atlas_inquiries

GET /slots/{slot}/atlas-inquiries

List the slot's Atlas inquiries

Atlas inquiries of the slot in the caller's environment, newest first (cursor pagination, 003 §1). Rows carry the masked question and its placeholder table (never raw question text; values to the requester only; null and empty for a withdrawn inquiry), and no plan, statistics or answer; GET one inquiry for them. Presenter mode finds approved inquiries with review_state=approved and export_id. Session only.

Operation ID: listSlotAtlasInquiries · Service: serving-api

Authentication

• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
slot	path	yes	string	Deployment slot reference: the slot id (slot_ ULID, 002 §1) or the per-project-unique slot name (002 §9 — the stable API-addressable unit; names never contain _, so the two forms are disjoint). A slot belonging to another project or environment is indistinguishable from a missing one (404 not_found, 003 §3).
cursor	query	no	string	Opaque pagination cursor from a previous response's next_cursor.
export_id	query	no	string	Only inquiries asked over this projection export.
limit	query	no	integer	Page size (cursor pagination, 003 §1). Maximum 200.
requested_by	query	no	string	me: only the caller's own inquiries.
review_state	query	no	string	Only inquiries in this review state.

Pagination

Cursor pagination (003 §1): pass limit (max 200) and cursor; the response is the pagination envelope — data plus next_cursor (null on the last page).

Responses

Status	Schema	Description
200	AtlasInquiryPage	One page of inquiries, newest first.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /slots/{slot}/atlas-inquiries

Ask a free-form question about the customers on a map

Queues one free-form inquiry over the points of a projection export (the map the person is looking at). The slot purpose gate runs first. serving-api tokenizes the question in memory with the allowlist tokenizer (tok-1), checks the masked text with an independent guard, and stores only the masked question and the placeholder table: the raw question is never stored, logged or returned. The atlas-copilot worker sends the masked question, aliases and reviewed glosses (never values, names or ids) to the hosted model, which returns a closed plan of read-only tool steps; code validates and executes it over the map, scoped by this request, and answers with aggregate statistics over at least 50 customers. The steps, statistics and matching customers appear on GET as soon as they are computed (phase: composing), before the AI-written part; poll until status is terminal. A clicked customer (context.point_index) is resolved by code inside the worker and is never sent to the model. Callers: an organization admin or owner, or a member whose custom role (WP-A5) grants atlas.inquiries.create, such as the presenter role. Creates are accepted in the test environment only: a live request is 400 failed_precondition with an AtlasInquiryPreconditionDetail (copilot_disabled, environment_not_allowed). Refusals known at create are 400 failed_precondition with an AtlasInquiryPreconditionDetail and write no row: a tokenizer refusal (input_not_allowed with format_character, markup_or_link, too_short, too_long or tokenizer_invariant; unanswerable with language_not_supported, or unsupported_field and its field_kind); unsupported for context.region_descriptors naming a segment outside the slot's current registry (segment_not_in_registry), below the 50-member floor (region_below_floor) or twice (duplicate_region_descriptor); copilot_disabled (operator_off, project_not_allowed, environment_not_allowed, inquiries_off, budget_exhausted); unsupported (an export that is not a succeeded projection_2d of this slot, a slot without an active bundle, a point_index outside the export, a focused segment outside the slot's current registry). Polygons that cannot be normalized are 400 invalid_argument. Another project's, environment's or slot's export_id, focused_segment_id or descriptor segment_id is indistinguishable from a missing one. A limit is 429 resource_exhausted with retry_after_seconds and an AtlasInquiryQuotaDetail. The same caller asking the same masked question with the same placeholder values, context, export and versions within 24 h gets their own earlier succeeded inquiry back (202, same id) unless force_new is true; withdrawn and rejected inquiries are never reused, and the dedupe key is a keyed HMAC that is not matched after 24 h, never the values. The 202 body carries placeholder roles only (no value), so the idempotency store never holds a typed number. Idempotency-Key replays return the same aiq_ id. For this operation only, the Idempotency-Key cache is keyed on the client key alone, never on the request body: a repeated key with a different body returns the ORIGINAL receipt (not 409 idempotency_key_reused), and the question body is never stored in the idempotency cache. Audit atlas_copilot.inquiry.request (no text). Session only.

