entity_baselines

GET /entity-baseline-bundles/{bundle_id}

Get an entity baseline bundle

One entity baseline bundle manifest by id (WP-M28 req 8). This is how a slot's active_bundle_id or history bundle_id, and the bundle id of a bundle.created, slot.activated or slot.rolled_back webhook, resolves when it names an entity baseline bundle. A sequence or event bundle's id or another tenant's id returns 404 not_found. A bundle of a descriptions.v1 or semantic.v2 build also pins that build's tokenizer inputs; this response serves the bundle without them and getEntityBaselineBundleTokenizerInputs serves them (fingerprint is the stored manifest's, which covers them; that operation states the rebuild rule).

Operation ID: getEntityBaselineBundle · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
bundle_id	path	yes	string	Entity baseline bundle id (bnd_ ULID, 002 §1).

Responses

Status	Schema	Description
200	EntityBaselineBundle	The entity baseline bundle.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /entity-baseline-bundles/{bundle_id}/tokenizer-inputs

Get an entity baseline bundle's tokenizer inputs

The tokenizer inputs an entity baseline bundle pins (WP-M28 slice 4n): its build's tokenizer format and, for a descriptions.v1 or semantic.v2 build, the copied description registry, description embeddings and semantic inputs artifacts and their content fingerprints. The released bundle reads (getEntityBaselineBundle, listEntityBaselineBundles, createEntityBaselineBundle) serve the bundle without these entries; fingerprint is the stored manifest's (002 §10), which covers them. To re-verify a bundle, rebuild its stored manifest from the released bundle: add every pins entry of this response to the bundle's pins, and insert each of its artifacts (without position) at its position, the index it holds in the stored artifacts array, in ascending position order; the rebuilt manifest's 002 §10 fingerprint equals fingerprint. A v1 bundle answers with empty pins and artifacts. A sequence or event bundle's id or another tenant's id returns 404 not_found.

Operation ID: getEntityBaselineBundleTokenizerInputs · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
bundle_id	path	yes	string	Entity baseline bundle id (bnd_ ULID, 002 §1).

Responses

Status	Schema	Description
200	EntityBaselineTokenizerInputs	The bundle's tokenizer inputs.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /entity-baseline-models

List entity baseline models

Entity baseline models of the resolved project + environment (WP-M28 req 1), newest first (cursor pagination, 003 §1). They are model versions in the shared registry, but the released ModelVersion operations never return them; this operation returns only entity baseline models.

Operation ID: listEntityBaselineModels · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
cursor	query	no	string	Opaque pagination cursor from a previous response's next_cursor.
limit	query	no	integer	Page size (cursor pagination, 003 §1). Maximum 200.

Pagination

Cursor pagination (003 §1): pass limit (max 200) and cursor; the response is the pagination envelope — data plus next_cursor (null on the last page).

Responses

Status	Schema	Description
200	EntityBaselineModelPage	Page of entity baseline models, newest first.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /entity-baseline-models

Train an entity baseline model

Creates an entity baseline model (status: training) and launches its training on the WP-M10 cpu-standard class (WP-M28 reqs 4–5): one model per label over THE aggregate-feature menu, fitted with its arm's own fixed definition on the dataset's train split, isotonic calibration of binary and multiclass outputs on the validation split, then the WP-M4 evaluation on the test split (req 7), after which the model is evaluated (or failed, with a typed training.error or evaluation_error). dataset_id must name a succeeded sequence dataset build of the project (else 400 failed_precondition), in any tokenizer format (v1, descriptions.v1 or semantic.v2: the evaluation and the batch refresh tokenize exactly as the build did, from its pinned inputs); labels must be a subset of its labels and default to all of them. Each label's arm is chosen in one of three ways: arms names it (selection.basis: explicit); study_id takes the strongest completed servable arm on the gate holdout of a completed WP-M27 study on this dataset fingerprint (study_strongest_on_gate_holdout; any other study is 400 failed_precondition, reason study_not_applicable, and another project's or a missing study is 404 not_found); with neither, every servable arm is fitted and the greatest validation primary metric wins, ties by arm name (validation). arms and study_id are mutually exclusive (400 invalid_argument). Any succeeded build, in any tokenizer format, is admitted (arm_not_servable and entity_baseline_too_large stay; owner directive 2026-10-15: the D-2 evidence is information, not a precondition). The provenance found server-side at creation is recorded on the model as admitted_by for context: the study named by study_id, otherwise the newest completed study of the project on this dataset fingerprint whatever its outcome, else an evaluated or promoted (never archived) sequence model of the project on it whose evaluation of record failed G1 for a label for a reason other than baseline_unavailable; admitted_by is absent when there is none. The servable arms are gbm_default, gbm_tuned and rfm_gbm; naming bgnbd_gg is 400 failed_precondition, reason arm_not_servable, and an unknown arm is 400 invalid_argument. A dataset whose estimated work exceeds the measured bound is 400 failed_precondition, reason entity_baseline_too_large. Each training counts toward the plan's concurrent_training_runs. Idempotency is on (dataset fingerprint, resolved arms, labels, seed, selection source), where the selection source is the study_id for a study candidate and otherwise the literal basis (validation or explicit), so a study candidate never collapses onto a direct model with the same arms: an identical request returns the existing model while it is training, evaluated or promoted; a failed, cancelled or archived one is superseded by a new model (a new mdl_ id and training) and is itself left unchanged.

