> ## Documentation Index > Fetch the complete documentation index at: https://docs.mnemom.ai/llms.txt > Use this file to discover all available pages before exploring further. # Read a conversation's model cost and µ totals > Returns what one conversation (lineage) cost (or, with lineage_key repeated up to 100 times, what each of several cost plus their sum) as two separate amount... ## OpenAPI ````yaml GET /orgs/{org_id}/record/totals openapi: 3.1.0 info: title: Mnemom API description: >- Trust infrastructure for AI agents. Transparent alignment verification, behavioral drift detection, and accountability primitives. version: 1.0.0 contact: name: Mnemom url: https://mnemom.ai email: support@mnemom.ai license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0 servers: - url: https://api.mnemom.ai/v1 description: Production security: - BearerAuth: [] - ApiKeyAuth: [] tags: - name: A2A description: >- Public A2A AgentCard projection of the canonical alignment card, with embedded AAP attestation extension (cards-as-primitive Phase 5). - name: Agents description: Agent registration, lifecycle, and metadata. - name: Agent Containment description: Containment policies and quarantine controls. - name: Agent Groups description: >- Lightweight logical tags for bucketing an org's agents — the unscored counterpart to the scored Teams primitive. No cards, coherence, reputation, or feature gate. - name: Alignment description: >- Alignment manifest CRUD — canonical `/v1/alignment//` surface across platform / org / team / agent (cards-as-primitive Phase 4). - name: Analyze description: Behavioral analysis endpoints. - name: Aletheia Support description: >- In-product Aletheia assistant MVP (issue #2195) — chat + voice adapters over one shared answer core. Gated behind ALETHEIA_SUPPORT_MVP_ENABLED + the ALETHEIA_SUPPORT_ALLOWLIST identity allowlist (whose default is the whole @mnemom.ai domain, and which may be set to "*" to admit every authenticated identity), fail-closed 404 for every non-allowed caller. Dark by default; whether it is customer-facing depends on that env var per deployment. - name: Attestation description: >- AAP attestation token JWKS surface and platform-admin signing-key rotation (cards-as-primitive Phase 5). - name: Auth description: Authentication, sessions, and access management. - name: Billing description: Subscription, usage, and invoicing. - name: Blog description: Public blog content. - name: Card Templates description: Org-level alignment and protection card templates. - name: Catalog description: >- Discovery surface for the 25-entry Mnemom value catalog v1 (cards-as-primitive Phase 4). - name: Checkpoints description: Integrity checkpoints and proof artifacts. - name: Conscience Values description: Org-level conscience-value configuration. - name: Consent description: >- GDPR Art. 7(1) append-only consent audit log (MNE-477). Public write (banner POSTs each decision); admin-only read/export. Stores a pseudonymous subject id + truncated IP only — in addition to client-side enforcement. - name: Domains description: >- Domain ownership claims (DNS-TXT verified) + the public no-PII claim-status projection. - name: MCP Servers description: >- MCP-server ownership claims (DNS-TXT verified on the origin domain) + the public no-PII claim-status projection for the IITR MCP-readiness rubric. - name: Dojo description: >- Dojo demo shared contracts (MNE-517): SimEvent SSE narrative feed + ephemeral compute-key issuance. Internal/demo surface, not customer-facing. - name: Invite Message Template description: >- Admin-only (mnemom_staff) CRUD over the invite composer's saved, reusable invite copy (MNE-7094, 5/8 of the RG invite-permission-product epic MNE-7089). Internal/staff surface, not customer-facing. - name: Code description: >- Mnemom Agent — the governed agent launcher (`mnemom agent`). The per-org feature gate the CLI checks at startup; invites and access reuse the product-invite surface with product `code`. - name: Sponsorship description: >- Invite sponsorship (MNE-8193): a sponsor shares a personal link; a verified colleague redeems it for one of the sponsor's invite slots. Dark behind the dedicated `invite_sponsorship` flag (default off). No figures, currency or balance wording in any