Operation ID: createSlotAtlasInquiry · Service: serving-api

Authentication

• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
Idempotency-Key	header	no	string	Idempotency key accepted by all POSTs (003 §1): 24 h dedup window, keyed per project. POSTs that are reads (batchSlotScores, scoreSlotEvent, deriveSlotBands, validateSourceRawPreset, sampleSource, watchEventFeedHeads and the preview operations: previewSourceMapping, previewCatalogMapping, previewLabel, previewPatternLabel, previewMarker, previewDatasetEligibility, previewSlotAudience, previewSharedCheckpointImport, previewSlotAtlasInquiry) accept the key but never replay a stored response: a retry with the same key is executed again (and metered again) against current data. A stored response that names an entity is removed when that entity is erased. A key that already answered answers only a retry of the request that stored its response: the same caller, environment, operation, path, query, scoping headers and body (a JSON body by its content, a gzip body by its inflated content). The same key with any other request is 409 already_exists with details[0].reason idempotency_key_reused, and that request is not run. The window holds no in-flight marker: two first requests sent at once can both run. A response stored by a release before this rule cannot be matched to its request and is refused the same way until it expires; send the request again with a new key. A body over 8 MiB (ingest: over its 5 MiB request limit) is run and its response is not stored. The ingest batch (POST /events) is the exception, except for an application's credentials: under a key that answered another batch it runs again, uncached, and its events' ids deduplicate them; so it does when its stored response cannot be checked. The operations that return a one-time secret store their response sealed: the stored copy opens only for the same key and credential, and one that cannot be opened is 409 idempotency_key_reused. While the server cannot check a stored response (it cannot read the key that checks it, for one), the request is 503 unavailable with Retry-After: retry with the same key. An operation whose handler claims the key itself answers the same 503, before it runs, while the key-hash pepper cannot be read; any other request sent with a key runs meanwhile, and its response is not stored.
slot	path	yes	string	Deployment slot reference: the slot id (slot_ ULID, 002 §1) or the per-project-unique slot name (002 §9 — the stable API-addressable unit; names never contain _, so the two forms are disjoint). A slot belonging to another project or environment is indistinguishable from a missing one (404 not_found, 003 §3).

Idempotency

This operation accepts an Idempotency-Key header (003 §1): within 24 hours, keyed per project and caller, a retry of the same request gets the first response, and the same key with another request is 409 already_exists (idempotency_key_reused). See the Idempotency-Key parameter for the exceptions.

Request body

AtlasInquiryRequest

Responses

Status	Schema	Description
202	AtlasInquiryReceipt	The queued (or reused) inquiry's receipt: roles only, never a placeholder value (the Idempotency-Key store caches it). GET the inquiry for the rest.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /slots/{slot}/atlas-inquiries/{inquiry_id}

Read one Atlas inquiry

The inquiry record: the masked question and its placeholders, the plan as readable steps rendered by code (readings), the executed steps with exact sizes, the statistics at full precision, the code-rendered sentences and the AI-written takeaways, the result group and the notes. It never carries raw question text or an entity id: the matching customers are served as export point indices by listSlotAtlasInquiryMembers. Placeholder values are returned to the requester only, and only those the chosen plan binds while they are kept; other viewers see roles. The exact sizes of the steps and the result are shown to every viewer: a group set by a typed count (top R1) reveals that quantity. A kept quantity is a bounded count, percent or threshold inside the tool's range; it can still be a number the person meant otherwise (for example "the last 4471" keeps R1 = 4471), so it is shown to the requester only, while every viewer can read the result's size. A withdrawn inquiry shows only its status. While the operator switch has takeaways off, stored takeaways are withheld (answer.takeaways_withheld). An awaiting_choice inquiry past choice_expires_at is failed (expired) by this read. A queued inquiry older than 10 minutes is failed (expired) by this read and never runs later. Another project's or environment's id is indistinguishable from a missing one (404 not_found). Polled by the console. Session only.

Operation ID: getSlotAtlasInquiry · Service: serving-api

Authentication

• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
inquiry_id	path	yes	string	Atlas inquiry id (aiq_ ULID, 002 §1 extension, ERRATA 2026-10-20). Another project's, environment's or slot's id is indistinguishable from a missing one (404 not_found, 003 §3).
slot	path	yes	string	Deployment slot reference: the slot id (slot_ ULID, 002 §1) or the per-project-unique slot name (002 §9 — the stable API-addressable unit; names never contain _, so the two forms are disjoint). A slot belonging to another project or environment is indistinguishable from a missing one (404 not_found, 003 §3).

