# AIRUS Gateway — Full Machine Context Base URL: https://airus.world/v1 Auth: Authorization: Bearer $AIRUS_API_KEY (env AIRUS_API_KEY). Ключи создаются в кабинете, показываются один раз. Формат ошибок OpenAI: { error: { message, type, code, param } }. Ответ chat/completions включает receipts: airus_routing, airus_slo, при включении — airus_firewall / airus_data_routing / airus_byok / airus_cache. ## Endpoints POST /v1/chat/completions auth: api_key Chat Completions (streaming через stream:true), airus_routing/airus_slo/airus_firewall receipts в ответе POST /v1/embeddings auth: api_key Embeddings (OpenAI-совместимо) GET /v1/models auth: api_key Каталог доступных моделей и алиасов POST /auth/register auth: public Регистрация: создаёт тенант, проект, рублёвый счёт, owner POST /auth/login auth: public Вход, возвращает JWT accessToken POST /auth/accept-invite auth: public Вход по инвайт-токену организации (IAM) GET /me auth: jwt Профиль пользователя и тенанта GET /projects auth: jwt Проекты тенанта GET /api-keys auth: jwt API-ключи (список) POST /api-keys auth: jwt Создать ключ (keyType: standard|agent|service); полный ключ показывается один раз DELETE /api-keys/:id auth: jwt Отозвать ключ (мгновенно) GET /billing/balance auth: jwt Баланс, план, SLA-класс, commit POST /billing/top-up/manual auth: jwt Ручное пополнение (dev/тест; на проде 403 без ALLOW_MANUAL_TOPUP) GET /billing/ledger auth: jwt Append-only журнал операций GET /usage auth: jwt События использования (metadata-only) GET /v1/airus/policies auth: jwt Политики проектов POST /v1/airus/policies auth: jwt Создать политику (бюджеты, allow-list, лимиты, hybrid, firewall) PATCH /v1/airus/policies/:id auth: jwt Обновить политику GET /v1/airus/cost/summary auth: jwt Сводка затрат GET /v1/airus/cost/by-feature auth: jwt Затраты по metadata.feature (CSV через format=csv) GET /v1/airus/cost/by-client auth: jwt Затраты по metadata.client_id (перевыставление) GET /v1/airus/cost/anomalies auth: jwt Аномалии затрат GET /v1/airus/slo/summary auth: jwt SLO: p50/p95/p99, error rate, TTFT по маршрутам GET /v1/airus/observability/summary auth: jwt Наблюдаемость и health score GET /v1/airus/observability/drift auth: jwt Дрифт-правила (окно vs базлайн) GET /v1/airus/observability/metrics auth: jwt Prometheus-экспорт метрик тенанта (requests/errors/latency/cost/tokens) GET /v1/airus/observability/cacheability auth: jwt Cacheability report: hit-rate по фичам + рекомендации по кэшированию GET /v1/airus/value/summary auth: jwt Value Dashboard: стоимость за результат по вертикалям (тендеры/звонки/документы/креативы/знания) GET /v1/airus/value/event-types auth: public Типы value events и decision-метки (scale/fix/pause/kill) POST /v1/airus/value/events auth: api_key Записать бизнес-результат AI (ticket_deflected/document_processed/...) GET /v1/airus/value/roi auth: jwt ROI Receipt по use case: value/cost/net/roi% + recommendation GET /v1/airus/value/dashboard auth: jwt Executive Value Dashboard: портфель use case с ROI и решениями GET /v1/airus/batches/templates auth: public Каталог batch-шаблонов (use-case → jobType + SLA + модель) GET /v1/airus/approved-ai/employee-templates auth: public Employee-safe prompt templates по отделам (соблюдают политику) POST /v1/airus/roi/estimate auth: public ROI-калькулятор: экономия ручной обработки vs стоимость AI GET /v1/airus/trust/overview auth: public Security/SLA/Incident posture (реальные контроли + roadmap) GET /v1/airus/trust/subprocessors auth: public Model/Subprocessor Register: маршруты, классы данных, хранение GET /v1/airus/trust/data-flow auth: public Data Flow Diagram v0 (узлы/рёбра пути запроса) GET /v1/airus/trust/artifacts auth: public Trust Artifacts: документы центра доверия (видимость/статус) GET /v1/airus/trust/questionnaire auth: public AI Vendor Questionnaire с преднаполненными ответами + missing_evidence GET /v1/airus/trust/vendor-pack auth: public Vendor Assurance Pack: единый пакет для закупки GET /v1/airus/partner/blueprints auth: public Partner Launch Kit: готовые AI-внедрения (CRM/RAG/тендеры/документы/звонки) GET /v1/airus/partner/tiers auth: public Партнёрские уровни и модель маржи + режимы биллинга GET /v1/airus/partner/margin auth: jwt Partner Margin Receipt по клиентскому проекту (себестоимость → цена клиента → маржа) GET /v1/airus/partner/report auth: jwt White-label отчёт для клиента: usage по вертикалям + маржа партнёра GET /v1/airus/tools/registry-reference auth: public ToolOps reference: verbs, risk levels, approval statuses, connector registry (http_webhook/simulated доступны; MCP/CRM/1С — roadmap) POST /v1/airus/tools/register auth: jwt Регистрация Tool Contract (tool_key, verbs, risk, destructive, requires_approval, endpoint_url) GET /v1/airus/tools auth: jwt Реестр зарегистрированных инструментов тенанта POST /v1/airus/tools/preview auth: api_key Preview-before-execute: governance-решение + blast radius, БЕЗ исполнения POST /v1/airus/tools/execute auth: api_key Исполнение действия через action policy: allow→адаптер / needs_approval→pending / block GET /v1/airus/tools/approvals auth: jwt Очередь pending-действий, ожидающих одобрения (ИБ/админ) POST /v1/airus/tools/calls/:id/approve auth: jwt Одобрить pending-действие → исполнение через адаптер POST /v1/airus/tools/calls/:id/reject auth: jwt Отклонить pending-действие GET /v1/airus/tools/calls/:id/receipt auth: jwt Tool Call Receipt: verb, решение, blast radius, latency, rollback GET /v1/airus/tools/calls auth: jwt Action Log: журнал действий агентов (фильтр по approval status) GET /v1/airus/blueprints auth: public Каталог готовых AI-workflow blueprints (фильтр ?category=) GET /v1/airus/blueprints/reference auth: public Blueprint reference: категории, платформы, типы шагов, политики, integration registry, readiness-критерии GET /v1/airus/blueprints/:id auth: public Blueprint detail: манифест (шаги/модели/политики/fallback), readiness score, lint POST /v1/airus/blueprints/:id/run auth: api_key Sandbox-прогон blueprint → Blueprint Run Receipt (шаги, стоимость, fallback, business_result) POST /v1/airus/blueprints/:id/deploy auth: jwt Sandbox deploy: детерминированная валидация → Deployment Receipt (tests, readiness, missing_items, decision) GET /v1/airus/blueprints/deployments auth: jwt Список deployment-квитанций тенанта GET /v1/airus/blueprints/deployments/:id auth: jwt Blueprint Deployment Receipt по id GET /v1/airus/blueprints/runs auth: jwt Журнал прогонов blueprints (фильтр ?blueprint_id=) GET /v1/airus/blueprints/runs/:id auth: jwt Blueprint Run Receipt по id GET /v1/airus/prompts/reference auth: public PromptOps reference: prompt states, lifecycle-переходы, gate-проверки, data classes POST /v1/airus/prompts auth: jwt Создать Prompt Package (prompt_key, owner_team, use_case, context_policy) GET /v1/airus/prompts auth: jwt Реестр prompt packages тенанта GET /v1/airus/prompts/:id auth: jwt Prompt Package detail: версии, статус, lifecycle POST /v1/airus/prompts/:id/versions auth: jwt Новая версия промпта (template, variables, output_schema, model_variants) GET /v1/airus/prompts/:id/versions auth: jwt История версий GET /v1/airus/prompts/:id/diff auth: jwt Diff двух версий (?from=&to=): added/removed строки и переменные POST /v1/airus/prompts/:id/promote auth: jwt Promote по lifecycle (draft→review→staging→production→deprecated) POST /v1/airus/prompts/:id/rollback auth: jwt Rollback current_version на предыдущую POST /v1/airus/prompts/:id/test auth: api_key Детерминированный prompt-gate → Prompt Receipt (gate_status, schema_valid, checks, cost) GET /v1/airus/prompts/:id/receipts auth: jwt Prompt receipts (история прогонов gate) POST /v1/airus/context-policies auth: jwt Создать Context Policy (allow/block sources, data classes, token budget, freshness/citation/provenance) GET /v1/airus/context-policies auth: jwt Список context policies POST /v1/airus/context-policies/:id/evaluate auth: jwt Context governance dry-run: проверка context pack против политики → allow/block + violations GET /v1/airus/migration/reference auth: public MigrationOps reference: source-провайдеры, capabilities, режимы миграции POST /v1/airus/migration/import-config auth: public Импорт конфига (.env/OpenAI SDK/n8n): детект провайдера, base_url, модель (ключ не сохраняется) POST /v1/airus/migration/projects auth: jwt Создать migration project (source_provider, base_url, use_cases, mode, rollback) GET /v1/airus/migration/projects auth: jwt Реестр миграционных проектов GET /v1/airus/migration/projects/:id auth: jwt Migration project detail: scan, receipt, cutover checklist, rollback plan POST /v1/airus/migration/projects/:id/compatibility-scan auth: jwt Compatibility scan: детерминированная оценка гэпов по capabilities → score + known_gaps POST /v1/airus/migration/projects/:id/compare auth: jwt Compare → Migration Receipt: cost delta (реальный), quality delta (EvalOps), cutover decision GET /v1/airus/migration/projects/:id/receipt auth: jwt Migration Receipt + rollback plan (для CTO/CFO/ИБ) POST /v1/airus/migration/projects/:id/cutover auth: jwt Cutover checklist + решение (blocked при hold) POST /v1/airus/migration/projects/:id/rollback auth: jwt Rollback plan + возврат статуса (старый base_url/модель/ключ) GET /v1/airus/routing/reference auth: public RouteEconomics reference: complexities, objective modes, nominal scorecards POST /v1/airus/routing/policies auth: jwt Route Policy (objective, min quality, max cost/latency, fallback) GET /v1/airus/routing/policies auth: jwt Список route policies POST /v1/airus/routing/model-scorecards auth: jwt Model Scorecard по use case (quality/cost/latency; source EvalOps/declared) GET /v1/airus/routing/model-scorecards auth: jwt Scorecards (фильтр ?use_case=) POST /v1/airus/routing/simulate auth: jwt Routing Simulator: classify + cheapest-passing-model dry-run (без записи) POST /v1/airus/routing/decide auth: api_key Routing Decision → Routing Receipt (selected route, rejected reasons, cost saved) GET /v1/airus/routing/decisions/:id/receipt auth: jwt Routing Receipt по id GET /v1/airus/routing/portfolio auth: jwt RouteEconomics portfolio: cost saved, premium avoided %, savings по use case GET /v1/airus/adaptive-routing/reference auth: public AdaptiveRouting reference: modes (FIXED/BALANCED/QUALITY_FIRST/COST_CONTROLLED/ASSURED/BATCH), exploration-forbidden, hard gates, roadmap POST /v1/airus/adaptive-routing/simulate auth: public What-if routing decision (без записи): hard gates → utility → margin firewall → exploration/hysteresis; commercial_influence:none POST /v1/airus/adaptive-routing/decide auth: api_key Routing decision → sealed tamper-evident Routing Receipt (seal-once по request_id) POST /v1/airus/adaptive-routing/outcomes auth: api_key Routing Outcome (accepted/cost/latency после факта) — источник live_measured портфеля POST /v1/airus/adaptive-routing/contracts auth: jwt Routing Contract (append-only версии: quality_floor/allowlists/margin/exploration/mode) GET /v1/airus/adaptive-routing/contracts auth: jwt Список версий контрактов (фильтр ?contract_key=) POST /v1/airus/adaptive-routing/kill-switch auth: jwt Router Kill Switch: ACTIVE/EXPLORATION_OFF/PINNED/FROZEN/ROLLED_BACK GET /v1/airus/adaptive-routing/kill-switch auth: jwt Текущее состояние kill-switch (?scope_key=) GET /v1/airus/adaptive-routing/portfolio auth: jwt live_measured портфель: acceptance_rate из routing_outcomes в окне (пусто → cannot_certify) GET /v1/airus/adaptive-routing/receipts/:id auth: jwt Routing Receipt по id (uuid-guard) GET /v1/airus/adaptive-routing/receipts/:id/verify auth: jwt verify-from-sealed: пересчёт sha256 из запечатанной строки GET /v1/airus/workloads/reference auth: public WorkloadShape reference: interaction classes, hard rules (tenant в cache, semantic fail-closed, C3 no free summary), roadmap POST /v1/airus/workloads/compile auth: public Token Budget Compiler (покомпонентный) + context priority prune-план (MUST не выбрасывается) POST /v1/airus/workloads/classify auth: public Async eligibility (сомнение→REALTIME) + reasoning budget + compression plan (C3/C4 без free summary) POST /v1/airus/workloads/cache-plan auth: public Cache Identity (tenant обязателен) + Semantic Cache decision (fail-closed C3/C4/write/personalized) POST /v1/airus/workloads/retrieval-plan auth: public Retrieval Budget Governor + Progressive (minimum sufficient evidence) POST /v1/airus/workloads/output-plan auth: public Output Budget plan (enum/schema/stop → потолок) POST /v1/airus/workloads/admission auth: public Admission Control: accepted/recommend_async/rejected+retry_after POST /v1/airus/workloads/simulate-transform auth: public What-if Context Transform ПРОЕКЦИЯ (без записи) POST /v1/airus/workloads/transform auth: api_key Context Transform → sealed ПРОЕКЦИЯ receipt (computed/estimated, authoritative:false, seal-once) POST /v1/airus/workloads/document-dedup auth: api_key Content-addressable dedup eligibility-план: reuse-eligibility при совпадении checksum+parser+tenant+policy+encryption (fail-closed; server artifact-store lookup=roadmap) POST /v1/airus/workloads/contracts auth: jwt Workload Shape Contract (append-only версии) GET /v1/airus/workloads/contracts auth: jwt Список версий контрактов (?contract_key=) GET /v1/airus/workloads/receipts/:id auth: jwt Context Transform Receipt по id (uuid-guard) GET /v1/airus/workloads/receipts/:id/verify auth: jwt verify-from-sealed: пересчёт sha256 из запечатанной проекции GET /v1/airus/unit-economics/reference auth: public FinOps reference: allocation confidence, cost categories, budget ladder, hard rules (provenance по метрике) POST /v1/airus/unit-economics/vat auth: public НДС нормализация: net/vat/gross раздельно POST /v1/airus/unit-economics/cost-category auth: public Failed cost taxonomy: accepted/failed_delivery/retry/wasted (failed имеет себестоимость) POST /v1/airus/unit-economics/shared-pool auth: public Shared Cost Pool аллокация по утверждённому driver (без units → cannot_allocate) POST /v1/airus/unit-economics/reconcile auth: public Invoice Reconciliation lifecycle (estimated↔reported↔invoiced; нет инвойса → cannot_certify) POST /v1/airus/unit-economics/budget-ladder auth: public Budget Action Ladder (6 ступеней: alert→restrict_premium→disable_exploration→force_batch→read_only→hard_stop) POST /v1/airus/unit-economics/velocity auth: public Cost Velocity: burn/hour + time-to-exhaustion POST /v1/airus/unit-economics/profitability auth: public Customer Profitability Map (margin-driven; нет ledger → CANNOT_CLASSIFY) POST /v1/airus/unit-economics/engineering-cost-gate auth: public Engineering Cost Gate: COGS before/after delta (ПРОЕКЦИЯ, authoritative:false) POST /v1/airus/unit-economics/margin-leakage auth: public Margin Leakage Detector (reuse marginops; ledger-backed→live_measured) POST /v1/airus/unit-economics/cost-events auth: api_key Ingest Universal Cost Event (server-side attribution + allocation confidence; append-only) POST /v1/airus/unit-economics/allocate auth: api_key Allocation confidence (tenant server-side; client-tag → максимум ESTIMATED) GET /v1/airus/unit-economics/coverage auth: jwt live_measured allocated coverage = DIRECT/total (пусто → cannot_certify не 98%) POST /v1/airus/unit-economics/finops-receipt auth: jwt Sealed FinOps Receipt: провенанс по каждой метрике (allocated_coverage/invoice_variance/forecast_error/margin_leakage), seal-once по period GET /v1/airus/unit-economics/receipts/:id auth: jwt FinOps Receipt по id (uuid-guard) GET /v1/airus/unit-economics/receipts/:id/verify auth: jwt verify-from-sealed: пересчёт sha256 GET /v1/airus/price-book/reference auth: public Price Book reference: canonical planы + hard rules (одна правда, quote=forward, floor из записанной policy) POST /v1/airus/price-book/quote auth: public Quote = FORWARD projection (expected/P80/P95/worst + contribution margin, authoritative:false — не измеренный счёт) POST /v1/airus/price-book/floor-gate auth: public Price Floor Gate из ЗАПИСАННОГО плана (reuse MarginOps, не quote body); below-floor → blocking POST /v1/airus/price-book/discount auth: public Discount governance: только platform_fee + Give-to-Get + cap по плану (pass-through usage запрещён) POST /v1/airus/price-book/paid-pilot auth: public Paid Pilot: платный + production decision date + credit при подписании POST /v1/airus/price-book/partner-rebate auth: public Partner rebate с СОБРАННОГО positive gross profit (debt/volume/negative блокируют) POST /v1/airus/price-book/plans auth: jwt Publish canonical plan (append-only versioned price book) GET /v1/airus/price-book/plans auth: jwt List canonical plans по price_book_version POST /v1/airus/price-book/receipts auth: jwt Sealed Price Book Receipt: quote→floor gate из записанного плана→seal; below-floor BLOCKED, hypothesis NOT_FOR_CONTRACT, seal-once по quote_ref GET /v1/airus/price-book/receipts/:id auth: jwt Price Book Receipt по id (uuid-guard) GET /v1/airus/price-book/receipts/:id/verify auth: jwt verify-from-sealed: пересчёт sha256 GET /v1/airus/commercial/reference auth: public Commercial reference: WTP-статусы, исходы (win/loss/no_decision), причины, hard rules (VALIDATED только из ledger) POST /v1/airus/commercial/wtp/what-if auth: public WTP what-if: всегда DECLARED (authoritative:false; тело НЕ поднимает до VALIDATED) POST /v1/airus/commercial/outcome auth: public Классификация исхода: win/loss/no_decision (no_decision ≠ loss) POST /v1/airus/commercial/win-rate auth: public Win-rate = won/(won+lost); no_decision вне знаменателя POST /v1/airus/commercial/experiment auth: public Заключение A/B fail-closed: малое n/вырожденная выборка → CANNOT_CONCLUDE; иначе DIRECTIONAL лидер (не significance/optimal price) POST /v1/airus/commercial/experiment/assign auth: public Назначение варианта (reuse packagingops.experimentAssignVariant) POST /v1/airus/commercial/wtp auth: jwt Записать WTP-гипотезу (declared, append-only) POST /v1/airus/commercial/wtp/validate auth: jwt live_measured: VALIDATED/REFUTED/DECLARED из РЕАЛЬНО уплаченного tenant (ledger top_up), server-side GET /v1/airus/commercial/wtp auth: jwt Список WTP-гипотез tenant (по deal_ref) POST /v1/airus/commercial/outcomes auth: jwt Записать исход сделки (win/loss/no_decision, append-only) GET /v1/airus/commercial/outcomes/win-rate auth: jwt live_measured win-rate из записанных исходов (no_decision вне знаменателя) POST /v1/airus/commercial/receipts auth: jwt Sealed Commercial Receipt: WTP validation из ledger, seal-once по deal_ref GET /v1/airus/commercial/receipts/:id auth: jwt Commercial Receipt по id (uuid-guard) GET /v1/airus/commercial/receipts/:id/verify auth: jwt verify-from-sealed: пересчёт sha256 GET /v1/airus/billing-integrity/reference auth: public Billing Integrity reference: checks (completeness/dual-meter/replay), hard rules (два независимых следа ledger↔usage, cannot_certify) POST /v1/airus/billing-integrity/completeness/what-if auth: public Completeness what-if из counts тела (declared, НЕ live_measured); нет independent source → CANNOT_CERTIFY POST /v1/airus/billing-integrity/dual-meter/what-if auth: public Dual meter what-if: ledger ₽ vs usage ₽; нет пар → CANNOT_CERTIFY, расхождение → MISMATCH POST /v1/airus/billing-integrity/replay/what-if auth: public Financial replay what-if: реплей из ledger vs usage; нет ledger → CANNOT_CERTIFY, вне допуска → DISCREPANCY GET /v1/airus/billing-integrity/completeness auth: jwt live_measured completeness: join ledger↔usage по request_id в окне (orphan/double/dangling; пусто → cannot_certify) GET /v1/airus/billing-integrity/dual-meter auth: jwt live_measured dual meter: finalize ₽ vs usage ₽ по request_id (MATCHED/MISMATCH/cannot_certify) GET /v1/airus/billing-integrity/replay auth: jwt live_measured financial replay из ledger (authoritative) vs usage (RECONCILED/DISCREPANCY) POST /v1/airus/billing-integrity/receipts auth: jwt Sealed Integrity Receipt: composite fail-closed (доказанное нарушение > недостаточно данных > HEALTHY), seal-once по period GET /v1/airus/billing-integrity/receipts/:id auth: jwt Integrity Receipt по id (uuid-guard) GET /v1/airus/billing-integrity/receipts/:id/verify auth: jwt verify-from-sealed: пересчёт sha256 GET /v1/airus/finops/reference auth: public PricingOps reference: budget scopes, on-cap actions, anomaly types, cost dimensions + unit prices POST /v1/airus/finops/budgets auth: jwt Budget по scope (use_case/route/partner_client/agent_session): hard_cap, soft_alerts, on_cap_reached GET /v1/airus/finops/budgets auth: jwt Список бюджетов POST /v1/airus/finops/budgets/:id/check auth: api_key Budget guard: current_spend vs cap → decision (allow/block/degrade/require_approval) POST /v1/airus/finops/forecast auth: jwt Pre-run Cost Forecast по юнитам → optimistic/base/worst + risk flags + approval POST /v1/airus/finops/cost-receipts auth: api_key Cost Receipt: итемизированный breakdown токенов/tools/retries/fallback + markup → total GET /v1/airus/finops/cost-receipts auth: jwt Список cost receipts (фильтр ?use_case_id=) GET /v1/airus/finops/cost-receipts/:id auth: jwt Cost Receipt по id POST /v1/airus/finops/anomaly-rules auth: jwt Cost Anomaly Rule (retry_loop/context_explosion/fallback_cost_spike/spend_over_forecast/...) GET /v1/airus/finops/anomaly-rules auth: jwt Список anomaly rules POST /v1/airus/finops/anomaly-rules/:id/evaluate auth: api_key Оценка метрик по правилу → triggered + action (pause/approval) GET /v1/airus/finops/dashboard auth: jwt PricingOps dashboard: бюджеты, receipts, cost total, forecasts, активные rules GET /v1/airus/devex/reference auth: public DevExOps reference: стеки, use cases, capability note GET /v1/airus/devex/model-capabilities auth: public Model Capability Matrix: text/vision/audio/embeddings/tools/json/streaming + russian quality/latency/cost tier GET /v1/airus/devex/model-capabilities/:id auth: public Capability по маршруту GET /v1/airus/devex/quickstart auth: public Quickstart по стеку (?stack=python/node/curl/...): шаги + snippet + agent-readable docs POST /v1/airus/devex/debug auth: public Request Debug: нормализация метаданных запроса + error explainer (Error Doctor) + warnings POST /v1/airus/devex/onboarding auth: api_key Onboarding tracking: milestones (api_key/first_request/budget/fallback/quickstart) + checklist GET /v1/airus/devex/onboarding/:id/receipt auth: jwt Onboarding Receipt: time_to_first_success, production checklist, next step GET /v1/airus/providers auth: public Upstream Provider Registry: Cloud.ru Evolution (RU-модели) со статусом configured/adapter_ready GET /v1/airus/providers/:id auth: public Провайдер + каталог моделей (GigaChat/DeepSeek/GLM/Kimi/MiniMax) с ценами ₽/1M и capability-флагами GET /v1/airus/providers/:id/models auth: public Каталог моделей провайдера GET /v1/airus/integrations/connectors/catalog auth: public Connector marketplace: Bitrix24/amoCRM/1С/n8n/Telegram/webhook/email/drive/csv (actions, risk, auth, status) GET /v1/airus/integrations/connectors/catalog/:id auth: public Connector detail GET /v1/airus/integrations/reference auth: public IntegrationOps reference: risk classes, action lifecycle, approval rules POST /v1/airus/integrations/actions/preview auth: api_key Action Preview: proposed_changes (old→new) + risk_level + approval_required (без изменения системы) POST /v1/airus/integrations/actions/execute auth: api_key Execute по preview_id: решение (auto/after_approval/pending/blocked) → Action Receipt (simulated) GET /v1/airus/integrations/actions auth: jwt Журнал действий (фильтр ?status=) GET /v1/airus/integrations/actions/:id/receipt auth: jwt Action Receipt: connector, changed_fields, decision, rollback, cost GET /v1/airus/abuse/reference auth: public AbuseOps reference: ephemeral scopes, incident types, key actions, risk signals POST /v1/airus/abuse/ephemeral-tokens auth: api_key Выпуск ephemeral token (TTL, scope, allowed_models, max_requests/cost) — для frontend/mobile/demo POST /v1/airus/abuse/ephemeral-tokens/validate auth: api_key Broker-валидация ephemeral token: TTL + квота → remaining + scope (инкремент requests) GET /v1/airus/abuse/ephemeral-tokens auth: jwt Список выпущенных ephemeral tokens POST /v1/airus/abuse/risk-scan auth: jwt Key Risk Score (identity-composite): age/rotation/scope/spend/ip → score + signals + recommended_action + spend_at_risk GET /v1/airus/abuse/keys/:ref/risk auth: jwt Последний risk score ключа POST /v1/airus/abuse/incidents auth: jwt Abuse Incident: type, actions_taken, requests_blocked, cost_saved → next_action GET /v1/airus/abuse/incidents auth: jwt Журнал инцидентов GET /v1/airus/abuse/incidents/:id/receipt auth: jwt Abuse Incident Receipt GET /v1/airus/workspaces/reference auth: public WorkspaceOps reference: отделы, adoption-события, режимы маршрутов, default policy + ссылки на существующие слои (employee-templates/apply-pack/members/budgets) POST /v1/airus/workspaces auth: jwt Создать Employee Workspace: отделы, approved routes (fast/balanced/document), машинная policy (data classes/actions/бюджет на пользователя) GET /v1/airus/workspaces auth: jwt Список workspace GET /v1/airus/workspaces/:id auth: jwt Workspace detail + policy POST /v1/airus/workspaces/:id/departments auth: jwt Включить department workspaces (sales/hr/legal/finance/...) POST /v1/airus/workspaces/adoption-events auth: api_key Adoption-событие: employee_invited/first_request/prompt_pack_used/policy_block/task_completed (+time_saved) GET /v1/airus/workspaces/:id/dashboard auth: jwt Workspace dashboard/receipt: active users, отделы, requests, policy blocks, time saved, top pack GET /v1/airus/certification/reference auth: public CertificationOps reference: 8 badges (required gates/renewal), 9 review gates, partner tiers (из PartnerOps) GET /v1/airus/marketplace/listings auth: public Публичный marketplace: listed-листинги с certified badges (?type=app/connector/mcp_tool/blueprint) GET /v1/airus/certification/verify/:id auth: public Публичная верификация badge (customer-visible receipt): gates, версия, срок действия POST /v1/airus/marketplace/listings auth: jwt Создать листинг (app/connector/mcp_tool/blueprint) — фундамент marketplace GET /v1/airus/marketplace/my-listings auth: jwt Свои листинги (все статусы) с badges POST /v1/airus/marketplace/listings/:id/publish auth: jwt Публикация листинга (гейт: требуется ≥1 certified badge) POST /v1/airus/certification/reviews auth: jwt Начать review на badge; mcp_safe+tool_key → реальный MCP-audit живого Tool Contract (ToolOps) POST /v1/airus/certification/reviews/:id/gates auth: jwt Ревьюер сабмитит пройденные gates → детерминированное решение certified/rejected + score GET /v1/airus/certification auth: jwt Список сертификаций (?status=) GET /v1/airus/certification/renewals-due auth: jwt Сертификации к продлению (valid_until < 30 дней) GET /v1/airus/certification/:id/receipt auth: jwt Certification Receipt: badge, gates passed/failed, score, версия, срок GET /v1/airus/revenue/reference auth: public RevOps reference: 10 PQL-событий, revenue stages, sales tasks, CPQ-пакеты + ссылки на смежные слои POST /v1/airus/revenue/events auth: api_key PQL-событие по СВОЕМУ аккаунту/клиенту (first_workflow/roi_receipt/budget_cap_hit/...) GET /v1/airus/revenue/pql/:accountRef auth: jwt PQL Score: fit/intent/usage/trust + stage recommendation (детерминированно) POST /v1/airus/revenue/signals/derive/:accountRef auth: jwt Derive revenue-сигналов из событий (правила: cap-hit×3/7д, ROI+procurement, второй отдел...) GET /v1/airus/revenue/signals auth: jwt Открытые сигналы с recommended_action + crm_payload (Bitrix24/amoCRM deal) POST /v1/airus/revenue/signals/:id/resolve auth: jwt Закрыть сигнал: won/lost/dismissed POST /v1/airus/revenue/quotes auth: jwt CPQ package-quote: цена + себестоимость + margin_estimate + guardrail <25% GET /v1/airus/revenue/quotes auth: jwt Список package-квот POST /v1/airus/revenue/partners/attributions auth: jwt Partner attribution: source/activated/paid/MRR/commission → commission_due GET /v1/airus/revenue/partners/:partnerRef/summary auth: jwt Partner revenue summary: клиенты, MRR, commission due, expansion GET /v1/airus/revenue/pipeline auth: jwt Pipeline dashboard: стадии аккаунтов, top signals, quotes, partner MRR, forecast GET /v1/airus/analytics/events auth: public Allowlist product-событий фронта POST /v1/airus/analytics/beacon auth: public First-party beacon: анонимное product-событие (без cookies/PII, rate-limit по IP) GET /v1/airus/analytics/dashboard auth: jwt Агрегат аналитики: события, уникальные сессии, топ путей/рефереров (только platform-admin — ADMIN_EMAILS) GET /v1/airus/procurement/reference auth: public ProcurementOps reference: типы пакетов, каталог документов (source generated/template_ref/roadmap), статусы, ЭДО-провайдеры, секции анкеты POST /v1/airus/procurement/packs auth: jwt Собрать закупочный пакет (pilot/enterprise): договор/счёт/SLA/DPA-152ФЗ/security/RF-only/zero-log GET /v1/airus/procurement/packs auth: jwt Список закупочных пакетов GET /v1/airus/procurement/packs/:id auth: jwt Пакет: документы + статусы source POST /v1/airus/procurement/packs/:id/status auth: jwt Статус пакета: ready/legal_review/security_review/invoice_sent/edo_sent/signed/paid/blocked GET /v1/airus/procurement/packs/:id/documents/:docType auth: jwt Текст документа: rf_only/zero_log/data_routing — генерируются правдиво; юридические — template_ref/roadmap POST /v1/airus/procurement/packs/:id/security-questionnaire auth: jwt Заполнить security questionnaire (преднаполнено правдиво) → completion_score GET /v1/airus/procurement/packs/:id/security-questionnaire auth: jwt Security questionnaire пакета POST /v1/airus/procurement/packs/:id/edo auth: jwt EDO flow tracker (diadoc/saby/pdf_email): статусы contract/invoice/act/upd. Реальный push — roadmap GET /v1/airus/procurement/packs/:id/receipt auth: jwt Procurement Receipt: readiness, blocking_items, days_saved_estimate GET /v1/airus/audit/reference auth: public AuditOps reference: audit-действия (AI-native), risk levels, incident/evidence типы, hash algo + смежные слои POST /v1/airus/audit/events auth: api_key Append audit-события в hash-цепочку (prev_hash→event_hash, SHA-256); privacy-safe (без тела промптов) GET /v1/airus/audit/events auth: jwt Лента audit-событий (фильтры action/risk_level) GET /v1/airus/audit/integrity auth: jwt Integrity check: пересчёт цепочки — ловит правку/удаление/переупорядочивание + digest GET /v1/airus/audit/receipts/:requestId auth: jwt Audit Receipt по request_id: события + hash_chain_valid + export_ready POST /v1/airus/audit/incidents auth: jwt Создать инцидент (тип/severity/root_cause/event_ids/affected_resources) GET /v1/airus/audit/incidents auth: jwt Список инцидентов GET /v1/airus/audit/incidents/:id/timeline auth: jwt Incident timeline: события + actor_chain + resource_chain POST /v1/airus/audit/evidence auth: jwt Evidence Vault: снимок с content_hash (tamper-evident), retention, access policy GET /v1/airus/audit/evidence auth: jwt Список evidence GET /v1/airus/audit/evidence/:id/verify auth: jwt Проверка целостности evidence (пересчёт content_hash) GET /v1/airus/incidentops/reference auth: public IncidentOps reference: severities SEV1-4, типы, semantic signals (пороги), containment actions, lifecycle POST /v1/airus/incidentops/detect auth: api_key Semantic detection: метрики (json_validity/tool_call/citation/p95/cost) → инцидент даже при HTTP 200 POST /v1/airus/incidentops/incidents auth: jwt Создать managed-инцидент (severity авто из metrics; affected providers/models/workspaces/requests) GET /v1/airus/incidentops/incidents auth: jwt Список инцидентов (?status=) GET /v1/airus/incidentops/incidents/:id auth: jwt Инцидент: blast radius, fallback rate, breaches POST /v1/airus/incidentops/incidents/:id/status auth: jwt Статус: detected/investigating/contained/recovering/resolved POST /v1/airus/incidentops/incidents/:id/receipts auth: jwt Customer Incident Receipt: impact по workspace + service_credit (расчёт по SLA) GET /v1/airus/incidentops/incidents/:id/receipts auth: jwt Receipts инцидента (service credits) POST /v1/airus/incidentops/containment-policies auth: jwt Containment policy: trigger → actions, respect_rf_only, cost-guard GET /v1/airus/incidentops/containment-policies auth: jwt Список containment-политик POST /v1/airus/incidentops/containment-policies/:id/evaluate auth: jwt Policy-aware containment decision: разрешённые/заблокированные действия (RF-only + cost) GET /v1/airus/incidentops/autopilot/reference auth: jwt Autopilot reference: command roles, mitigation modes, close-rule, tenant-scope + advisory boundary POST /v1/airus/incidentops/incidents/:id/impact auth: jwt Impact node + Customer Impact Score (бизнес-ущерб, не % ошибок) GET /v1/airus/incidentops/incidents/:id/impact auth: jwt Impact Graph: blast radius (workflows tenant, critical/high, max score) POST /v1/airus/incidentops/incidents/:id/command auth: jwt Incident Command System: авто-назначение ролей war room по severity GET /v1/airus/incidentops/incidents/:id/command auth: jwt Назначенные роли war room POST /v1/airus/incidentops/mitigation/evaluate auth: jwt Mitigation Decision Engine: failover/queue/brownout/read-only/safe-mode/shutdown + проверка совместимости fallback (advisory) POST /v1/airus/incidentops/retry-shield/evaluate auth: jwt Retry Storm Shield: circuit breaker + retry budget + dedup (advisory) POST /v1/airus/incidentops/financial-safety/evaluate auth: jwt Financial Safety Mode: hold suspicious charges, critical tenant не блокируется (advisory, ledger не трогаем) POST /v1/airus/incidentops/agent-safe-mode auth: jwt Agent Safe Mode по severity: read/draft ок, external writes на паузе, финансы denied (advisory) POST /v1/airus/incidentops/backlog-replay/plan auth: jwt Controlled Backlog Replay: rate ≤80% capacity + fairness + dedup (advisory) POST /v1/airus/incidentops/incidents/:id/customer-update auth: jwt Customer-specific update: impact своего workflow + требуемое действие + billing protection GET /v1/airus/incidentops/incidents/:id/customer-updates auth: jwt История customer-updates инцидента POST /v1/airus/incidentops/incidents/:id/recovery-receipt auth: jwt Recovery Receipt: replayed/duplicates_prevented, sla_credit (computeServiceCredit), charges_reversed (pending) GET /v1/airus/incidentops/incidents/:id/recovery-receipt auth: jwt Recovery receipt инцидента POST /v1/airus/incidentops/incidents/:id/corrective-actions auth: jwt Corrective action (owner/verification_test/due) POST /v1/airus/incidentops/corrective-actions/:id/verify auth: jwt Верификация corrective action (нужен verification_test) → verified/failed POST /v1/airus/incidentops/corrective-actions/:id/status auth: jwt Статус corrective (verified только через /verify) GET /v1/airus/incidentops/incidents/:id/corrective-actions auth: jwt Corrective actions + can_close/unverified POST /v1/airus/incidentops/incidents/:id/close auth: jwt Закрыть инцидент (ПРАВИЛО: все corrective actions verified, иначе 400) GET /v1/airus/incidentops/incidents/:id/learning auth: jwt Learning Graph: похожие прошлые инциденты (provider/type) + recurrence GET /v1/airus/incidentops/metrics auth: jwt MTTD/MTTM/MTTR из timestamps инцидентов GET /v1/airus/support/reference auth: public SupportOps reference: SLA-тиры, severities, категории, integration playbooks + ссылка на Error Doctor GET /v1/airus/support/playbooks/:key auth: public Integration playbook: openai_sdk/n8n/cursor/roo_code/claude_code/langchain GET /v1/airus/support/errors/:requestId auth: jwt Error Doctor по РЕАЛЬНОМУ request_id: category/source/retryable, root cause, cost charged, fix snippets GET /v1/airus/support/debug-bundles/:requestId auth: jwt Safe Debug Bundle: телеметрия без промптов/ключей (prompt_body_included=false, api_key_redacted) POST /v1/airus/support/cases auth: jwt One-click support case: severity/category/request_ids + auto debug bundle + SLA по тиру GET /v1/airus/support/cases auth: jwt Список кейсов (?status=) GET /v1/airus/support/cases/:id auth: jwt Support case POST /v1/airus/support/cases/:id/status auth: jwt Статус кейса: open/in_progress/waiting_customer/resolved/closed POST /v1/airus/support/fix-verifications auth: jwt Fix Verification: сверка original vs replay request_id (client-driven replay) GET /v1/airus/compat/reference auth: public DevExperience reference: API profiles, уровни совместимости, contract capabilities, deprecations GET /v1/airus/compat/profiles auth: public API Profiles: openai-chat-2024/openai-responses-2026/anthropic-messages-2026/airus-native-v1 (pinning, deprecation policy) GET /v1/airus/compat/matrix auth: public Compatibility Matrix: verified/degraded/emulated/unsupported по маршрутам × профилю (?api_profile=) POST /v1/airus/compat/validate auth: public Parameter Validator: до отправки — accepted/dropped/mapped/warnings (temperature на reasoning, max_tokens→max_completion_tokens) GET /v1/airus/compat/deprecations auth: public Deprecation center: уведомления ≥90 дней POST /v1/airus/compat/contract-runs auth: jwt Прогнать contract-оценку route×profile → capability levels + test_cases_passed/total (persisted) GET /v1/airus/compat/contract-runs auth: jwt История contract runs POST /v1/airus/compat/pin auth: jwt Зафиксировать API profile (version pinning + ≥90 дней на breaking changes) GET /v1/airus/compat/pin auth: jwt Текущий закреплённый API profile GET /v1/airus/price/reference auth: public PricingOps reference: fee-структура (без скрытых коэффициентов), commit-планы, price-lock периоды GET /v1/airus/price/commit-plans auth: public Commit ladder: PAYG/50k/250k/1M/enterprise-reserved (скидка+price-lock+SLA+support) POST /v1/airus/price/quote auth: public Price Quote до отправки: Price Anatomy (upstream+gateway_fee+reliability+SLA+RF-only+retry) + estimated/maximum_total POST /v1/airus/price/fallback-ceiling auth: public Fallback Cost Ceiling: pre-execution guardrail (uplift ≤ лимита? approval? on_limit) POST /v1/airus/price/margin auth: public Margin status workflow: gross_margin + healthy/thin/negative POST /v1/airus/price/locks auth: jwt Price Lock: фиксация