Tessera API reference

Generated from api/openapi.yaml (version 0.1.0) by tessera-codegen — do not edit.

Tessera trains a behavioral model on your event-stream data: one embedding per entity, optional prediction heads, and low-latency scoring APIs (001 §1).

Conventions (003 §1) — normative for every operation added to this file:

• JSON everywhere; snake_case fields; RFC 3339 UTC timestamps.
• Cursor pagination: ?limit= (max 200) &cursor=; responses reuse the pagination envelope (data + next_cursor, see PageEnvelope).
• Errors always use the error envelope (ErrorEnvelope) with the closed code enum; the HTTP status must match the code.
• Every response carries an X-Request-Id header.
• All POSTs accept an Idempotency-Key header (24 h dedup window, keyed per project and caller). A key answers only a retry of the request that first used it; the same key with another request is 409 already_exists (idempotency_key_reused). See the Idempotency-Key parameter.
• Custom (non-CRUD) actions use the :action suffix on the resource path.

SCIM 2.0 is specified separately in api/scim-openapi.yaml at https://api.staging.tessera.zone/scim/v2. SCIM uses application/scim+json, RFC 7644 camelCase fields, one-based list pagination and SCIM Error responses, rather than the /v1 JSON field, pagination and ErrorEnvelope conventions. Only organization-bound SCIM bearer tokens authenticate SCIM operations.

Servers

URL	Description
https://api.staging.tessera.zone/v1	Public REST API (gateway-api, serving-api). Env-configurable (003 §1).
https://ingest.staging.tessera.zone/v1	Event ingestion (ingest-api). Env-configurable (003 §1).

Authentication

Scheme	Type	Description
apiKey	http (bearer)	Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
applicationToken	http (bearer)	A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.
consoleSession	http (bearer)	Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.
publishableKey	http (bearer)	Publishable key (003 §2): tpk_… in Authorization: Bearer. Client-side SDK event ingestion only (ingest scope, single project).
stripeSignature	apiKey	Stripe webhook signature (WP-B3 req 3): t=\<ts\>,v1=\<hex\> where v1 = HMAC-SHA256(signing_secret, "\{t\}.\{raw_body\}"), ±5 minute tolerance, constant-time comparison. The signing secret lives in Secret Manager (004 §2 rule 4). Documented for POST /billing/webhooks/stripe only — no platform credential is accepted there.

Errors

Every non-2xx response uses the 003 §1 error envelope; the closed error-code set is listed on each resource page.

Resources

• adapters — 1 operation
• alerts — 12 operations
• api_keys — 5 operations
• applications — 21 operations
• atlas — 5 operations
• atlas_inquiries — 8 operations
• audiences — 15 operations
• audit — 7 operations
• billing — 5 operations
• comparators — 3 operations
• contracts — 8 operations
• credentials — 2 operations
• crosswalks — 3 operations
• customer_map — 5 operations
• dataset_files — 6 operations
• datasets — 11 operations
• destinations — 9 operations
• domain_packs — 5 operations
• dossiers — 5 operations
• dual_control — 5 operations
• entities — 4 operations
• entity_baselines — 11 operations
• entity_deletions — 3 operations
• event_models — 18 operations
• events — 9 operations
• exports — 14 operations
• field_declarations — 3 operations
• gate_definitions — 1 operation
• governance — 6 operations
• history — 3 operations
• invites — 6 operations
• labels — 15 operations
• leakage_policy — 3 operations
• mappings — 5 operations
• markers — 6 operations
• model_files — 6 operations
• models — 11 operations
• monitors — 14 operations
• orgs — 7 operations
• platform — 1 operation
• projects — 5 operations
• promotion_policy — 2 operations
• proof — 18 operations
• purges — 3 operations
• roles — 12 operations
• runs — 11 operations
• schedules — 5 operations
• scim_admin — 4 operations
• scores — 10 operations
• segments — 14 operations
• semantic — 36 operations
• slots — 7 operations
• sources — 8 operations
• sso — 9 operations
• suppression — 18 operations
• syncs — 8 operations
• training_studies — 4 operations
• uploads — 3 operations
• usage — 1 operation
• usage_quotas — 1 operation
• users — 3 operations
• webhook_endpoints — 11 operations
• Schemas