invitee/sponsor-facing field. Internal while dark. - name: Invites description: >- Invitee-facing product-invite redemption (MNE-7166, 6/8 of the RG invite-permission-product epic MNE-7089). Accepting a `pinv_…` token grants product access and forwards a server-owned starter grant; the grant amount is admin-only and never surfaced. - name: Coherence description: >- Coherence report-claim round-trip (MNE-1379): single-use claim-intent tickets that carry a report claim across the sign-up/email-confirm/return round-trip so no session token rides the URL — only the opaque `mci_…` ticket. - name: Drift description: Drift detection and resolution. - name: Enforcement description: Enforcement-mode configuration and queries. - name: Governance description: Operator-actionable governance signals (ADR-048). - name: Integrity description: AIP integrity checkpoints and verdicts. - name: Intelligence description: Intelligence reports and queries. - name: Licensing description: License management. - name: Network description: >- Protection Network L4 thermometer read surface. Public-aggregate disclosure: any authenticated principal may read; rows carry no per-tenant identifiers. - name: OAuth description: >- OAuth 2.1 authorization-code + PKCE flow for MCP clients (MNE-328). Identity delegated to Supabase GoTrue; mnemom-api mints its own short-lived MCP-scoped tokens. Includes RFC 7591 dynamic client registration and RFC 7009 revocation. - name: On-Chain description: On-chain verification and proofs. - name: Onboarding description: >- Onboarding guidance generation (MNE-5508) — LLM-driven step guidance + bounded action suggestions for customers completing onboarding checklists. - name: Organizations description: Org-level resources and management. - name: Policy description: Policy evaluation and configuration. - name: Postures description: Trust posture management (ADR-045). - name: Protection description: >- Protection manifest CRUD — canonical `/v1/protection//` surface across platform / org / team / agent (cards-as-primitive Phase 4). - name: Recipes description: >- Customer-facing detection-recipe surface — FN/FP reports. Distinct from the Admin recipe-promotion surface and the Internal seeding surface. - name: Reclassification description: Reclassification workflows. - name: Reputation description: Per-agent reputation scores. - name: Risk description: Risk assessment endpoints. - name: Safe House description: Safe House threat detection and quarantine. - name: Sideband description: Sideband detection queries (legacy; sunsetting). - name: Team Reputation description: Team-level reputation aggregates. - name: Teams description: Team-scope resources. - name: Tools description: >- Mnemom-side tools registry — per-tool class+domain+schema metadata (cards-as-primitive Phase 4). - name: Telemetry description: >- Public browser-RUM ingest (Core Web Vitals). Anon-eligible by design, rate-limited, closed-enum dimensions only — emits spans, persists nothing. - name: Traces description: AP-Trace artifacts and queries. - name: Transparency description: >- Append-only public log of every canonical card identity ever composed. Signed Merkle root + per-row inclusion proofs (cards-as-primitive Phase 5). - name: Trust description: >- Protection Network L5 public-trust surface — security advisories, IoC feed (STIX 2.1), and platform-admin CMS for both. - name: Mu description: >- mu-engine ledger proxy — thin pass-through to the mnemom-mu Worker (balances, budgets, staff reads). api owns auth/RBAC/org-context; the ledger lives in mnemom-mu (issue #2357). - name: Verification description: Trace verification endpoints. - name: Webhook Notifications description: Webhook event subscription management. - name: Webhooks description: Webhook delivery and lifecycle. - name: Misc description: >- Miscellaneous operator-facing endpoints (contact, enterprise inquiries, compliance). - name: Feedback description: >- Authenticated in-product feedback ingest (Aletheia Customer Voice). Redacted + consent-gated + idempotent. - name: Notifications description: >- Reactive notification channels — SSE stream + signed-webhook subscriptions for canonical card changes (cards-as-primitive Phase 5). - name: Presentations description: >- Investor/data-room presentations + per-viewer grants (MNE-1428, "Inside Mnemom"). Admin create/invite/revoke; authed-user read scoped to active grants. Internal/demo surface, not customer-facing. - name: Aletheia description: >- Aletheia grounded Q&A answer core (MNE-1937). Internal/preview surface, not customer-facing. - name: Agent Setup description: >- Single-use agent setup links into the add-agent page, started from MCP (MNE-8920). DARK: gated by AGENT_ONBOARDING_MCP, internal until promoted. - name: Org Scan Runs description: >- Server-side org scan run started from the onboarding page (MNE-9743). DARK: gated per org by org_onboarding_v2, internal until promoted. - name: AletheiaVoice description: >- In-product Aletheia voice register (MNE-1944), the customer/anon sibling of the Presentations deck voice register. DARK: feature-flag + allowlist gated, zero customer exposure until promoted; cookie/bearer-authed like any other customer route. paths: /orgs/{org_id}/record/totals: get: tags: - Organizations summary: Read a conversation's model cost and µ totals description: >- Returns what one conversation (lineage) cost (or, with `lineage_key` repeated up to 100 times, what each of several cost plus their sum) as two separate amounts in millimu (1 µ = 1000 mmu): `model_cost_mmu` and `mu_charged_mmu`, each the sum of the lineage's record rows (billing rows join through the request id). Money is a decimal string (an integer total can exceed 2^53), the same encoding as the billed-share `charged_mmu`. `as_of` is the server read time and `row_count` the number of record rows summed; a consumer that re-reads later and sees a different `row_count` knows a late charge landed. When billing has charged nothing for the lineage, `mu_charged_mmu` is `null`, shown as "not charged" — never 0. There is no provisional/final status: a charge is final when billing commits it. A single `lineage_key` answers the v1 object. Two to 100 answer `lineages` (per-lineage totals), `sum` (µ is `null` only when every listed lineage is `null`) and `unknown_lineage_keys`: a key with no rows for this org, unknown or another org's, is never listed or summed. If every key is unknown the answer is 404; more than 100 keys, a key over 256 characters or a malformed `binding` is 400. Duplicate keys are read once. The optional repeated `binding` (`pilot_pr`, `starter`, `unbound`, one per `lineage_key`, in order) is echoed back untouched: the totals read never derives or stores a binding (the PR record owns it). An org reads only its own lineages. Org window (v1.2): pass `from` and `to` (ISO-8601 with a zone, `[from, to)`) instead of one lineage to read the org's total over the window: `window`, `model_cost_mmu`, `mu_charged_mmu` (`null` when billing charged nothing, never 0), `row_count`, `as_of` (the latest `created_at` among the rows read, `null` for an empty window, so two reads with no new row agree), `read_at` (server time) and `card_versions`. A request is in the window when its gateway row is; its billing row follows by request id, so a late charge raises `row_count`. With `lineage_key` also given, `bound` is those lineages' sum, `unbound` the remainder and `unmatched_lineage_keys` the listed keys with no row in the window. A window longer than 30 days, reaching before the retention floor (`expired`), ending in the future, holding over 10,000 requests, or sent with `binding` is 400. Nothing is stored: C3 seals these fields into its signed PR statement. Billing-shaped — `owner`, `admin`, and `auditor` only. An org API key reads only the org it was issued for: another org's is 404. Behind `RECORD_ACCUMULATOR_MODE` and the accumulator cohort: while the mode is off, or the org is outside the cohort, this returns 404 to every authenticated caller (before the role check). operationId: getRecordTotals parameters: - $ref: '#/components/parameters/OrgId' - name: lineage_key in: query required: false style: form explode: true schema: type: array minItems: 1 maxItems: 100 items: type: string minLength: 1 maxLength: 256 description: >- The conversation's lineage key; repeat it for up to 100 lineages (more is 400). Required unless `from`/`to` are given; with a window it names the pilot lineages for the `bound` split. - name: binding in: query required: false style: form explode: true schema: type: array items: type: string enum: - pilot_pr - starter - unbound description: >- Optional pass-through label per lineage, repeated once per `lineage_key` in the same order, echoed back as `binding`. Never derived or stored by this route. - name: from in: query required: false schema: type: string format: date-time description: >- Window start, inclusive, ISO-8601 with a zone. Give with `to`; at most 30 days, not before the retention floor. - name: to in: query required: false schema: type: string format: date-time description: Window end, exclusive, ISO-8601 with a zone; not in the future. responses: '200': description: The lineage's totals. content: application/json: schema: oneOf: - type: object required: - lineage_key - model_cost_mmu - mu_charged_mmu - as_of - row_count properties: lineage_key: type: string binding: type: string enum: - pilot_pr - starter - unbound description: >- The caller-supplied label, echoed back; present only when supplied. model_cost_mmu: type: string pattern: ^(0|[1-9][0-9]{0,18})$ description: >- Sum of the lineage's model cost, integer millimu as a decimal string. mu_charged_mmu: type: - string - 'null' pattern: ^(0|[1-9][0-9]{0,18})$ description: >- Sum of the µ billing charged, integer millimu as a decimal string. null when billing has no row for the lineage ("not charged"). as_of: type: string format: date-time description: Server time of this read, ISO-8601. row_count: type: integer minimum: 1 description: >- Number of record rows summed into the totals (gateway and billing). - type: object required: - lineages - sum - unknown_lineage_keys - as_of properties: lineages: type: array minItems: 1 maxItems: 100 description: >- Totals per lineage that has rows for this org, in request order. items: type: object required: - lineage_key - model_cost_mmu - mu_charged_mmu - row_count properties: lineage_key: type: string binding: type: string enum: - pilot_pr - starter - unbound model_cost_mmu: type: string pattern: ^(0|[1-9][0-9]{0,18})$ mu_charged_mmu: type: - string - 'null' pattern: ^(0|[1-9][0-9]{0,18})$ row_count: type: integer minimum: 1 sum: type: object required: - model_cost_mmu - mu_charged_mmu - row_count description: >- Sum over the listed lineages. mu_charged_mmu is null only when every listed lineage is null. properties: model_cost_mmu: type: string pattern: ^(0|[1-9][0-9]{0,18})$ mu_charged_mmu: type: - string - 'null' pattern: ^(0|[1-9][0-9]{0,18})$ row_count: type: integer minimum: 1 unknown_lineage_keys: type: array items: type: string description: >- Requested keys with no rows for this org (unknown, or another org's). Never summed. as_of: type: string format: date-time - type: object description: >- Org window total (v1.2): sent when `from` and `to` are given. required: - window - model_cost_mmu - mu_charged_mmu - row_count - as_of - read_at - card_versions properties: window: type: object required: - from - to properties: from: type: string format: date-time to: type: string format: date-time model_cost_mmu: type: string pattern: ^(0|[1-9][0-9]{0,18})$ mu_charged_mmu: type: - string - 'null' pattern: ^(0|[1-9][0-9]{0,18})$ row_count: type: integer minimum: 0 as_of: type: - string - 'null' format: date-time description: >- Latest created_at among the rows read; null when the window is empty. read_at: type: string format: date-time card_versions: type: array items: type: string bound: type: object required: - model_cost_mmu - mu_charged_mmu - row_count properties: model_cost_mmu: type: string pattern: ^(0|[1-9][0-9]{0,18})$ mu_charged_mmu: type: - string - 'null' pattern: ^(0|[1-9][0-9]{0,18})$ row_count: type: integer minimum: 0 unbound: type: object required: - model_cost_mmu - mu_charged_mmu - row_count properties: model_cost_mmu: type: string pattern: ^(0|[1-9][0-9]{0,18})$ mu_charged_mmu: type: - string - 'null' pattern: ^(0|[1-9][0-9]{0,18})$ row_count: type: integer minimum: 0 unmatched_lineage_keys: type: array items: type: string '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/RecordReadCapExceeded' '500': $ref: '#/components/responses/InternalServerError' '503': $ref: '#/components/responses/RecordReadTimeout' security: - BearerAuth: [] - ApiKeyAuth: [] components: parameters: OrgId: name: org_id in: path required: true schema: type: string description: Organization identifier (e.g. org-abc12345) responses: BadRequest: description: Bad request content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Authentication required content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' RecordReadCapExceeded: description: >- Rate-limit exceeded: either the org's hourly record read cap (`error.code` `record_read_cap`, 600 reads per org per hour by default, one counter shared by `GET /orgs/{org_id}/record/totals` and `GET /orgs/{org_id}/record/conduct`) or the global per-IP limiter (100 requests/minute by default on every `/v1/*` route). On `record_read_cap`, `error.details.retry_after_seconds` is the time to the hour boundary. Back off for `Retry-After` seconds. When present, `X-RateLimit-Limit` and `X-RateLimit-Reset` describe the per-IP limiter, also on a `record_read_cap` 429. Only a per-IP 429 sets `X-RateLimit-Remaining`. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 X-RateLimit-Limit: description: Requests permitted per window (per-IP limiter only). schema: type: integer X-RateLimit-Remaining: description: >- Requests remaining in the current window (per-IP limiter only, 0 on a 429). schema: type: integer minimum: 0 X-RateLimit-Reset: description: Unix epoch seconds at which the window resets (per-IP limiter only). schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: >- Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error. content: application/json: schema: $ref: '#/components/schemas/Error' RecordReadTimeout: description: >- The record read did not finish in time (database statement timeout, upstream 503/504/408, client abort or an open circuit breaker). `error.code` is `record_read_timeout`. Nothing was stored; retry after `Retry-After` seconds, or narrow the window. headers: Retry-After: description: >- Seconds to wait before retrying. Always present on `record_read_timeout`. schema: type: integer minimum: 1 content: application/json: schema: $ref: '#/components/schemas/Error' schemas: Error: type: object description: >- Canonical error envelope (ADR-API-001 conv 1). `error` is always an object — never a bare string. Every 4xx/5xx response across the API conforms to this shape; the runtime helper is `src/http-errors.ts::buildErrorBody`. required: - error properties: error: type: object required: - code - message properties: code: type: string pattern: ^[a-z][a-z0-9_]*$ description: >- Stable, machine-matchable failure identifier (lowercase snake_case). Clients may branch on this; the string is part of the contract. **Status-class defaults** — emitted when no caller code is supplied (`errorCodeForStatus(status)`): `bad_request` (400), `unauthorized` (401), `forbidden` (403), `not_found` (404), `method_not_allowed` (405), `conflict` (409), `gone` (410), `precondition_failed` (412), `payload_too_large` (413), `unsupported_media_type` (415), `unprocessable_entity` (422), `precondition_required` (428), `rate_limited` (429), `internal_error` (500), `not_implemented` (501), `bad_gateway` (502), `service_unavailable` (503), `gateway_timeout` (504). Fallback `error` for unmapped statuses. **Caller-supplied codes** — handlers may pass an explicit `code` for a specific failure class. Examples: `agent_not_found`, `invalid_hash_proof`, `already_linked`, `idempotency_conflict`, `feature_gated`, `schema_validation_failed`, `no_token`, `bad_canonical_payload`. **Care-framed sub-resource codes** — the cards-as-primitive surface passes its stable care code-string straight through as `error.code`. Examples: `if_match_absent`, `if_match_stale`, `if_match_malformed`, `primitive_validation_failed`. message: type: string description: Human-readable, care-framed explanation of the failure. details: description: >- Optional structured context for the failure (any JSON value: object, array, or primitive). Common shapes: validation findings list, idempotency-conflict diff, `{presented_etag, current_etag}` on a stale `If-Match`, etc. Mirrors the helper's `details?: unknown`. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: 'Supabase JWT token in Authorization: Bearer header' ApiKeyAuth: type: apiKey in: header name: X-Mnemom-Api-Key description: Mnemom API key (mnm_... format) ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.