цены на 30/90/365 дней (+commit plan, VAT) GET /v1/airus/price/locks auth: jwt Список price-lock (active-флаг) GET /v1/airus/price/locks/:id auth: jwt Price Lock detail POST /v1/airus/price/changes auth: jwt Price Change Receipt (versioned): old→new, change%, impact, effective_at, notice≥, recommended_action GET /v1/airus/price/changes auth: jwt Журнал изменений цен (Price Change Ledger) GET /v1/airus/billing/reference auth: public BillingOps reference: charging policy (Zero Double-Charge), типы adjustment/dispute, VAT + ссылки на реальный ledger GET /v1/airus/billing/charging-policy/:situation auth: public Charging decision: тарифицируется ли ситуация (validation_error/timeout/partial_streaming/duplicate_idempotent...) POST /v1/airus/billing/receipts auth: jwt Выпустить verifiable Billing Receipt: canonical usage + provider+fee+VAT − credits + sha256 hash GET /v1/airus/billing/receipts auth: jwt Список billing receipts GET /v1/airus/billing/receipts/:requestId auth: jwt Billing Receipt по request_id (раскрытие итога до конкретного запроса) GET /v1/airus/billing/receipts/:requestId/verify auth: jwt Математическая верификация receipt (пересчёт hash) POST /v1/airus/billing/reconciliation auth: jwt Reconciliation Run: AIRUS receipts vs provider statement → matched/unmatched/difference GET /v1/airus/billing/reconciliation auth: jwt История сверок POST /v1/airus/billing/adjustments auth: jwt Billing Adjustment: refund/credit/correction/sla_credit/promotional_credit GET /v1/airus/billing/adjustments auth: jwt Журнал adjustments POST /v1/airus/billing/disputes auth: jwt Dispute by request_id: авто-проверки (idempotency/attempts/status) → verdict + авто-credit GET /v1/airus/billing/disputes auth: jwt Список споров GET /v1/airus/fraud/reference auth: public AntiFraudOps reference: fraud signals, containment tiers, rotation reasons + ссылки на AbuseOps/Firewall/Billing POST /v1/airus/fraud/honey-check auth: public Проверка honey-токена: срабатывание canary = доказательство утечки GET /v1/airus/fraud/validity-check/:prefix auth: public Leak validity-check (GitHub-style): honey/unknown статус ключа POST /v1/airus/fraud/baselines auth: jwt Behavioral baseline ключа: spend velocity, model mix, ASN/region, concurrency, active hours POST /v1/airus/fraud/evaluate auth: jwt Оценка: observed vs baseline → fraud signals + behavioral risk + adaptive containment (сохраняет production) GET /v1/airus/fraud/signals auth: jwt Журнал fraud signals (?key_ref=) POST /v1/airus/fraud/rotations auth: jwt Safe Rotation receipt: overlap→migrate→revoke (zero downtime) GET /v1/airus/fraud/rotations auth: jwt История ротаций ключей POST /v1/airus/fraud/honey-keys auth: jwt Выпустить honey (canary) key для репо/доки/.env (drill) GET /v1/airus/fraud/honey-keys auth: jwt Список honey keys (triggered-флаг) POST /v1/airus/fraud/cases auth: jwt Fraud Case → Zero Fraud Charge: подтверждённое мошенничество → credit (BillingOps adjustment) GET /v1/airus/enterprise/reference auth: public EnterpriseOps reference: deal stages, buying roles, continuity matrix, capability contract POST /v1/airus/enterprise/roi auth: public Pre-sale ROI model: conservative/expected/max сценарии + payback (без auth) POST /v1/airus/enterprise/capability-contract auth: public Capability Contract: accuracy/availability/cost/data_residency/latency + exit assurance POST /v1/airus/enterprise/accounts auth: jwt Enterprise account (segment, ARR, use case, stage) GET /v1/airus/enterprise/accounts auth: jwt Список аккаунтов (?stage=) POST /v1/airus/enterprise/accounts/:id/stage auth: jwt Стадия сделки: discovery/security_review/pilot/procurement/production/expansion POST /v1/airus/enterprise/accounts/:id/committee auth: jwt Buying Committee Map: роли → coverage score + missing critical roles POST /v1/airus/enterprise/accounts/:id/pilots auth: jwt Pilot Success Contract (правило: без business owner/baseline/decision_date/budget/metrics — 400) GET /v1/airus/enterprise/accounts/:id/pilots auth: jwt Пилоты аккаунта POST /v1/airus/enterprise/pilots/:id/evaluate auth: jwt Pilot Gate: observed vs targets → pass/fail + production offer POST /v1/airus/enterprise/accounts/:id/requirements auth: jwt Procurement Requirement (category → requirement → evidence → owner) POST /v1/airus/enterprise/requirements/:id/status auth: jwt Статус требования: open/supported/partial/gap GET /v1/airus/enterprise/accounts/:id/deal-room auth: jwt Deal Room: агрегат — committee coverage, pilot gate, requirements, deal risk, blockers, readiness, next action GET /v1/airus/success/reference auth: public CustomerSuccessOps reference: activation-уровни (technical/production/value), веса health, churn-каталог GET /v1/airus/success/playbooks auth: public Success playbooks: activation_stalled/usage_drop/quality_drop/commit_underused/champion_replacement GET /v1/airus/success/activation-template auth: public 30-дневный шаблон production-активации (фазы + milestones) POST /v1/airus/success/accounts/:id/success-plan auth: jwt Customer Success Plan: business_goal/baseline/target/owner/stakeholders + seed 30-day activation GET /v1/airus/success/accounts/:id/success-plan auth: jwt Success plan + прогресс активации POST /v1/airus/success/accounts/:id/stakeholders auth: jwt Stakeholder map → coverage score + single_champion_risk GET /v1/airus/success/accounts/:id/activation auth: jwt Activation journey: milestones, stalled, production_activated POST /v1/airus/success/accounts/:id/activation/:key auth: jwt Обновить milestone (status/owner/blocker/due_at) POST /v1/airus/success/accounts/:id/value-events auth: jwt Value Realization event: metric/value/financial_equivalent/evidence/customer_verified POST /v1/airus/success/value-events/:id/verify auth: jwt Подтверждение value event клиентом (customer_verified) GET /v1/airus/success/accounts/:id/value-receipt auth: jwt Value Receipt: realized/pending savings, net value, value multiple, by workflow/metric POST /v1/airus/success/accounts/:id/health auth: jwt Account Health Score: value/stakeholder из своих таблиц + входы → score + reasons + action GET /v1/airus/success/accounts/:id/health auth: jwt Последний health snapshot POST /v1/airus/success/accounts/:id/churn/evaluate auth: jwt Churn Signal Engine (contextual): usage-decline при стабильных workflows — не сигнал; рост от retries — сигнал GET /v1/airus/success/accounts/:id/churn auth: jwt Churn-сигналы аккаунта (?status=open) POST /v1/airus/success/churn/:id/resolve auth: jwt Закрыть churn-сигнал GET /v1/airus/success/accounts/:id/expansion auth: jwt Expansion graph: рекомендации (?workflow=) или сохранённые возможности POST /v1/airus/success/accounts/:id/expansion auth: jwt Добавить expansion opportunity (current→proposed workflow, ARR, launch days, complexity) POST /v1/airus/success/accounts/:id/renewal auth: jwt Renewal plan: contract_end → timeline 180/120/60/30 + status GET /v1/airus/success/accounts/:id/renewal auth: jwt Renewal timeline + статус (on_track/at_risk/monitoring) GET /v1/airus/success/accounts/:id/success-room auth: jwt Success Room: агрегат — plan, activation, health, value, churn, renewal, expansion, next action GET /v1/airus/advocacy/reference auth: public AdvocacyOps reference: evidence tiers, consent modes, proof pack requirements, rules (estimated not publishable, honest case, reference quota) POST /v1/airus/advocacy/accounts/:id/claims auth: jwt Evidence Claim: statement/metric/baseline/result/tier (A verified_operational/B customer_verified/C estimated) + evidence_refs POST /v1/airus/advocacy/claims/:id/verify auth: jwt Подтверждение claim (customer_approved / tier upgrade / evidence refs) GET /v1/airus/advocacy/accounts/:id/claims auth: jwt Evidence claims аккаунта POST /v1/airus/advocacy/accounts/:id/consent auth: jwt Advocacy Consent: режим (public_named/public_anonymous/private_reference/evidence_only) + allowed_assets + expiry POST /v1/airus/advocacy/consent/:id/revoke auth: jwt Отзыв согласия на публикацию POST /v1/airus/advocacy/accounts/:id/cases auth: jwt Case Study (правила: Honest Case Standard = limitations обязательны; consent режима; claims не estimated) GET /v1/airus/advocacy/accounts/:id/cases auth: jwt Кейсы аккаунта + freshness (current/due_for_revalidation/historical) POST /v1/airus/advocacy/cases/:id/refresh auth: jwt Перепроверка кейса (Case Freshness SLA) → current POST /v1/airus/advocacy/cases/:id/attribution auth: jwt Partner Attribution (правило: business_owner обязателен — запрет присвоения результата) POST /v1/airus/advocacy/accounts/:id/reference auth: jwt Reference Customer Registry: supported_topics, max calls/quarter, min ARR POST /v1/airus/advocacy/references/match auth: jwt Reference Matching: opportunity → score (industry/use_case/topics/security/arr) + best eligible POST /v1/airus/advocacy/references/:id/request auth: jwt Reference Request (enforce квоты + минимального ARR) POST /v1/airus/advocacy/reference-requests/:id/complete auth: jwt Завершить reference call (списать квоту + feedback) POST /v1/airus/advocacy/accounts/:id/champion auth: jwt Champion Network: уровень (contributor/advocate/strategic) по вкладу, не по похвале POST /v1/airus/advocacy/influence auth: jwt Advocacy Influence Event: asset → opportunity → influenced ARR GET /v1/airus/advocacy/influence/report auth: jwt Influence report: influenced pipeline, by event, proof-assisted win rate GET /v1/airus/advocacy/accounts/:id/proof-pack auth: jwt Buyer-specific Proof Pack (?buyer_role=cto/ciso/cfo/product_owner/procurement): required vs available GET /v1/airus/advocacy/accounts/:id/advocacy-room auth: jwt Advocacy Room: агрегат — verified claims, consent modes, cases+freshness, reference, champion, next action GET /v1/airus/trust-center/reference auth: public TrustCenter reference: слои (public/customer/machine), SLO defs, availability definition, severity, postmortem поля, boundary с IncidentOps GET /v1/airus/trust-center/status auth: public Component-level status (12 компонентов) + availability_30d POST /v1/airus/trust-center/status/compute auth: public Калькулятор статуса компонента из метрик (operational/degraded/partial/major/maintenance) GET /v1/airus/trust-center/incidents auth: public Публичный incident archive + overdue corrective actions (affected_tenants — счётчик) GET /v1/airus/trust-center/incidents/:id auth: public Инцидент: timeline + postmortem + corrective actions + communication SLA POST /v1/airus/trust-center/postmortem/validate auth: public Валидатор postmortem по стандарту (impact/root_cause/detection/recovery/corrective/what_worked/what_failed) GET /v1/airus/trust-center/slo auth: public SLO definitions + availability definition + SLA credit ladder POST /v1/airus/trust-center/slo/evaluate auth: public Verifiable SLO: availability + breach + credit% + реальный sha256 evidence_hash (методику не менять задним числом) GET /v1/airus/trust-center/routes auth: public Route Trust Passports: regions/retention/training_usage/fallback/data_classes/SLA/last_verified GET /v1/airus/trust-center/routes/:id auth: public Passport конкретного route (rf_zero_log/rf_standard/embeddings_rf/external_fallback) GET /v1/airus/trust-center/providers auth: public Provider Health Matrix — ВСЕГДА анонимизировано в public (имена под NDA только через JWT) GET /v1/airus/trust-center/providers/named auth: jwt Provider Health Matrix с именами провайдеров (JWT/NDA) GET /v1/airus/trust-center/evidence auth: public Security Evidence Registry + freshness; истёкшее исключено (?include_expired=true) GET /v1/airus/trust-center/subprocessors auth: public Subprocessor Registry + changelog (30-day notice, geography, effective dates) GET /v1/airus/trust-center/disclosure auth: public Responsible Disclosure policy: contact/PGP/scope/prohibited/safe harbor/timeline GET /v1/airus/trust-center/security-txt auth: public security.txt (RFC 9116) в text/plain GET /v1/airus/trust-center/badge auth: public Trust Badge: overall + availability_30d + last incident (открывает данные, не картинку) GET /v1/airus/trust-center/customer-room auth: jwt Customer Trust Room: платформенный статус + требования tenant + evidence expiry + SLA + инциденты именно его GET /v1/airus/trust-center/sla/compliance auth: jwt SLA compliance tenant из OpsIncident (Ф47) GET /v1/airus/resilience/reference auth: public ResilienceOps reference: tiers R0–R4, chaos scenarios, recovery groups, control-plane survival, rules GET /v1/airus/resilience/tiers auth: public Resilience Tiers R0–R4: RTO/RPO/fallbacks/drill cadence/cost delta GET /v1/airus/resilience/failure-domains auth: public Failure Domain Registry (provider/cloud/zone/dns/kms/db + shared_risk_group) POST /v1/airus/resilience/failure-domains/shared-risk auth: public Common-mode detection: два маршрута независимы или делят failure domain POST /v1/airus/resilience/failover-matrix auth: public Semantic Failover Matrix: primary vs fallback (json/tool/accuracy/latency/cost/rf-only) → pass/warning/fail POST /v1/airus/resilience/capacity/headroom auth: public Capacity headroom при эвакуации на fallback → sufficient / load-shedding GET /v1/airus/resilience/degradation-profiles auth: public Graceful degradation profiles (normal/degraded/emergency) + priority classes + never-shed POST /v1/airus/resilience/degradation/plan auth: public Degradation plan по уровню нагрузки (что снижается, что не режется) GET /v1/airus/resilience/recovery-groups auth: public Recovery Dependency Groups: порядок восстановления (core→state→runtime→stateful→ops) GET /v1/airus/resilience/control-plane-survival auth: public Control Plane Survival: что продолжает работать при потере control plane GET /v1/airus/resilience/cost auth: public Resilience Cost Optimizer: cost delta по tier (?tier=R2) POST /v1/airus/resilience/workflows/:id/profile auth: jwt Resilience Profile: tier/RTO/RPO/min quality/max cost/data policy GET /v1/airus/resilience/workflows/:id/profile auth: jwt Resilience profile workflow POST /v1/airus/resilience/workflows/:id/failover-plan auth: jwt Failover Plan (ПРАВИЛО: R2+ critical → нужен quality_receipt_id, иначе 400) GET /v1/airus/resilience/workflows/:id/failover-plan auth: jwt Failover plans workflow POST /v1/airus/resilience/chaos/experiments auth: jwt Chaos Experiment (scenario/scope/blast_radius/abort_conditions) GET /v1/airus/resilience/chaos/experiments auth: jwt Chaos experiments POST /v1/airus/resilience/chaos/experiments/:id/result auth: jwt Результат drill → оценка abort conditions → passed/aborted POST /v1/airus/resilience/chaos/experiments/:id/receipt auth: jwt Resilience Receipt: actual vs target RTO/RPO/quality/cost → certified/failed GET /v1/airus/resilience/receipts auth: jwt Resilience receipts (drills) GET /v1/airus/resilience/room auth: jwt Resilience Room: профили, планы, chaos pass rate, certified receipts, next action GET /v1/airus/resilience/metrics auth: jwt tested_rto, chaos_pass_rate, certified receipts, drills GET /v1/airus/sovereignty/reference auth: public SovereigntyOps reference: deployment modes, disconnected control plane, rules (три уровня независимости) GET /v1/airus/sovereignty/deployment-modes auth: public Deployment Profiles: SaaS/Dedicated RF/Customer VPC/On-prem/Air-gapped GET /v1/airus/sovereignty/disconnected-control-plane auth: public Что продолжает работать без внешнего интернета (external routes → unavailable, не блокируют) POST /v1/airus/sovereignty/policy/compile auth: public Sovereignty Policy Compiler: rf_only/no_telemetry/offline → model routes/network/storage/logging/toolops/artifacts POST /v1/airus/sovereignty/hybrid/schedule auth: public Controlled Hybrid Scheduler: data-class-aware (sensitive→local, critical→reserved, public→burst) POST /v1/airus/sovereignty/license-passport auth: public License passport open-weight модели → production_approved (commercial_use + field restrictions) POST /v1/airus/sovereignty/artifact-manifest auth: public Artifact manifest + sha256 hash + license check (Sovereign Artifact Vault) POST /v1/airus/sovereignty/substitution/preview auth: public Derived статус замены (certified/conditional/warning/gap) без записи POST /v1/airus/sovereignty/deployments/:name auth: jwt Deployment Profile (mode/control_plane_location/inference/external_connectivity/license_mode) GET /v1/airus/sovereignty/deployments auth: jwt Deployment profiles tenant POST /v1/airus/sovereignty/workflows/:id/dependencies auth: jwt Sovereignty Dependency (component/provider_country/criticality/local_substitute/artifact/offline) GET /v1/airus/sovereignty/workflows/:id/dependencies auth: jwt Dependency registry workflow GET /v1/airus/sovereignty/workflows/:id/sovereignty-score auth: jwt Sovereignty Score (foreign critical unsubstituted штрафует; ?mode=) + sovereign_ready POST /v1/airus/sovereignty/workflows/:id/substitutions auth: jwt Model Substitution (DERIVED статус: certified только с quality_receipt + measured >= floor + schema/tool) GET /v1/airus/sovereignty/workflows/:id/substitutions auth: jwt Substitutions workflow POST /v1/airus/sovereignty/entitlements auth: jwt Offline Entitlement (valid_until + grace period + allowed capabilities) GET /v1/airus/sovereignty/entitlements/:id auth: jwt Проверка entitlement (valid/grace/expired) POST /v1/airus/sovereignty/workflows/:id/sovereignty-receipt auth: jwt Sovereignty Receipt (drill): foreign disabled + local substitution + quality/capacity → certified/failed GET /v1/airus/sovereignty/receipts auth: jwt Sovereignty receipts (drills) GET /v1/airus/sovereignty/room auth: jwt Sovereignty Room: deployments, foreign critical deps, certified substitutions, receipts, next action GET /v1/airus/sovereignty/metrics auth: jwt foreign_dependency_count, artifact/offline coverage, certified substitutions/drills GET /v1/airus/local-models/reference auth: public LocalModelOps reference: precisions, route classes, rules (variant needs benchmark, adapter lineage, no latest) GET /v1/airus/local-models/catalog auth: public Local Model Registry: GigaChat 3.1 Lightning/3.5 Ultra, T-lite/T-pro, YandexGPT (params/context/precisions/runtime) GET /v1/airus/local-models/route-classes auth: public Route classes: local/fast|balanced|reasoning|tool-calling|legal|code|offline POST /v1/airus/local-models/quantization-gate auth: public Quantization Quality Gate: business_accuracy floor + json/tool/numerical within tol → approved/rejected + memory reduction POST /v1/airus/local-models/hardware-fit auth: public Hardware Fit Planner: weights + KV-cache → GPU count/precision/runtime/TCO POST /v1/airus/local-models/tco auth: public API-vs-Local TCO + break-even + cost per ACCEPTED result (честно рекомендует API если self-hosting бессмыслен) POST /v1/airus/local-models/fine-tune-decision auth: public Fine-tune Decision: prompt/structured/RAG/few-shot/reranker first; НЕ fine-tune для меняющихся данных POST /v1/airus/local-models/cascade auth: public Dynamic Model Cascade: confidence/risk/rf_only → route class + escalation POST /v1/airus/local-models/optimization/preview auth: public Optimization receipt preview: baseline→selected → production_approved (quality в допуске) POST /v1/airus/local-models/benchmarks auth: jwt Local benchmark run на датасете клиента (business_accuracy/json/tool/numerical) GET /v1/airus/local-models/benchmarks auth: jwt Benchmark runs tenant POST /v1/airus/local-models/variants auth: jwt Model variant — статус DERIVED из Quality Gate (approved невозможен без прохождения benchmark) GET /v1/airus/local-models/variants auth: jwt Model variants (quantization) POST /v1/airus/local-models/adapters auth: jwt Model adapter — production требует base_model_version + dataset_version + quality_receipt (lineage) → 400 POST /v1/airus/local-models/adapters/:id/status auth: jwt Статус adapter (production enforced lineage) GET /v1/airus/local-models/adapters auth: jwt Adapter Registry + lineage POST /v1/airus/local-models/optimization-receipts auth: jwt Optimization Receipt (baseline→selected, memory/throughput/quality → production_approved) GET /v1/airus/local-models/optimization-receipts auth: jwt Optimization receipts GET /v1/airus/local-models/room auth: jwt Local Model Factory Room: benchmarks, approved/rejected variants, adapters, optimizations, next action GET /v1/airus/local-models/metrics auth: jwt variants tested/approved, production adapters GET /v1/airus/gpu-finops/reference auth: public GPUFinOps reference: gpu types, allocation methods, waste types, efficiency weights, rules POST /v1/airus/gpu-finops/unified-cost auth: public Unified GPU cost model: base+bundle+NVLink premium (justified?)+VAT → effective GPU-hour POST /v1/airus/gpu-finops/allocate auth: public Распределение cost по долям (gpu-time/vram/token/request) + unallocated POST /v1/airus/gpu-finops/accepted-per-gpu-hour auth: public Accepted results per GPU-hour + cost per accepted result POST /v1/airus/gpu-finops/efficiency-score auth: public GPU Efficiency Score DERIVED (accepted+throughput=40% → загрузка при плохом качестве не даёт высокий score) POST /v1/airus/gpu-finops/waste/detect auth: public Waste Engine: idle/low-util/duplicated model/NVLink/warm pool/stale/underused commitment → findings + monthly waste POST /v1/airus/gpu-finops/commitment/evaluate auth: public Commitment decision DERIVED: reject до оптимизации (FP8) или при forecast ниже floor; discount != capacity POST /v1/airus/gpu-finops/warm-pool auth: public Warm Pool Optimizer: required replicas под QPS + idle cost POST /v1/airus/gpu-finops/scheduler auth: public Training/Inference Scheduler: priority + preemption (low-priority вытесняется при production pressure) POST /v1/airus/gpu-finops/capacity-portfolio auth: public Capacity Portfolio: base→owned, growth→committed, peak→on-demand, rare→API, DR→reserved POST /v1/airus/gpu-finops/waste-receipt auth: public GPU Waste Receipt: spend/productive/waste/reserve/savings + productive_spend_ratio POST /v1/airus/gpu-finops/assets auth: jwt GPU Asset Ledger (provider/gpu_type/count/topology/hourly_cost/commercial_model/owner) GET /v1/airus/gpu-finops/assets auth: jwt GPU assets tenant POST /v1/airus/gpu-finops/assets/:id/allocations auth: jwt Allocation record (key/workflow/method/gpu-seconds/allocated cost) GET /v1/airus/gpu-finops/allocations auth: jwt Allocation ledger POST /v1/airus/gpu-finops/chargeback auth: jwt Department Chargeback (ПРАВИЛО: требует allocation coverage >= порога, иначе 400 showback only) POST /v1/airus/gpu-finops/waste-findings auth: jwt GPU waste finding GET /v1/airus/gpu-finops/waste-findings auth: jwt Waste findings POST /v1/airus/gpu-finops/commitments auth: jwt Capacity commitment — decision DERIVED (нельзя self-assert approved) GET /v1/airus/gpu-finops/commitments auth: jwt Commitments POST /v1/airus/gpu-finops/savings-actions auth: jwt Savings Action (action + savings + latency/quality/sla risk + approval_required) POST /v1/airus/gpu-finops/savings-actions/:id/status auth: jwt Статус savings (applied рискованного требует approved) GET /v1/airus/gpu-finops/savings-actions auth: jwt Savings actions GET /v1/airus/gpu-finops/room auth: jwt GPU FinOps Room: spend, allocation coverage, waste, commitments at risk, potential savings, next action GET /v1/airus/gpu-finops/metrics auth: jwt monthly spend, productive_spend_ratio, allocation coverage, confirmed waste GET /v1/airus/margins/reference auth: public MarginOps reference: FX modes, billable events, anomaly types, rules (floor from policy, block negative margin) POST /v1/airus/margins/fx-apply auth: public FX: USD→RUB по курсу ЦБ + буфер (для гарантированной enterprise-цены) GET /v1/airus/margins/billable-matrix auth: public Billable Event Matrix: кто платит (клиент/upstream) по событию (retry/cancel/filter/fallback) GET /v1/airus/margins/billable/:event auth: public Billable правило события POST /v1/airus/margins/upstream-cost auth: public Стоимость запроса по pricing version (input/output/cache/reasoning раздельно) POST /v1/airus/margins/economics/preview auth: public Request economics: contribution margin DERIVED (revenue − upstream − partner − platform − reserve) POST /v1/airus/margins/fallback/check auth: public Margin-aware fallback: cost delta в лимите И маржа >= floor (или SLA reserve) → allow/block POST /v1/airus/margins/discount/check auth: public Discount Guardrail: скидка ниже floor требует commit/min-spend/approval POST /v1/airus/margins/price-lock/reserve auth: public Price Lock Reserve: volatility+FX+provider+SLA+financing → reserve% + locked price POST /v1/airus/margins/anomalies/detect auth: public Margin Anomaly: negative margin / fallback spike / FX / output ratio / pricing mismatch → alerts POST /v1/airus/margins/gross-margin-receipt auth: public Gross Margin Receipt: revenue − fully-loaded cost → contribution margin + rate POST /v1/airus/margins/pricing-versions auth: jwt Pricing Version Registry (provider/model/currency/input/output/effective_at/VAT) GET /v1/airus/margins/pricing-versions auth: jwt Pricing versions POST /v1/airus/margins/policies/:scope/:key auth: jwt Margin Policy (scope customer/route/workflow): min gross/contribution margin, incident override GET /v1/airus/margins/policies auth: jwt Margin policies POST /v1/airus/margins/route-check auth: jwt Margin route check (ПРАВИЛО: floor из ЗАПИСАННОЙ policy; отрицательная маржа → block) POST /v1/airus/margins/economics auth: jwt Record request economics (contribution margin DERIVED) GET /v1/airus/margins/economics auth: jwt Request economics ledger POST /v1/airus/margins/price-locks auth: jwt Price Lock (valid_until/min commit/fx corridor/reserve/routes) GET /v1/airus/margins/price-locks auth: jwt Price locks POST /v1/airus/margins/alerts auth: jwt Margin alert GET /v1/airus/margins/alerts auth: jwt Margin alerts GET /v1/airus/margins/room auth: jwt Margin Room: revenue, contribution margin, negative-margin requests, policies, next action GET /v1/airus/margins/metrics auth: jwt gross margin rate, contribution margin, negative-margin requests, open alerts GET /v1/airus/packaging/reference auth: public PricingOps reference: pricing principles, packaging tiers (гипотеза), value metrics, capability packs, rules (entitlement из подписки, quote DERIVED, price-lock) GET /v1/airus/packaging/tiers auth: public Packaging tiers (Sandbox/Business/Enterprise/On-prem) — продуктовая гипотеза упаковки (состав/fences), НЕ прайс: платформенная цена = null, из canonical price book (/v1/airus/price-book). #23 убрал дубль-число GET /v1/airus/packaging/tiers/:tier auth: public Tier: platform fee, included, entitlements, fences GET /v1/airus/packaging/tiers/:tier/entitlements auth: public Entitlements и fences тира (реестр) GET /v1/airus/packaging/value-metrics auth: public Value Metric Registry: метрика ценности на каждый продукт (tokens/org-month/successful run/reserved throughput/...) GET /v1/airus/packaging/capability-packs auth: public Capability Packs: Resilience/Governance/Trust/Sovereignty/FinOps + monthly fee GET /v1/airus/packaging/capability-packs/:pack auth: public Capability pack: includes + monthly fee POST /v1/airus/packaging/quote/preview auth: public Contract quote: expected + worst-case total DERIVED из компонентов (platform_fee + usage + packs) POST /v1/airus/packaging/calculator auth: public Public Pricing Calculator: workflow → model usage → expected + worst-case POST /v1/airus/packaging/overage/check auth: public Overage Corridor: ≤110% contract / 110–125% corridor / >125% upgrade-or-burst POST /v1/airus/packaging/rollover/compute auth: public Rollover: carried = min(unused, annual × rollover%) — ограниченный перенос POST /v1/airus/packaging/commitment/forecast auth: public Commitment Autopilot: P50/P80/P95 из выборки usage → рекомендованный commit + underuse risk POST /v1/airus/packaging/transparency-receipt auth: public Pricing Transparency Receipt (contract-level, sha256): platform fee + usage + add-ons + overage + price version POST /v1/airus/packaging/subscription auth: jwt Выбрать packaging tier (platform fee из реестра) GET /v1/airus/packaging/subscription auth: jwt Текущая подписка тира GET /v1/airus/packaging/entitlements auth: jwt Entitlements ВЫВОДЯТСЯ из записанного tier подписки (не из запроса) POST /v1/airus/packaging/entitlements/check auth: jwt Проверка фичи: grant DERIVED из tier подписки (enforcement_class descriptive, hot-path gating = roadmap) POST /v1/airus/packaging/quotes auth: jwt Записать contract quote (expected/worst-case DERIVED) GET /v1/airus/packaging/quotes auth: jwt История quotes тенанта POST /v1/airus/packaging/add-ons/:pack auth: jwt Активировать Capability Pack (fee из реестра) GET /v1/airus/packaging/add-ons auth: jwt Активные add-ons + monthly total POST /v1/airus/packaging/commitments auth: jwt Portable annual commit: переносимый между моделями/маршрутами/API/local, rollover + overage corridor GET /v1/airus/packaging/commitments auth: jwt Список portable commitments GET /v1/airus/packaging/commitments/:id/status auth: jwt Статус commit ВЫВОДИТСЯ из записанных RequestEconomics: consumed, forecast, overage zone, rollover POST /v1/airus/packaging/experiments auth: jwt Price Experiment: variant A/B, primary + guardrail metric, price version GET /v1/airus/packaging/experiments auth: jwt Список price experiments POST /v1/airus/packaging/experiments/:key/assign auth: jwt Детерминированное назначение варианта; цена участнику ЗАФИКСИРОВАНА (идемпотентно) POST /v1/airus/packaging/experiments/:key/reprice auth: jwt Reprice — ЗАПРЕЩЁН для активного эксперимента с назначениями (price-lock, 409) POST /v1/airus/packaging/experiments/:key/conclude auth: jwt Завершить эксперимент (снимает price-lock для reprice) POST /v1/airus/packaging/receipt auth: jwt Выдать contract-level transparency receipt (add-ons выводятся из активных, если не переданы) GET /v1/airus/packaging/metrics auth: jwt tier, quotes, commitments, active add-ons, experiments, assignments GET /v1/airus/quote-to-cash/reference auth: public QuoteToCash reference: payment models, wallet priority, tax policies, rules (invoice DERIVED, revenue из delivery, money boundary) POST /v1/airus/quote-to-cash/contract/compile auth: public Billing Contract as Code: quote → исполняемые правила + sha256 (никаких условий только в PDF) POST /v1/airus/quote-to-cash/wallet/allocate auth: public Multi-wallet allocation КАЛЬКУЛЯТОР: приоритет списания (credits раньше cash), без мутации баланса POST /v1/airus/quote-to-cash/tax/apply auth: public Tax Policy Registry (versioned): НДС по дате (22% с 2026), УПД 5.03; illustrative, требует утверждения бухгалтерией POST /v1/airus/quote-to-cash/invoice/preview-calc auth: public Invoice preview калькулятор: usage lines + adjustments + fee + НДС → total (what-if) POST /v1/airus/quote-to-cash/credit/decide auth: public Credit & Continuity: exposure vs limit + overdue → continuity stage 0-4, production status POST /v1/airus/quote-to-cash/payment/match-score auth: public Payment match confidence (детерминированно): amount + payer + purpose → matched/review/unmatched POST /v1/airus/quote-to-cash/deferred-revenue/split auth: public Deferred revenue (ПБУ 9/99 illustrative): предоплата = обязательство, выручка из service_delivered POST /v1/airus/quote-to-cash/collections/timeline auth: public Collections Autopilot timeline: T−7..T+15 (reminder → escalation → continuity restriction) POST /v1/airus/quote-to-cash/assurance-receipt auth: public Billing Assurance Receipt (period-level, sha256): usage events, dupes, invoice total, preview accepted, payment POST /v1/airus/quote-to-cash/contracts/:key auth: jwt Записать billing contract (компиляция quote → контракт + hash) GET /v1/airus/quote-to-cash/contracts auth: jwt Список billing contracts GET /v1/airus/quote-to-cash/contracts/:key auth: jwt Billing contract по ключу POST /v1/airus/quote-to-cash/credit-profile auth: jwt Credit profile: credit limit, soft limit, grace period, risk tier GET /v1/airus/quote-to-cash/credit/status auth: jwt ПРАВИЛО: exposure и continuity stage ВЫВОДЯТСЯ из неоплаченных previews + overdue POST /v1/airus/quote-to-cash/balance-buckets auth: jwt Credit-грант (promo/partner/SLA/commit) — НЕ денежный баланс (cash = LedgerService) GET /v1/airus/quote-to-cash/balance-buckets auth: jwt Список credit-грантов POST /v1/airus/quote-to-cash/invoices/preview auth: jwt ПРАВИЛО: invoice preview ВЫВОДИТСЯ из записанных UsageEvent + billingops adjustments + контракт + НДС (authoritative=false) GET /v1/airus/quote-to-cash/invoices/previews auth: jwt История invoice previews POST /v1/airus/quote-to-cash/invoices/:id/accept auth: jwt Принять invoice preview (до dispute deadline) POST /v1/airus/quote-to-cash/payments auth: jwt Записать банковский платёж + авто-match к preview (confidence DERIVED) GET /v1/airus/quote-to-cash/payments auth: jwt Список payment matches POST /v1/airus/quote-to-cash/revenue/recognize auth: jwt Deferred revenue entry: service_delivered из UsageEvent если не передан; предоплата = обязательство GET /v1/airus/quote-to-cash/revenue auth: jwt Deferred revenue ledger + totals (deferred/recognized/receivable) GET /v1/airus/quote-to-cash/assurance/:period auth: jwt Period-level Billing Assurance Receipt ВЫВОДИТСЯ из записанных usage/adjustments/preview/payments GET /v1/airus/quote-to-cash/metrics auth: jwt contracts, previews, payment matches, deferred entries, exposure, continuity stage GET /v1/airus/fraud-control/reference auth: public Fraud Control Plane reference: risk components/bands, KYB checks, promo policy, rules (score DERIVED из KeyBaseline) POST /v1/airus/fraud-control/risk/score auth: public Request Risk Score калькулятор: 8 взвешенных компонентов → 0-100 → allow/monitor/throttle/quarantine + max exposure (what-if) POST /v1/airus/fraud-control/velocity/check auth: public Adaptive Spend Velocity: minute/hour/day/expensive окна → violated + action POST /v1/airus/fraud-control/velocity/adaptive auth: public Динамический лимит: baseline + release + сезонность − резерв риска POST /v1/airus/fraud-control/firewall/check auth: public Economic Request Firewall (Denial of Wallet): max context/output/reasoning/images/tools/retries/batch/cost POST /v1/airus/fraud-control/entity/link-score auth: public Entity link confidence по общим атрибутам (device/card/payer/inn/phone весомее) POST /v1/airus/fraud-control/referral/self-check auth: public Self-referral: связанные сущности → payout заблокирован POST /v1/airus/fraud-control/kyb/assess auth: public KYB risk: скоринг переданных проверок → status/risk tier/action (реальный ЕГРЮЛ = roadmap) POST /v1/airus/fraud-control/credit/staged auth: public Staged postpaid limit: 50k→200k→500k по закрытым периодам; high-risk KYB → prepayment only POST /v1/airus/fraud-control/secret/decision auth: public Leaked secret: confidence≥0.9 → revoke_and_rotate, overlap 0s (реальное сканирование = roadmap) POST /v1/airus/fraud-control/evidence-receipt auth: public Fraud Evidence Receipt (case-level, sha256): suspected exposure, prevented loss, legit preserved % POST /v1/airus/fraud-control/agent-loop/check auth: public Agent Loop Circuit Breaker (#26): within-run детектор зацикленного агента (repeat-tool/no-progress/error-streak/spend-accel — которых нет в per-request firewall/AgentsService step-limiter) → РЕКОМЕНДАЦИЯ CONTINUE/WARN/BREAK; hot-path enforcement через AgentsService max_chain_steps + подключение loop-сигналов = roadmap POST /v1/airus/fraud-control/risk/evaluate auth: jwt ПРАВИЛО: security-компоненты ВЫВОДЯТСЯ из ЗАПИСАННОГО KeyBaseline + фактов запроса (caller их НЕ передаёт) GET /v1/airus/fraud-control/risk/decisions auth: jwt История risk decisions POST /v1/airus/fraud-control/velocity-policies/:key auth: jwt Multi-window spend velocity policy для ключа GET /v1/airus/fraud-control/velocity-policies auth: jwt Список velocity policies POST /v1/airus/fraud-control/entity-links auth: jwt Записать entity link (confidence ВЫВОДИТСЯ из общих атрибутов) GET /v1/airus/fraud-control/entity-links auth: jwt Entity graph + high-relevance count POST /v1/airus/fraud-control/customer-risk/:ref auth: jwt Customer KYB + staged credit: max postpaid exposure ВЫВОДИТСЯ из KYB + периодов GET /v1/airus/fraud-control/customer-risk/:ref auth: jwt Customer risk profile POST /v1/airus/fraud-control/secret-findings auth: jwt Leaked secret finding → триггер ротации (реальный отзыв — antifraudops/api-keys) GET /v1/airus/fraud-control/secret-findings auth: jwt Список secret findings + confirmed count GET /v1/airus/fraud-control/metrics auth: jwt risk decisions, quarantined, velocity policies, entity links, customer risk, secret findings GET /v1/airus/identity/reference auth: public IdentityOps reference: 7 типов principal, scope categories, rules (token exchange = policy-matching не auth в v0) POST /v1/airus/identity/subject/match auth: public Subject pattern match (сегментами, '*' wildcard) — project:42:branch:main POST /v1/airus/identity/scope/compile auth: public Scope compiler (least privilege): intent → scopes, опасные scopes только явно POST /v1/airus/identity/federation/evaluate auth: public Federation policy eval (what-if): issuer/audience/subject match; claims caller-asserted (не auth в v0) POST /v1/airus/identity/budget/check auth: public Identity-bound budget: model allowlist + per-hour + max-request (калькулятор, не баланс) POST /v1/airus/identity/privileged/decide auth: public Privileged session: требует reason + second approver + step-up MFA → TTL 5-60 мин POST /v1/airus/identity/assurance-receipt auth: public Identity Assurance Receipt (sha256): human→agent→workload→tool + delegation_valid + decision POST /v1/airus/identity/principals/:key auth: jwt Principal (human/service/workload/agent/tool/partner/break_glass); service account требует owner GET /v1/airus/identity/principals auth: jwt Список principals GET /v1/airus/identity/principals/:key auth: jwt Principal по ключу POST /v1/airus/identity/principals/:key/disable auth: jwt SCIM disable: гасит principal + identity_tokens (каскад в auth/api-keys = roadmap) POST /v1/airus/identity/federations/:key auth: jwt OIDC