Responses

Status	Schema	Description
200	AtlasInquiry	The inquiry.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /slots/{slot}/atlas-inquiries/{inquiry_id}/members

The matching customers of an inquiry, as export point indices

The members of the inquiry's result group as indices into the points of the inquiry's projection export (export_id at export_sha256), in the result's order (rank or similarity when the result step has one, else export), with cursor pagination. Never an entity id: the console loads that export generation and joins the indices with it, never with another. Built by code; never passed through the model. Serving reads the export's current digest on every page: when it differs from the pinned export_sha256 (an erasure rewrote the export in place, shifting indices), the answer is 400 failed_precondition with an AtlasInquiryPreconditionDetail (members_unavailable/export_changed) and the console shows "Computed on an earlier map". Every page is also re-fenced against erasures newer than the members' fence. Available once the execution has committed (phase composing or finished); otherwise members_unavailable with no_result, not_executed, export_gone (the export was purged) or withdrawn (an admin withdrew the inquiry). Runs the slot purpose gate on the output and meters the read as state reads. Another project's, environment's or slot's id is 404 not_found. Session only.

Operation ID: listSlotAtlasInquiryMembers · Service: serving-api

Authentication

• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
inquiry_id	path	yes	string	Atlas inquiry id (aiq_ ULID, 002 §1 extension, ERRATA 2026-10-20). Another project's, environment's or slot's id is indistinguishable from a missing one (404 not_found, 003 §3).
slot	path	yes	string	Deployment slot reference: the slot id (slot_ ULID, 002 §1) or the per-project-unique slot name (002 §9 — the stable API-addressable unit; names never contain _, so the two forms are disjoint). A slot belonging to another project or environment is indistinguishable from a missing one (404 not_found, 003 §3).
cursor	query	no	string	Opaque pagination cursor from a previous response's next_cursor.
limit	query	no	integer	Page size in member indices (cursor pagination, 003 §1). Maximum 1000.

Pagination

Cursor pagination (003 §1): pass limit (max 200) and cursor; the response is the pagination envelope — data plus next_cursor (null on the last page).

Responses

Status	Schema	Description
200	AtlasInquiryMemberPage	One page of member indices.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /slots/{slot}/atlas-inquiries/{inquiry_id}:choose

Choose one reading of an ambiguous inquiry

For an inquiry in awaiting_choice (two readings, expiring 10 minutes after it got there): records which reading the person meant, with chosen_by and chosen_at. The inquiry returns to queued with a fresh 10-minute queued expiry and that reading's already validated plan; the worker executes and composes it with no new plan call. The choice is a second request: the switch (including the inquiries key), quotas and budget are checked again as at create, and it is audited as atlas_copilot.inquiry.choose. Only the requester, or an organization admin, may choose. Anything else is 400 failed_precondition with an AtlasInquiryPreconditionDetail (not_choosable: not_ambiguous, already_chosen, not_requester, or choice_expired once choice_expires_at has passed). Idempotency-Key replays return the same record. Callers hold atlas.inquiries.choose (admin floor, grantable). Session only.