Operation ID: createEntityBaselineModel · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
Idempotency-Key	header	no	string	Idempotency key accepted by all POSTs (003 §1): 24 h dedup window, keyed per project. POSTs that are reads (batchSlotScores, scoreSlotEvent, deriveSlotBands, validateSourceRawPreset, sampleSource, watchEventFeedHeads and the preview operations: previewSourceMapping, previewCatalogMapping, previewLabel, previewPatternLabel, previewMarker, previewDatasetEligibility, previewSlotAudience, previewSharedCheckpointImport, previewSlotAtlasInquiry) accept the key but never replay a stored response: a retry with the same key is executed again (and metered again) against current data. A stored response that names an entity is removed when that entity is erased. A key that already answered answers only a retry of the request that stored its response: the same caller, environment, operation, path, query, scoping headers and body (a JSON body by its content, a gzip body by its inflated content). The same key with any other request is 409 already_exists with details[0].reason idempotency_key_reused, and that request is not run. The window holds no in-flight marker: two first requests sent at once can both run. A response stored by a release before this rule cannot be matched to its request and is refused the same way until it expires; send the request again with a new key. A body over 8 MiB (ingest: over its 5 MiB request limit) is run and its response is not stored. The ingest batch (POST /events) is the exception, except for an application's credentials: under a key that answered another batch it runs again, uncached, and its events' ids deduplicate them; so it does when its stored response cannot be checked. The operations that return a one-time secret store their response sealed: the stored copy opens only for the same key and credential, and one that cannot be opened is 409 idempotency_key_reused. While the server cannot check a stored response (it cannot read the key that checks it, for one), the request is 503 unavailable with Retry-After: retry with the same key. An operation whose handler claims the key itself answers the same 503, before it runs, while the key-hash pepper cannot be read; any other request sent with a key runs meanwhile, and its response is not stored.

Idempotency

This operation accepts an Idempotency-Key header (003 §1): within 24 hours, keyed per project and caller, a retry of the same request gets the first response, and the same key with another request is 409 already_exists (idempotency_key_reused). See the Idempotency-Key parameter for the exceptions.

Request body

CreateEntityBaselineModelRequest

Responses

Status	Schema	Description
202	EntityBaselineModel	The entity baseline model (new or idempotent existing).
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /entity-baseline-models/{model_id}

Get an entity baseline model

One entity baseline model with its training, its per-label arm selection, its latest evaluation facts and the WP-M14 verdict in promotion (WP-M28 reqs 4–7). This is how a model_id from listMonitorGateFailures or the gate.failed and bundle.created webhooks resolves when it names an entity baseline model. A sequence or event model's id or another tenant's id returns 404 not_found (003 §3).

Operation ID: getEntityBaselineModel · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
model_id	path	yes	string	Entity baseline model id (mdl_ ULID, 002 §1; WP-M28).

Responses

Status	Schema	Description
200	EntityBaselineModel	The entity baseline model.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /entity-baseline-models/{model_id}/bundles

List an entity baseline model's bundles

The entity baseline model's bundle manifests, newest first (cursor pagination, 003 §1). Bundles are immutable; any change is a new bundle. A non-v1 build's tokenizer inputs are served separately by getEntityBaselineBundleTokenizerInputs, which states how they rebuild the stored manifest that fingerprint covers.