workload federation: issuer, audience, allowed subject pattern, TTL GET /v1/airus/identity/federations auth: jwt Список federations POST /v1/airus/identity/token/exchange auth: jwt ПРАВИЛО: claims проверяются против ЗАПИСАННОЙ federation policy → short-lived token (v0 policy-matching, не honored на hot-path) GET /v1/airus/identity/tokens auth: jwt Список выпущенных short-lived tokens POST /v1/airus/identity/delegations auth: jwt Delegation grant subject→actor + scopes + expiry + max exposure GET /v1/airus/identity/delegations auth: jwt Список delegation grants POST /v1/airus/identity/delegation/tool-token auth: jwt ПРАВИЛО: tool token только при существующем grant subject→actor→scope → scoped short-lived token GET /v1/airus/identity/orphans auth: jwt Orphan detector: ВЫВОДИТ principals без owner / stale / review overdue POST /v1/airus/identity/privileged-sessions auth: jwt Privileged session (записывается при reason+approver+MFA) GET /v1/airus/identity/privileged-sessions auth: jwt Список privileged sessions GET /v1/airus/identity/metrics auth: jwt principals, service accounts, federations, tokens, delegations, orphans GET /v1/airus/authorization/reference auth: public AuthorizationOps reference: action registry, decision order (deny-wins + fail-safe), rules (decision из stored policies, context caller-asserted) POST /v1/airus/authorization/evaluate auth: public PDP what-if: policies + request → allow/deny/allow_with_obligations/require_approval; default-deny, explicit-deny-wins, fail-safe missing attr POST /v1/airus/authorization/task-envelope/check auth: public Task envelope: action/resource/cost/external-write в пределах grant агента POST /v1/airus/authorization/approval/check auth: public Approval gate: правило по action + условию (напр. deal.value > 1M → sales_manager) POST /v1/airus/authorization/simulate auth: public Policy simulation: would_deny/approval/allow % над набором запросов (shadow before rollout) POST /v1/airus/authorization/receipt auth: public Authorization Decision Receipt (sha256): principal/action/resource/decision/determining policy/reason POST /v1/airus/authorization/policies/:key auth: jwt Authorization policy (crown jewel, owner/admin/security): effect, actions, conditions, obligations, status draft/shadow/production GET /v1/airus/authorization/policies auth: jwt Список authorization policies POST /v1/airus/authorization/authorize auth: jwt ПРАВИЛО: решение ВЫЧИСЛЯЕТСЯ из ЗАПИСАННЫХ production-policies (shadow НЕ enforce); default-deny + explicit-deny-wins + fail-safe GET /v1/airus/authorization/decisions auth: jwt История authorization decisions (explainable) POST /v1/airus/authorization/simulate-stored auth: jwt Shadow: симуляция STORED policies (production+shadow) над запросами перед rollout POST /v1/airus/authorization/relationships auth: jwt ReBAC relationship: subject relation resource (напр. partner operator project) GET /v1/airus/authorization/relationships auth: jwt Список relationships POST /v1/airus/authorization/approval-rules/:key auth: jwt Approval requirement: action + condition → approver role + TTL GET /v1/airus/authorization/approval-rules auth: jwt Список approval requirements POST /v1/airus/authorization/task-grants/:key auth: jwt Task grant агенту: allowed actions/resources, max cost, external writes, expiry GET /v1/airus/authorization/task-grants auth: jwt Список task grants POST /v1/airus/authorization/task-grants/:key/check auth: jwt ПРАВИЛО: запрос проверяется против ЗАПИСАННОГО task grant (в пределах envelope) GET /v1/airus/authorization/metrics auth: jwt policies, production/shadow, relationships, approval rules, task grants, decisions, deny rate GET /v1/airus/data-access/reference auth: public Secure RAG reference: classifications, revocation SLA, rules (trim из stored, AND-логика, existence hiding) POST /v1/airus/data-access/principal-set/resolve auth: public Principal set: subject+groups+task grants → effective principals + compressed set id POST /v1/airus/data-access/trim auth: public Pre-retrieval security trimming (what-if): source_acl AND data_class AND route policy; principal view скрывает denied POST /v1/airus/data-access/field-mask/decision auth: public Field masking: поля вне allowed classes маскируются (сумма/ПДн/реквизиты) POST /v1/airus/data-access/cache/permission-hash auth: public ACL-bound cache: permission_hash из tenant+principal set+policy version+data classes+source versions POST /v1/airus/data-access/cache/validity auth: public Cache validity: ACL изменился → invalidate POST /v1/airus/data-access/revocation/propagation auth: public Revocation propagation: source_detected → enforced → SLA (standard 15м/business 5м/enterprise 60с/critical 10с) POST /v1/airus/data-access/lineage/build auth: public Context Lineage: answer → chunks → source objects → permission decisions → masked fields POST /v1/airus/data-access/receipt auth: public Data Access Receipt (sha256): authorized/denied sources, chunks in context, masked fields, COMPLIANT/LEAK POST /v1/airus/data-access/data-objects/:key auth: jwt Source ACL Mirror: data object (source system, version, classification, ПДн, deletion state) GET /v1/airus/data-access/data-objects auth: jwt Список data objects + acl coverage POST /v1/airus/data-access/data-objects/:key/aces auth: jwt ACE: principal + effect allow/deny + inherited + valid_until GET /v1/airus/data-access/data-objects/:key/aces auth: jwt ACL объекта POST /v1/airus/data-access/data-objects/:key/delete auth: jwt Deletion propagation (v0): исключить из retrieval; удаление embeddings/cache/memory = roadmap POST /v1/airus/data-access/chunks/:key auth: jwt Secure chunk: source range, permission hash, classification, ПДн GET /v1/airus/data-access/chunks auth: jwt Список secure chunks POST /v1/airus/data-access/principal-sets/:key auth: jwt Data principal set: subject+groups → effective principals + allowed classes GET /v1/airus/data-access/principal-sets auth: jwt Список principal sets POST /v1/airus/data-access/retrieval/authorize auth: jwt ПРАВИЛО: pre-retrieval trimming из ЗАПИСАННЫХ objects+ACE+principal-set; existence hiding (principal view скрывает denied) GET /v1/airus/data-access/retrieval/authorizations auth: jwt История retrieval authorizations POST /v1/airus/data-access/revocations auth: jwt Revocation event + propagation SLA GET /v1/airus/data-access/revocations auth: jwt Revocations + SLA met rate GET /v1/airus/data-access/metrics auth: jwt data objects, acl coverage, quarantined, chunks, personal data, revocation SLA GET /v1/airus/data-lifecycle/reference auth: public Lifecycle reference: purposes, artifact types, rules (fail-safe RETAIN, holds win, restore firewall, training off) POST /v1/airus/data-lifecycle/purpose-firewall/check auth: public Purpose firewall: training/fine-tuning по умолчанию ЗАПРЕЩЁН; purpose drift → new basis POST /v1/airus/data-lifecycle/retention/expired auth: public Retention: expired по age vs retention_days (retention<0 = хранить бессрочно) POST /v1/airus/data-lifecycle/erasure/plan auth: public Erasure plan (what-if): allowlist подтверждённо-удаляемых; mandatory/hold/uncertain → RETAIN (fail-safe) POST /v1/airus/data-lifecycle/tombstone/create auth: public Backup tombstone (sha256): applyAfterRestore для предотвращения data resurrection POST /v1/airus/data-lifecycle/restore/firewall auth: public Restore firewall (what-if): blocked пока все tombstones не replayed POST /v1/airus/data-lifecycle/minimal-evidence auth: public Minimal Evidence: payload удалён, content_hash + event + amount сохранены (восстановить нельзя) POST /v1/airus/data-lifecycle/provider-retention/check auth: public Provider policy: sensitive route если retention<=0 ∧ no training ∧ deletion API ∧ RU POST /v1/airus/data-lifecycle/receipt auth: public Data Lifecycle Receipt (sha256): attests ЧТО СДЕЛАЛ AIRUS (marked/tombstoned/notified), не destruction POST /v1/airus/data-lifecycle/artifacts/:key auth: jwt Data artifact (registry + lineage): type, source, purpose (обязателен), legal basis GET /v1/airus/data-lifecycle/artifacts auth: jwt Список data artifacts POST /v1/airus/data-lifecycle/retention-policies/:key auth: jwt Retention policy: TTL по artifact type + on_expiry (purge payload keep evidence) GET /v1/airus/data-lifecycle/retention-policies auth: jwt Список retention policies POST /v1/airus/data-lifecycle/purpose-grants/:key auth: jwt Purpose grant: data scope + allowed purpose + training_allowed (default false) GET /v1/airus/data-lifecycle/purpose-grants auth: jwt Список purpose grants POST /v1/airus/data-lifecycle/purpose/authorize auth: jwt Purpose firewall из ЗАПИСАННОГО grant: training/analytics по факту разрешения POST /v1/airus/data-lifecycle/legal-holds/:key auth: jwt Legal hold: scope + reason + approver + review date; блокирует erasure GET /v1/airus/data-lifecycle/legal-holds auth: jwt Список legal holds POST /v1/airus/data-lifecycle/provider-retentions/:key auth: jwt Provider retention policy + sensitive-route allow GET /v1/airus/data-lifecycle/provider-retentions auth: jwt Список provider retentions POST /v1/airus/data-lifecycle/erasure/execute auth: jwt ПРАВИЛО: orchestration по ЗАПИСАННЫМ artifacts+lineage+holds; fail-safe RETAIN; holds/mandatory win GET /v1/airus/data-lifecycle/erasure/jobs auth: jwt История erasure jobs GET /v1/airus/data-lifecycle/tombstones auth: jwt Backup tombstones + replayed статус POST /v1/airus/data-lifecycle/restore/validate auth: jwt ПРАВИЛО: restore firewall из ЗАПИСАННЫХ tombstones — blocked пока не replayed POST /v1/airus/data-lifecycle/restore/replay auth: jwt Replay tombstones → restore разблокирован GET /v1/airus/data-lifecycle/metrics auth: jwt artifacts, coverage, marked, holds, erasure jobs, tombstones, pending GET /v1/airus/data-processors/reference auth: public Reference: party roles, eligibility classes, risk factors, upstream SLA, rules (fail-closed, single-source retention, notification≠authorization) POST /v1/airus/data-processors/risk-score auth: public Provider Data Risk Score (what-if): 8 взвешенных факторов → low/medium/high/critical POST /v1/airus/data-processors/cross-border/decide auth: public Cross-border decision (what-if, fail-closed): страна нет в policy → deny; notification ≠ authorization POST /v1/airus/data-processors/route/evaluate auth: public Route gate (what-if, AND fail-closed): DPA ∧ party allowlist ∧ country ∧ approval ∧ retention ∧ training POST /v1/airus/data-processors/dpa/compile auth: public DPA-as-Code compiler: договорные термины → runtime policy + policy_hash (sha256) POST /v1/airus/data-processors/policy-change/detect auth: public Policy Change Monitor (what-if): material change → suspend sensitive routes + legal review POST /v1/airus/data-processors/incident/cascade auth: public Incident Cascade (what-if): upstream delay vs SLA + РКН дедлайн 24ч оператора POST /v1/airus/data-processors/assurance-receipt auth: public Provider Data Assurance Receipt (sha256): attests processing route, role_disclaimer, authoritative=false POST /v1/airus/data-processors/parties/:key auth: jwt Processing party (legal role graph): role declared, services, countries; retention/training НЕ здесь (single-source Ф69) GET /v1/airus/data-processors/parties auth: jwt Список processing parties POST /v1/airus/data-processors/dpa-contracts/:key auth: jwt DPA contract: allowed processors/countries, max retention, training, policy_hash GET /v1/airus/data-processors/dpa-contracts auth: jwt Список DPA contracts POST /v1/airus/data-processors/subprocessor-approvals/:key auth: jwt Subprocessor approval (customer allowlist): party + approved routes + valid_until GET /v1/airus/data-processors/subprocessor-approvals auth: jwt Список subprocessor approvals POST /v1/airus/data-processors/route/authorize auth: jwt ПРАВИЛО: routing-решение из ЗАПИСАННЫХ DPA+party+approval+Ф69 ProviderRetention; fail-closed; fallback per-party (не наследует approval) GET /v1/airus/data-processors/cross-border/decisions auth: jwt История cross-border/route решений POST /v1/airus/data-processors/provider-policy-versions auth: jwt Provider policy version snapshot: material change detection + routes suspended GET /v1/airus/data-processors/provider-policy-versions auth: jwt История provider policy versions POST /v1/airus/data-processors/incident-notices/:key auth: jwt Processor incident notice: upstream delay vs SLA + regulator deadline GET /v1/airus/data-processors/incident-notices auth: jwt Список processor incident notices GET /v1/airus/data-processors/metrics auth: jwt parties, approved, active DPAs, approvals, route decisions, blocked, policy versions, material changes, incidents GET /v1/airus/buyer-desk/reference