Operation ID: chooseSlotAtlasInquiryReading · Service: serving-api

Authentication

• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
Idempotency-Key	header	no	string	Idempotency key accepted by all POSTs (003 §1): 24 h dedup window, keyed per project. POSTs that are reads (batchSlotScores, scoreSlotEvent, deriveSlotBands, validateSourceRawPreset, sampleSource, watchEventFeedHeads and the preview operations: previewSourceMapping, previewCatalogMapping, previewLabel, previewPatternLabel, previewMarker, previewDatasetEligibility, previewSlotAudience, previewSharedCheckpointImport, previewSlotAtlasInquiry) accept the key but never replay a stored response: a retry with the same key is executed again (and metered again) against current data. A stored response that names an entity is removed when that entity is erased. A key that already answered answers only a retry of the request that stored its response: the same caller, environment, operation, path, query, scoping headers and body (a JSON body by its content, a gzip body by its inflated content). The same key with any other request is 409 already_exists with details[0].reason idempotency_key_reused, and that request is not run. The window holds no in-flight marker: two first requests sent at once can both run. A response stored by a release before this rule cannot be matched to its request and is refused the same way until it expires; send the request again with a new key. A body over 8 MiB (ingest: over its 5 MiB request limit) is run and its response is not stored. The ingest batch (POST /events) is the exception, except for an application's credentials: under a key that answered another batch it runs again, uncached, and its events' ids deduplicate them; so it does when its stored response cannot be checked. The operations that return a one-time secret store their response sealed: the stored copy opens only for the same key and credential, and one that cannot be opened is 409 idempotency_key_reused. While the server cannot check a stored response (it cannot read the key that checks it, for one), the request is 503 unavailable with Retry-After: retry with the same key. An operation whose handler claims the key itself answers the same 503, before it runs, while the key-hash pepper cannot be read; any other request sent with a key runs meanwhile, and its response is not stored.
inquiry_id	path	yes	string	Atlas inquiry id (aiq_ ULID, 002 §1 extension, ERRATA 2026-10-20). Another project's, environment's or slot's id is indistinguishable from a missing one (404 not_found, 003 §3).
slot	path	yes	string	Deployment slot reference: the slot id (slot_ ULID, 002 §1) or the per-project-unique slot name (002 §9 — the stable API-addressable unit; names never contain _, so the two forms are disjoint). A slot belonging to another project or environment is indistinguishable from a missing one (404 not_found, 003 §3).

Idempotency

This operation accepts an Idempotency-Key header (003 §1): within 24 hours, keyed per project and caller, a retry of the same request gets the first response, and the same key with another request is 409 already_exists (idempotency_key_reused). See the Idempotency-Key parameter for the exceptions.

Request body

AtlasInquiryChooseRequest

Responses

Status	Schema	Description
202	AtlasInquiryReceipt	The re-queued inquiry's receipt (roles only, never a placeholder value).
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /slots/{slot}/atlas-inquiries/{inquiry_id}:review

Approve or reject an inquiry for presenters

Records one review decision on a succeeded inquiry, for presenter replay by deep link: approve or reject an unreviewed inquiry, or withdraw it from any review state (unreviewed, approved or rejected). A withdrawal hides the inquiry's content from every reader (GET and list show only its status; members answers withdrawn), nulls its bound placeholder values at once, takes it out of content dedupe and presenter mode for good (it cannot be approved again), and is audited as atlas_copilot.inquiry.withdraw. Any other decision is 400 failed_precondition with an AtlasInquiryPreconditionDetail (not_reviewable, or already_reviewed for a second approve or reject). Callers hold atlas.inquiries.review (admin; never the presenter role). review.reviewed_by records the latest reviewer. Audit atlas_copilot.inquiry.review. Admin, session only.

Operation ID: reviewSlotAtlasInquiry · Service: serving-api

Authentication

• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
Idempotency-Key	header	no	string	Idempotency key accepted by all POSTs (003 §1): 24 h dedup window, keyed per project. POSTs that are reads (batchSlotScores, scoreSlotEvent, deriveSlotBands, validateSourceRawPreset, sampleSource, watchEventFeedHeads and the preview operations: previewSourceMapping, previewCatalogMapping, previewLabel, previewPatternLabel, previewMarker, previewDatasetEligibility, previewSlotAudience, previewSharedCheckpointImport, previewSlotAtlasInquiry) accept the key but never replay a stored response: a retry with the same key is executed again (and metered again) against current data. A stored response that names an entity is removed when that entity is erased. A key that already answered answers only a retry of the request that stored its response: the same caller, environment, operation, path, query, scoping headers and body (a JSON body by its content, a gzip body by its inflated content). The same key with any other request is 409 already_exists with details[0].reason idempotency_key_reused, and that request is not run. The window holds no in-flight marker: two first requests sent at once can both run. A response stored by a release before this rule cannot be matched to its request and is refused the same way until it expires; send the request again with a new key. A body over 8 MiB (ingest: over its 5 MiB request limit) is run and its response is not stored. The ingest batch (POST /events) is the exception, except for an application's credentials: under a key that answered another batch it runs again, uncached, and its events' ids deduplicate them; so it does when its stored response cannot be checked. The operations that return a one-time secret store their response sealed: the stored copy opens only for the same key and credential, and one that cannot be opened is 409 idempotency_key_reused. While the server cannot check a stored response (it cannot read the key that checks it, for one), the request is 503 unavailable with Retry-After: retry with the same key. An operation whose handler claims the key itself answers the same 503, before it runs, while the key-hash pepper cannot be read; any other request sent with a key runs meanwhile, and its response is not stored.
inquiry_id	path	yes	string	Atlas inquiry id (aiq_ ULID, 002 §1 extension, ERRATA 2026-10-20). Another project's, environment's or slot's id is indistinguishable from a missing one (404 not_found, 003 §3).
slot	path	yes	string	Deployment slot reference: the slot id (slot_ ULID, 002 §1) or the per-project-unique slot name (002 §9 — the stable API-addressable unit; names never contain _, so the two forms are disjoint). A slot belonging to another project or environment is indistinguishable from a missing one (404 not_found, 003 §3).