Operation ID: listEntityBaselineBundles · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
model_id	path	yes	string	Entity baseline model id (mdl_ ULID, 002 §1; WP-M28).
cursor	query	no	string	Opaque pagination cursor from a previous response's next_cursor.
limit	query	no	integer	Page size (cursor pagination, 003 §1). Maximum 200.

Pagination

Cursor pagination (003 §1): pass limit (max 200) and cursor; the response is the pagination envelope — data plus next_cursor (null on the last page).

Responses

Status	Schema	Description
200	EntityBaselineBundlePage	Page of entity baseline bundles, newest first.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /entity-baseline-models/{model_id}/bundles

Promote an entity baseline model into a bundle

Assembles the immutable, fingerprinted entity baseline bundle (WP-M28 req 8; https://spec.tessera.dev/schemas/entity_baseline_bundle.json) from the model's verified evaluation report. The response, and an Idempotency-Key replay, is the bundle without a non-v1 build's tokenizer inputs, which getEntityBaselineBundleTokenizerInputs serves (with the rule that rebuilds the stored manifest). Gate handling is the WP-M14 one under the project policy, as for every family: G1 and G2 follow the policy (advisory by default) and G4, G5 and G6 are blocking. A failed blocking gate is 400 failed_precondition with typed details [\{gate, status, severity\}]; failed advisory gates need acknowledge_gates covering exactly the failed set (strict mode refuses any acknowledgement) and are recorded in the manifest promotion block and a gate.override audit event. Records a bundle.create audit event, emits the existing bundle.created webhook (whose ids resolve through getEntityBaselineBundle and getEntityBaselineModel) and sets the model promoted. An unevaluated, failed, cancelled or archived model is 400 failed_precondition. Creating a bundle never activates it: the incumbent stays active until an explicit activateSlot.

Operation ID: createEntityBaselineBundle · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
Idempotency-Key	header	no	string	Idempotency key accepted by all POSTs (003 §1): 24 h dedup window, keyed per project. POSTs that are reads (batchSlotScores, scoreSlotEvent, deriveSlotBands, validateSourceRawPreset, sampleSource, watchEventFeedHeads and the preview operations: previewSourceMapping, previewCatalogMapping, previewLabel, previewPatternLabel, previewMarker, previewDatasetEligibility, previewSlotAudience, previewSharedCheckpointImport, previewSlotAtlasInquiry) accept the key but never replay a stored response: a retry with the same key is executed again (and metered again) against current data. A stored response that names an entity is removed when that entity is erased. A key that already answered answers only a retry of the request that stored its response: the same caller, environment, operation, path, query, scoping headers and body (a JSON body by its content, a gzip body by its inflated content). The same key with any other request is 409 already_exists with details[0].reason idempotency_key_reused, and that request is not run. The window holds no in-flight marker: two first requests sent at once can both run. A response stored by a release before this rule cannot be matched to its request and is refused the same way until it expires; send the request again with a new key. A body over 8 MiB (ingest: over its 5 MiB request limit) is run and its response is not stored. The ingest batch (POST /events) is the exception, except for an application's credentials: under a key that answered another batch it runs again, uncached, and its events' ids deduplicate them; so it does when its stored response cannot be checked. The operations that return a one-time secret store their response sealed: the stored copy opens only for the same key and credential, and one that cannot be opened is 409 idempotency_key_reused. While the server cannot check a stored response (it cannot read the key that checks it, for one), the request is 503 unavailable with Retry-After: retry with the same key. An operation whose handler claims the key itself answers the same 503, before it runs, while the key-hash pepper cannot be read; any other request sent with a key runs meanwhile, and its response is not stored.
model_id	path	yes	string	Entity baseline model id (mdl_ ULID, 002 §1; WP-M28).

Idempotency

This operation accepts an Idempotency-Key header (003 §1): within 24 hours, keyed per project and caller, a retry of the same request gets the first response, and the same key with another request is 409 already_exists (idempotency_key_reused). See the Idempotency-Key parameter for the exceptions.

Request body

CreateEntityBaselineBundleRequest (optional)

Responses

Status	Schema	Description
200	EntityBaselineBundle	The new entity baseline bundle.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /entity-baseline-models/{model_id}/eval-report

Get an entity baseline model's evaluation report

The stored eval_report.json of the entity baseline model's latest evaluation (WP-M28 req 7), in the released WP-M4 shape: G1–G6 on the dataset's test split and the identical masked test targets a sequence model has, with G3 not_applicable (no entity embedding), G4 the input-parity check and, per label, the arm, its selection basis and the uncalibrated estimate in the G1 metrics. The artifact is re-hashed against the recorded report fingerprint before it is served (002 §10, fail closed). An unevaluated model, a sequence or event model's id or another tenant's id returns 404 not_found.

