> Production API availability: use /api/v1/help?view=guides and the resource operations catalog before following a recipe. Some localhost capabilities are not deployed yet; an absent operation is unavailable.
What this module owns
Page structure, HMVC contracts, section templates, source mappings and deployment configuration.
Use the guided patch path
Read the board, agent-context and page-flow before editing. Use the server patch/dry-run and inspect its design_review before patch. The HTTP interface does not enforce a preflight token or atomic board revision. Compile utilities when class or Sass settings change. Deploy only to the identified website and alias, then verify-deployment and inspect the rendered route.
Avoid list and hmvc replacement endpoints for routine edits. They are broader mutation surfaces than the narrow patch workflow. Read agent patches, JSON structure, data mapping and Sass v2.
First read
Use API_URL with /api/v1, for example http://localhost/api/v1. Set API_KEY privately. Replace any resource placeholder with an ID returned by discovery.
curl --fail-with-body "$API_URL/databoards" \
-H "Authorization: Bearer $API_KEY"Registered agent routes
The entries below are extracted from the current route and handler source. Scope tokens can represent alternatives or different method branches, not a requirement to grant every listed scope. Body fields are observed inputs, not a complete required-field schema. Follow the resource guide and the deployed validation response for a write.
/api/v1/databoards
Intended request methods: GET, POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:patch, databoard:read, databoard:write
Observed JSON fields: boardname, common_js, common_sass, common_scripts, common_styles, description, global_sections, group_id, hmvc, js, list, menu, name, sass, website_settings.
Selected rejection messages:
- boardname is required
- Failed to create databoard
/api/v1/databoards/{objectid}
Intended request methods: GET. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:read
Selected rejection messages:
- Invalid databoard id
- Databoard not found
/api/v1/databoards/{objectid}/hmvc
Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:write
Observed JSON fields: hmvc.
Selected rejection messages:
- Missing hmvc payload
- hmvc must be an object
- Invalid databoard id
- Databoard not found
/api/v1/databoards/{objectid}/agent-context
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: GET. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:read
Selected rejection messages:
- Invalid databoard id
- Databoard not found
- Unable to build Databoard agent context
/api/v1/databoards/{objectid}/page-flow
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: GET. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:read, ecommerce:read
Selected rejection messages:
- GET required
- Invalid databoard id
- Databoard not found
- Invalid store_id
- Missing scope: ecommerce:read
- Unable to build Page Flow audit
/api/v1/databoards/{objectid}/list
Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:write
Observed JSON fields: hmvc_list, list, mvc_list.
Selected rejection messages:
- Missing list payload
- Invalid databoard id
- Databoard not found
- Managed section tag filters differ between list and hmvc_list at
/api/v1/databoards/{objectid}/patch
Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:patch, databoard:write
Observed JSON fields: patch_delta, selected_patch_ids.
Selected rejection messages:
- Missing patch_delta payload
- selected_patch_ids must be an array
- Invalid databoard id
- Databoard not found
- Patch delta failed the Databoard design contract
- Failed to save patch_delta
- Patch delta failed
/api/v1/databoards/{objectid}/patch/dry-run
Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:patch, databoard:write
Observed JSON fields: patch_delta, selected_patch_ids.
Selected rejection messages:
- Missing patch_delta payload
- selected_patch_ids must be an array
- Invalid databoard id
- Databoard not found
- Patch delta dry run failed
/api/v1/databoards/{objectid}/group
Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:patch, databoard:write
Observed JSON fields: group_id.
Selected rejection messages:
- group_id is required
- Group not found or not writable by API key user
- Invalid databoard id
- Databoard not found
- Failed to attach group
/api/v1/databoards/{objectid}/utilities/compile
Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:patch, databoard:write
Observed JSON fields: alias, blog, deploy, group_id, list, sass, website_id.
Selected rejection messages:
- Invalid databoard id
- Databoard not found
- Invalid Sass file path:
- Failed to save utilities
- Deploy skipped: website_id, alias, or group_id could not be inferred.
- Utility compile failed
/api/v1/databoards/{objectid}/deploy
Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:deploy
Observed JSON fields: alias, blog, group_id, website_id.
Selected rejection messages:
- Invalid databoard id
- Databoard not found
- Deploy requires website_id, alias, and group_id. These can be passed in JSON or inferred from Databoard website_settings/tags_category.
- Deployment failed
/api/v1/databoards/{objectid}/stripe-credentials
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: GET, POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:deploy, databoard:read
Selected rejection messages:
- GET or POST required
- Databoard not found
- Attach a website and alias before setting Stripe credentials
- Website alias not found
- No credentials supplied
- Stripe key modes do not match
- Private credential storage is unavailable
/api/v1/databoards/{objectid}/member-mail
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: GET, POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:deploy, databoard:read
Selected rejection messages:
- GET or POST required
- Databoard not found
- Attach a website and alias first
- Deploy the website alias first
- Board and deployed HTTPS origin do not match
- Private member mail configuration failed
/api/v1/databoards/{objectid}/sync-data
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:deploy
Observed JSON fields: alias, website_id.
Selected rejection messages:
- POST required
- Databoard not found
/api/v1/databoards/{objectid}/sync-blog
Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:deploy
Observed JSON fields: alias, website_id.
Selected rejection messages:
- POST required
- Databoard not found
/api/v1/databoards/{objectid}/verify-deployment
Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: databoard:deploy
Observed JSON fields: alias, deployment_path, strict, website_id.
Selected rejection messages:
- Invalid databoard id
- Databoard not found
- Deployment path could not be inferred. Deploy first or pass deployment_path.
- Refusing to verify a path outside /antsand_data/deployment.
Access boundary
External agents use only the versioned operations documented above and returned by the deployed catalog. Browser actions and internal controllers are not substitutes for missing API operations.
Verification before automation
Read back the owned record after a write. On a dedicated local fixture, test missing input, wrong owner, missing scope and stale revisions where supported. Confirm the request did not change state when rejected. Check the generated projection separately from the source record. Never replay sends, payments or deletion requests merely to test connectivity.
See API validation and remaining gaps for the shared test strategy.
HTTP discovery and safety contract
Read GET /api/v1/help?view=guide&resource=databoards for this module's machine-readable guidance. Discover supported operations through its discovery_url when present. A null discovery_url means no direct resource API is documented; related endpoints, when provided, have their own ownership and scope requirements.
Use GET /api/v1/me with your key to confirm identity and scopes. Only request methods and fields supported by this deployment. The shared transport boundary rejects unsupported methods and malformed JSON on covered routes, but field schemas and revision checks remain resource-specific. Notes and Carousels expose typed save schemas and payload-only validation; other modules must not be assumed to share that contract.
Create, update, replace, patch, delete, send and publish are distinct capabilities. An operation absent from the returned catalog is unavailable, not permission to guess a URL. Read back after writes; after a timeout inspect the result before retrying. Never automatically replay a payment, message, deployment or deletion.