# API Reference — Planned, Not Implemented

Status: **No executable production APIs declared here**.

- OpenAPI should be generated from actual runtime contracts, with stable versioning and categorized tags.
- Future endpoints will cover identities, organizations, metadata model publishing, validations, domain transactions, integrations and audit evidence.
- A self-hosted Swagger UI or equivalent API viewer can later be served under the docs portal with a committed / generated `openapi.yaml`.
- Browser API calls require CORS, authentication, per-tenant authorization and a safe environment selection.
- Never publish API secrets or internal network topology in a public Cloudflare Pages deployment.