Operation ID: getEntityBaselineModelEvalReport · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
model_id	path	yes	string	Entity baseline model id (mdl_ ULID, 002 §1; WP-M28).

Responses

Status	Schema	Description
200	EvalReport	The evaluation report JSON.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /entity-baseline-models/{model_id}:archive

Archive an entity baseline model

Sets the entity baseline model's status to archived (003 §1 :action). Refused with 400 failed_precondition while any deployment slot's active bundle belongs to this model or while its training is in flight (cancel it first); archiving an archived model is a no-op returning it unchanged. An archived model never admits a later entity baseline model (WP-M28 req 4).

Operation ID: archiveEntityBaselineModel · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
Idempotency-Key	header	no	string	Idempotency key accepted by all POSTs (003 §1): 24 h dedup window, keyed per project. POSTs that are reads (batchSlotScores, scoreSlotEvent, deriveSlotBands, validateSourceRawPreset, sampleSource, watchEventFeedHeads and the preview operations: previewSourceMapping, previewCatalogMapping, previewLabel, previewPatternLabel, previewMarker, previewDatasetEligibility, previewSlotAudience, previewSharedCheckpointImport, previewSlotAtlasInquiry) accept the key but never replay a stored response: a retry with the same key is executed again (and metered again) against current data. A stored response that names an entity is removed when that entity is erased. A key that already answered answers only a retry of the request that stored its response: the same caller, environment, operation, path, query, scoping headers and body (a JSON body by its content, a gzip body by its inflated content). The same key with any other request is 409 already_exists with details[0].reason idempotency_key_reused, and that request is not run. The window holds no in-flight marker: two first requests sent at once can both run. A response stored by a release before this rule cannot be matched to its request and is refused the same way until it expires; send the request again with a new key. A body over 8 MiB (ingest: over its 5 MiB request limit) is run and its response is not stored. The ingest batch (POST /events) is the exception, except for an application's credentials: under a key that answered another batch it runs again, uncached, and its events' ids deduplicate them; so it does when its stored response cannot be checked. The operations that return a one-time secret store their response sealed: the stored copy opens only for the same key and credential, and one that cannot be opened is 409 idempotency_key_reused. While the server cannot check a stored response (it cannot read the key that checks it, for one), the request is 503 unavailable with Retry-After: retry with the same key. An operation whose handler claims the key itself answers the same 503, before it runs, while the key-hash pepper cannot be read; any other request sent with a key runs meanwhile, and its response is not stored.
model_id	path	yes	string	Entity baseline model id (mdl_ ULID, 002 §1; WP-M28).

Idempotency

This operation accepts an Idempotency-Key header (003 §1): within 24 hours, keyed per project and caller, a retry of the same request gets the first response, and the same key with another request is 409 already_exists (idempotency_key_reused). See the Idempotency-Key parameter for the exceptions.

Responses

Status	Schema	Description
200	EntityBaselineModel	The entity baseline model after archival.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

POST /entity-baseline-models/{model_id}:cancel

Cancel an entity baseline model's training

Cancels the entity baseline model's training as cancelRun does (003 §1 :action; WP-M28 req 4): a queued training flips to cancelled immediately; a running training gets a cancel marker that the trainer polls between two arm fits (each arm's fit runs to its own stop rule, unchanged from the evaluation's safeguard arms), then stops and flips to cancelled. The Job is torn down either way, the plan's concurrent_training_runs slot is released, and the model becomes cancelled (terminal, never bundle-eligible). Cancelling a training that already finished is 400 failed_precondition.