Idempotency

This operation accepts an Idempotency-Key header (003 §1): within 24 hours, keyed per project and caller, a retry of the same request gets the first response, and the same key with another request is 409 already_exists (idempotency_key_reused). See the Idempotency-Key parameter for the exceptions.

Request body

AtlasInquiryReviewRequest

Responses

Status	Schema	Description
200	AtlasInquiryReceipt	The reviewed inquiry's receipt (roles only, never a placeholder value).
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /slots/{slot}/atlas-inquiries:availability

Whether free-form inquiries can be answered here, and what this caller may do

Whether inquiries can be created for the slot in the caller's environment (the operator switch, the enabled project and environment scopes, the inquiries key and the inquiry dollar sub-cap), whether this caller may create and review, the caller's remaining quota, the typical time to an answer and the tokenizer and vocabulary versions. Spends no quota and writes nothing. Session only.

Operation ID: getSlotAtlasInquiryAvailability · Service: serving-api

Authentication

• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
slot	path	yes	string	Deployment slot reference: the slot id (slot_ ULID, 002 §1) or the per-project-unique slot name (002 §9 — the stable API-addressable unit; names never contain _, so the two forms are disjoint). A slot belonging to another project or environment is indistinguishable from a missing one (404 not_found, 003 §3).

Responses

Status	Schema	Description
200	AtlasInquiryAvailability	Availability for this caller.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /slots/{slot}/atlas-inquiries:preview

Show what the AI would see of a question

Tokenizes a question in memory with the allowlist tokenizer (tok-1) and returns exactly what the hosted model would see: the masked question (reviewed vocabulary words, punctuation and [ID] placeholder tokens) and the placeholder table. Every number the person typed becomes a typed placeholder whose value is returned here and never sent to the model; every word outside the vocabulary becomes a hidden placeholder whose text is discarded and never returned (the console shows the person's own words from its input box, at the spans offsets). Writes no row, calls no model, writes no audit object and never stores or logs the question. A refusal of the tokenizer (input_not_allowed or unanswerable with a closed detail) is returned in refusal with no masked text, so the box can say why before anything is sent. Also reads the operator switch, so the box can say when inquiries are off. Limited to 20 previews a minute per caller (429 resource_exhausted with an AtlasInquiryQuotaDetail, scope preview_rate). Callers: an organization admin or owner, or a member whose custom role (WP-A5) grants atlas.inquiries.preview, such as the presenter role, in the test environment only (a live request is copilot_disabled, environment_not_allowed). Session only.

Operation ID: previewSlotAtlasInquiry · Service: serving-api

Authentication

• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
slot	path	yes	string	Deployment slot reference: the slot id (slot_ ULID, 002 §1) or the per-project-unique slot name (002 §9 — the stable API-addressable unit; names never contain _, so the two forms are disjoint). A slot belonging to another project or environment is indistinguishable from a missing one (404 not_found, 003 §3).

Idempotency

This operation never replays a stored response (003 §1): a retry carrying the same Idempotency-Key runs again, against current data.

Request body

AtlasInquiryPreviewRequest

Responses

Status	Schema	Description
200	AtlasInquiryPreview	What the AI would see.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

Errors

Every non-2xx response uses the 003 §1 error envelope; error.request_id matches the X-Request-Id response header, and the HTTP status always matches error.code:

{
  "error": {
    "code": "invalid_argument",
    "details": [
      {
        "type": "field_violation"
      }
    ],
    "message": "human-readable",
    "request_id": "req_01hxample"
  }
}

Closed error-code set (003 §1): invalid_argument, unauthenticated, permission_denied, not_found, already_exists, failed_precondition, resource_exhausted, internal, unavailable.

resource_exhausted responses (HTTP 429) additionally carry retry_after_seconds. See ErrorEnvelope.