: - AAP-ConductRecord/v1 unit_kind: type: string enum: - conversation org_id: type: string lineage_key: type: string built_at: type: string format: date-time previous_digest: type: - string - 'null' description: >- sha256 hex of the previous build of this record, or null for a first build. signing_key_id: type: string cost: type: object additionalProperties: true goal: type: object additionalProperties: true protection: type: object additionalProperties: true people: type: object additionalProperties: true checkpoints: type: array items: type: object additionalProperties: true lines: type: array items: type: object required: - class - key - text properties: class: type: string enum: - measured - verdict - estimate - benchmark - outcome key: type: string text: type: string signature: type: string description: >- base64url Ed25519 over the canonical JSON of the record minus this field. digest: type: string pattern: ^[0-9a-f]{64}$ description: sha256 hex of the signed bytes. '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '422': $ref: '#/components/responses/UnprocessableEntity' '429': $ref: '#/components/responses/RecordReadCapExceeded' '500': $ref: '#/components/responses/InternalServerError' security: - BearerAuth: [] components: parameters: OrgId: name: org_id in: path required: true schema: type: string description: Organization identifier (e.g. org-abc12345) responses: BadRequest: description: Bad request content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Authentication required content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' Conflict: description: >- Resource conflict — the request cannot proceed because of a current state conflict (e.g., resource already exists, version mismatch, in-flight idempotency key with a different body). content: application/json: schema: $ref: '#/components/schemas/Error' UnprocessableEntity: description: >- Request was well-formed but semantically invalid (e.g., business-rule validation failure, malformed YAML inside a JSON payload). content: application/json: schema: $ref: '#/components/schemas/Error' RecordReadCapExceeded: description: >- Rate-limit exceeded: either the org's hourly record read cap (`error.code` `record_read_cap`, 600 reads per org per hour by default, one counter shared by `GET /orgs/{org_id}/record/totals` and `GET /orgs/{org_id}/record/conduct`) or the global per-IP limiter (100 requests/minute by default on every `/v1/*` route). On `record_read_cap`, `error.details.retry_after_seconds` is the time to the hour boundary. Back off for `Retry-After` seconds. When present, `X-RateLimit-Limit` and `X-RateLimit-Reset` describe the per-IP limiter, also on a `record_read_cap` 429. Only a per-IP 429 sets `X-RateLimit-Remaining`. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 X-RateLimit-Limit: description: Requests permitted per window (per-IP limiter only). schema: type: integer X-RateLimit-Remaining: description: >- Requests remaining in the current window (per-IP limiter only, 0 on a 429). schema: type: integer minimum: 0 X-RateLimit-Reset: description: Unix epoch seconds at which the window resets (per-IP limiter only). schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: >- Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error. content: application/json: schema: $ref: '#/components/schemas/Error' schemas: Error: type: object description: >- Canonical error envelope (ADR-API-001 conv 1). `error` is always an object — never a bare string. Every 4xx/5xx response across the API conforms to this shape; the runtime helper is `src/http-errors.ts::buildErrorBody`. required: - error properties: error: type: object required: - code - message properties: code: type: string pattern: ^[a-z][a-z0-9_]*$ description: >- Stable, machine-matchable failure identifier (lowercase snake_case). Clients may branch on this; the string is part of the contract. **Status-class defaults** — emitted when no caller code is supplied (`errorCodeForStatus(status)`): `bad_request` (400), `unauthorized` (401), `forbidden` (403), `not_found` (404), `method_not_allowed` (405), `conflict` (409), `gone` (410), `precondition_failed` (412), `payload_too_large` (413), `unsupported_media_type` (415), `unprocessable_entity` (422), `precondition_required` (428), `rate_limited` (429), `internal_error` (500), `not_implemented` (501), `bad_gateway` (502), `service_unavailable` (503), `gateway_timeout` (504). Fallback `error` for unmapped statuses. **Caller-supplied codes** — handlers may pass an explicit `code` for a specific failure class. Examples: `agent_not_found`, `invalid_hash_proof`, `already_linked`, `idempotency_conflict`, `feature_gated`, `schema_validation_failed`, `no_token`, `bad_canonical_payload`. **Care-framed sub-resource codes** — the cards-as-primitive surface passes its stable care code-string straight through as `error.code`. Examples: `if_match_absent`, `if_match_stale`, `if_match_malformed`, `primitive_validation_failed`. message: type: string description: Human-readable, care-framed explanation of the failure. details: description: >- Optional structured context for the failure (any JSON value: object, array, or primitive). Common shapes: validation findings list, idempotency-conflict diff, `{presented_etag, current_etag}` on a stale `If-Match`, etc. Mirrors the helper's `details?: unknown`. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: 'Supabase JWT token in Authorization: Bearer header' ApiKeyAuth: type: apiKey in: header name: X-Mnemom-Api-Key description: Mnemom API key (mnm_... format) ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.