# API docs — 0pt

BACKLOG P1-20 (DOC-07/08). This directory did not exist before this pass.

**Source of truth:** [`contracts/openapi.yaml`](../../contracts/openapi.yaml)
(OpenAPI 3.1, `0pt Data OS API`). Route handlers in `app/api/*` realize
these contracts; `x-siax-status` on each path says whether it's `live` or
contract-first (target).

This directory does **not** duplicate the contract as hand-written prose —
that would drift the moment one of them is edited and not the other (exactly
the kind of stale-doc problem this whole compliance pass exists to fix).
Instead:

| Question | Where to look |
|---|---|
| What routes exist, request/response shapes | [`contracts/openapi.yaml`](../../contracts/openapi.yaml) directly, or render it with any OpenAPI viewer |
| Which routes are live vs. target-only | `x-siax-status` field per path in the same file |
| Risk level + auth requirement per route | `docs/architecture/ARCHITECTURE.md` §3 "API-yta" |
| Capability → surface (API/CLI/MCP/UI) coverage | `docs/architecture/ARCHITECTURE.md` §5 "Ytor och paritet" |
| The separate FastAPI engine contract (`services/api`) | `docs/04-api.md` |
| The edge-native P0 capability contract (`app/api/0pt/*`) | `docs/12-edge-capability-api.md` |

There are genuinely **two** API surfaces documented separately (edge Next.js
routes vs. the FastAPI engine) — see `docs/02-architecture.md` "Two API
surfaces" for why, before assuming a route lives in the file you expected.