Operation ID: cancelEntityBaselineModel · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
Idempotency-Key	header	no	string	Idempotency key accepted by all POSTs (003 §1): 24 h dedup window, keyed per project. POSTs that are reads (batchSlotScores, scoreSlotEvent, deriveSlotBands, validateSourceRawPreset, sampleSource, watchEventFeedHeads and the preview operations: previewSourceMapping, previewCatalogMapping, previewLabel, previewPatternLabel, previewMarker, previewDatasetEligibility, previewSlotAudience, previewSharedCheckpointImport, previewSlotAtlasInquiry) accept the key but never replay a stored response: a retry with the same key is executed again (and metered again) against current data. A stored response that names an entity is removed when that entity is erased. A key that already answered answers only a retry of the request that stored its response: the same caller, environment, operation, path, query, scoping headers and body (a JSON body by its content, a gzip body by its inflated content). The same key with any other request is 409 already_exists with details[0].reason idempotency_key_reused, and that request is not run. The window holds no in-flight marker: two first requests sent at once can both run. A response stored by a release before this rule cannot be matched to its request and is refused the same way until it expires; send the request again with a new key. A body over 8 MiB (ingest: over its 5 MiB request limit) is run and its response is not stored. The ingest batch (POST /events) is the exception, except for an application's credentials: under a key that answered another batch it runs again, uncached, and its events' ids deduplicate them; so it does when its stored response cannot be checked. The operations that return a one-time secret store their response sealed: the stored copy opens only for the same key and credential, and one that cannot be opened is 409 idempotency_key_reused. While the server cannot check a stored response (it cannot read the key that checks it, for one), the request is 503 unavailable with Retry-After: retry with the same key. An operation whose handler claims the key itself answers the same 503, before it runs, while the key-hash pepper cannot be read; any other request sent with a key runs meanwhile, and its response is not stored.
model_id	path	yes	string	Entity baseline model id (mdl_ ULID, 002 §1; WP-M28).

Idempotency

This operation accepts an Idempotency-Key header (003 §1): within 24 hours, keyed per project and caller, a retry of the same request gets the first response, and the same key with another request is 409 already_exists (idempotency_key_reused). See the Idempotency-Key parameter for the exceptions.

Responses

Status	Schema	Description
200	EntityBaselineModel	The entity baseline model after the cancellation request.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /slots/{slot}/entities/{entity_type}/{entity_id}/scores

Get an entity's scores under an entity baseline slot

The entity's current scores under a slot whose active bundle is an entity baseline bundle (WP-M28 req 10), with the mandatory freshness object (005 §7). It follows getSlotEntityState step for step, without the embedding the family does not have: a slot name outside the resolved project is 404 not_found (003 §3); a slot of another model family is 400 failed_precondition, reason model_family_not_supported (resolved from the ≤ 30 s slot cache); a principal whose purpose allow-list excludes the slot's effective purpose is 403 permission_denied, reason purpose_not_allowed (WP-V12), before any state is read; an entity_type that differs from the slot's entity type is 400 invalid_argument; an entity with no state row is 404 not_found with details[0] == \{type: "no_state", reason: "no_state", hint: "run a slot refresh"\}, and a suppressed entity reads exactly the same (WP-V12 req 4); if suppression state cannot be read the request fails with 503 unavailable and is not metered. A once-activated slot whose bundle was deactivated is 400 failed_precondition, reason no_active_bundle (its stored state is retained, not served), while a never-activated slot keeps the per-entity 404 no_state (D-R9-3, as getSlotEntityState). Metered as state_reads quantity 1 (002 §11), which also feeds the opt-in WP-A8 read audit (endpoint entity_scores). Scores are written by the slot's batch refresh (createSlotRefresh); realtime scoring of these slots is a later slice (scoring: batch_only).

Operation ID: getSlotEntityScores · Service: serving-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• consoleSession (http (bearer)) — Console session (003 §2): Identity Platform JWT. Data-plane calls add X-Tessera-Project + X-Tessera-Environment headers, validated against org membership.

Parameters

Name	In	Required	Type	Description
entity_id	path	yes	string	The customer's entity id (opaque, 002 §2).
entity_type	path	yes	string	Customer-declared entity type (002 §2).
slot	path	yes	string	Deployment slot name (002 §9: the slot is the API-addressable unit and its name is stable while bundles rotate). Resolved within the credential's project only — a slot name that exists in another project is 404 not_found (WP-V2 req 1).

Responses

Status	Schema	Description
200	SlotEntityScores	The entity's current scores under the slot.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

Errors

Every non-2xx response uses the 003 §1 error envelope; error.request_id matches the X-Request-Id response header, and the HTTP status always matches error.code:

{
  "error": {
    "code": "invalid_argument",
    "details": [
      {
        "type": "field_violation"
      }
    ],
    "message": "human-readable",
    "request_id": "req_01hxample"
  }
}

Closed error-code set (003 §1): invalid_argument, unauthenticated, permission_denied, not_found, already_exists, failed_precondition, resource_exhausted, internal, unavailable.

resource_exhausted responses (HTTP 429) additionally carry retry_after_seconds. See ErrorEnvelope.