auth: public Reference: buyer profiles, evidence states, readiness factors, clause library, rules (derived-not-gameable, export-blocked, fail-closed), no-duplication map POST /v1/airus/buyer-desk/readiness-score auth: public Procurement Readiness Score (what-if): 8 взвешенных измерений + fail-closed gates → not_ready/conditional/procurement_ready/production_ready POST /v1/airus/buyer-desk/evidence-freshness auth: public Evidence Freshness (what-if): state вычисляется из дат → verified/expiring/stale/contradicted/missing POST /v1/airus/buyer-desk/questionnaire-match auth: public Questionnaire Autopilot (what-if): match/dedup по нормализованному intent; export непроверенного ЗАБЛОКИРОВАН POST /v1/airus/buyer-desk/clause-classify auth: public Contract Clause Library (what-if): acceptable/negotiable/requires-pricing/requires-architecture/prohibited + fallback language (illustrative, юрист утверждает) POST /v1/airus/buyer-desk/contract-runtime auth: public Contract-to-Runtime Validator (what-if, AND fail-closed): требования договора vs product config → match/mismatch POST /v1/airus/buyer-desk/promise-check auth: public Customer Promise check (what-if): enforced только при owner ∧ implementation ∧ contract clause, иначе unbacked POST /v1/airus/buyer-desk/red-flag auth: public Red Flag Deal Desk (what-if): триггеры эскалации (unlimited liability, negative margin, SLA above capability, ...) POST /v1/airus/buyer-desk/deals/:key auth: jwt Procurement Deal: buyer profile, stage, target date, owner, link на EnterpriseAccount (single-source deal/pilot) GET /v1/airus/buyer-desk/deals auth: jwt Список procurement deals + last readiness score/decision POST /v1/airus/buyer-desk/canonical-answers/:key auth: jwt Canonical Answer Registry: intent + answer + scope + evidence link + verified/review dates GET /v1/airus/buyer-desk/canonical-answers auth: jwt Список canonical answers POST /v1/airus/buyer-desk/evidence/:key auth: jwt Procurement Evidence: type, scope, visibility, verified/expires → freshness state вычисляется GET /v1/airus/buyer-desk/evidence auth: jwt Список evidence + freshness state (verified/expiring/stale/contradicted) POST /v1/airus/buyer-desk/contract-clauses/:key auth: jwt Contract Clause record: decision выводится из clause library + fallback language GET /v1/airus/buyer-desk/contract-clauses auth: jwt Список contract clauses с решениями POST /v1/airus/buyer-desk/promises/:key auth: jwt Customer Promise Registry: status выводится (enforced/unbacked) из owner+implementation+contract clause GET /v1/airus/buyer-desk/promises auth: jwt Список customer promises + статус backing POST /v1/airus/buyer-desk/questionnaires/:key auth: jwt Questionnaire import + autopilot match из ЗАПИСАННЫХ canonical answers + evidence freshness; export непроверенного заблокирован GET /v1/airus/buyer-desk/questionnaires auth: jwt Список questionnaire-прогонов (completion, export_allowed) POST /v1/airus/buyer-desk/deals/:key/readiness auth: jwt ПРАВИЛО: readiness ВЫЧИСЛЯЕТСЯ из записанного состояния + join enterpriseops (pilot/requirements single-source); hard-gates не gameable; DERIVED receipt (sha256) GET /v1/airus/buyer-desk/metrics auth: jwt deals, production_ready, blocked, evidence stale/expiring, questionnaires, unbacked promises, prohibited clauses GET /v1/airus/production-launch/reference auth: public Reference: stages, owner roles, rollback components, health factors, rules (derived, fail-closed, full-rollback, value-required), no-duplication map POST /v1/airus/production-launch/stage-gate auth: public Stage gate (what-if): переход demo→…→certified, пропуск стадий запрещён, блокеры по условиям POST /v1/airus/production-launch/acceptance/evaluate auth: public Production Acceptance Contract (what-if): quality/availability/p95/cost/adoption/rollback floors, AND fail-closed POST /v1/airus/production-launch/shadow/evaluate auth: public Shadow traffic evaluation (what-if): min cases, schema match rate, quality delta, budget cap POST /v1/airus/production-launch/capacity/preflight auth: public Quota & Capacity Preflight (what-if): primary И fallback обязаны покрыть пик с headroom; неизвестная квота = не проверено POST /v1/airus/production-launch/canary/evaluate auth: public Business-aware canary (what-if): guardrails качество/стоимость/эскалации; незамеренный guardrail = abort POST /v1/airus/production-launch/rollback/evaluate auth: public Full rollback drill (what-if): snapshot из 6 компонентов (model/prompt/route/tools/budget/logging) + drill в срок POST /v1/airus/production-launch/value/verify auth: public Value verification (what-if): baseline vs production, improvement %, направление метрики POST /v1/airus/production-launch/health-score auth: public Production Health Score: 7 факторов (quality/reliability/adoption/value/cost/security/ops), не только uptime POST /v1/airus/production-launch/traffic-ladder auth: public Risk-Based Traffic Ladder (#28, reuse C0-C4): ступени % трафика по классу риска; C3/C4 — стадии без авто-split; ненадёжный rollback → advance заблокирован. Реальный traffic split hot-path = roadmap POST /v1/airus/production-launch/side-effect/classify auth: public Shadow Side-Effect Firewall (#28): КЛАССИФИКАТОР режима tool-действия (READ_ALLOWED/WRITE_SIMULATED/EXTERNAL_BLOCKED). НЕ блокирует — реальный перехват в shadow hot-path = roadmap (authoritative:false) POST /v1/airus/production-launch/scope-firewall auth: public Pilot Scope Firewall (#28): изменение scope → пересчёт cost/timeline/baseline/acceptance + ре-апрув (нет бесплатной бесконечной доработки) POST /v1/airus/production-launch/decision-board auth: public Decision Board (#28): DERIVES из записанных гейтов (не пересчитывает) → LAUNCH/EXTEND_ONCE/STOP + дата. value failed/критичный гейт/нет гипотезы → STOP POST /v1/airus/production-launch/adoption-funnel auth: public Adoption Funnel (#28): rates из declared counts (eligible→first-use→accepted→repeat→bypass→abandoned); first_value = accepted/eligible (usage ≠ adoption). Живая телеметрия из клиентских систем = roadmap POST /v1/airus/production-launch/workflows/:key auth: jwt Production Workflow: owners (business+technical обязательны), baseline, funding, links на EnterpriseAccount/MigrationProject GET /v1/airus/production-launch/workflows auth: jwt Список production workflows + stage + last decision POST /v1/airus/production-launch/workflows/:key/acceptance auth: jwt Acceptance contract workflow: floors + observed → derived passed POST /v1/airus/production-launch/shadow-runs/:key auth: jwt Записать shadow-прогон → derived pass/fail (schema match, quality delta, budget) GET /v1/airus/production-launch/shadow-runs auth: jwt Список shadow-прогонов POST /v1/airus/production-launch/capacity-preflights/:key auth: jwt Записать capacity preflight → derived pass/blockers (fail-closed на неизвестных квотах) POST /v1/airus/production-launch/canary-runs/:key auth: jwt Записать canary + guardrails + observed → derived proceed/abort (авто-abort по любому порогу) GET /v1/airus/production-launch/canary-runs auth: jwt Список canary-прогонов + abort reasons POST /v1/airus/production-launch/rollback-drills/:key auth: jwt Записать rollback drill: полный snapshot (6 компонентов) + время → derived tested POST /v1/airus/production-launch/value-verifications/:key auth: jwt Записать верификацию ценности: baseline vs production → improvement %, verified_by POST /v1/airus/production-launch/workflows/:key/stage auth: jwt ПРАВИЛО: переход стадии server-enforced из ДЕРИВНУТОГО состояния + join pilot/compatibility (не gameable) POST /v1/airus/production-launch/workflows/:key/certify auth: jwt ПРАВИЛО: certification DERIVED из записанных прогонов (shadow/canary/drill/value) + join'ов; Production Readiness Receipt (sha256) GET /v1/airus/production-launch/metrics auth: jwt workflows by stage, certified, shadow/canary/drill/value counts + pass rates GET /v1/airus/adoption/reference auth: public Reference: acceptance signals, override reasons, value types, manager actions, repeat criterion, health weights, hard rules (login≠adoption, declared, cannot_certify на пустом eligible, fail-closed, privacy), roadmap POST /v1/airus/adoption/first-accepted/what-if auth: public First Accepted Outcome (what-if): accepted/eligible и accepted/trained; пустой eligible → CANNOT_CERTIFY (не 0%/100%). DECLARED из записанных событий (authoritative:false); live completion CRM/1С/n8n = roadmap POST /v1/airus/adoption/override/what-if auth: public Override taxonomy (what-if): распределение причин правок (missing_source/wrong_format/fact_error/…) + unclassified_rate — почему правят, не только сколько POST /v1/airus/adoption/repeat-value/what-if auth: public Repeat Value (what-if): users_with_repeat/accepted_users (≥3 принятых, 3+ разных дня); пустой знаменатель → null (не 0%) POST /v1/airus/adoption/manual-bypass/what-if auth: public Manual Bypass (what-if): bypass/(accepted+bypass) — честный контр-сигнал обхода AI, не прячется POST /v1/airus/adoption/policy-recovery/what-if auth: public Policy Recovery (what-if): safe_alternative_completed/policy_blocks; НЕТ блоков → CANNOT_CERTIFY (не 100% recovery на нуле) POST /v1/airus/adoption/manager-activation/what-if auth: public Manager Activation (what-if): убран legacy-шаг + принят формат + время + разбор блокеров; legacy не убран/формат не принят → MANAGEMENT_BLOCKED POST /v1/airus/adoption/champion-coverage/what-if auth: public Champion Coverage (what-if): departments_with_active_champion/departments_active + gap POST /v1/airus/adoption/health/what-if auth: public Adoption Health (what-if): FAIL-CLOSED — MANAGEMENT_BLOCKED / manual_bypass>15% → BLOCKED независимо от score; нет данных → CANNOT_CERTIFY; взвешенный композит POST /v1/airus/adoption/value-entry/what-if auth: public Realized Value (what-if): категориально (TIME/QUALITY/THROUGHPUT/COST), provenance declared vs business_owner_verified; is_proven_rub:false (не доказанный ₽) POST /v1/airus/adoption/champions auth: jwt Регистрация чемпиона (append-only реестр): department, champion_ref, backup, мандат часов/неделю GET /v1/airus/adoption/champions auth: jwt Список чемпионов tenant (append-only) GET /v1/airus/adoption/summary auth: jwt Агрегатная сводка (privacy: aggregate_only, НЕ рейтинг сотрудников): accepted_users, users_with_repeat, departments из записанных adoption-событий в окне (declared) POST /v1/airus/adoption/receipts auth: jwt ПРАВИЛО: Adoption Receipt DERIVED (ADOPTION_VERIFIED/UNCONFIRMED/BLOCKED); seal-once по (tenant,workflow,period), sha256, authoritative:false; VERIFIED только Health=HEALTHY+first-accepted CERTIFIED+business_owner_verified value GET /v1/airus/adoption/receipts/:id auth: jwt Adoption Receipt по id (uuid-guard, tenant-scoped, found=false вне тенанта) GET /v1/airus/adoption/receipts/:id/verify auth: jwt Verify из запечатанной строки (tamper_evident_ok, uuid-guard) GET /v1/airus/demo/persona auth: public Паспорт роли AIRUS R01: как отвечает, что запрещено, лимиты демо (прозрачность вместо магии) POST /v1/airus/demo/chat auth: public Демо-чат с собственной RF-моделью AIRUS R01 (self-hosted): серверная роль (анти-джейлбрейк), rate-limit по IP, metadata-only логи GET /v1/airus/content/posts auth: public Блог: список опубликованных постов (только published+publishAt<=now; черновики не утекают) GET /v1/airus/content/posts-index auth: public Индекс опубликованного (слаги+даты) для RSS/sitemap GET /v1/airus/content/posts/:slug auth: public Пост целиком: санитизированный body_html (XSS-контроль на записи), SEO-поля, CTA POST /v1/airus/content/admin/posts auth: jwt CMS upsert (platform-admin ADMIN_EMAILS): markdown→sanitized HTML на записи; идемпотентный source_key для маркетинг-агента; slug заморожен после публикации GET /v1/airus/content/admin/posts auth: jwt CMS: все посты (draft/scheduled/published/archived) POST /v1/airus/content/admin/posts/:slug/status auth: jwt CMS: смена статуса (publish/archive/draft) DELETE /v1/airus/content/admin/posts/:slug auth: jwt CMS: архивирование поста (мягкое удаление — история/SEO) GET /v1/airus/exec-docs/reference auth: public Reference: SDK, change types, error reason codes, rules (executable/error-contract/changelog), no-duplication map POST /v1/airus/exec-docs/error/explain auth: public Stable Error Intelligence: код/HTTP → actionable object (reason_code, retryable, retry_after, scope, safe_alternatives, docs_slug) POST /v1/airus/exec-docs/shape/verify auth: public Детерминированная shape-верификация ответа против схемы (структура, не текст — без живой модели) POST /v1/airus/exec-docs/changelog/preview auth: public Machine-readable changelog preview: change_type/affected/effective_at → requires_ci_action GET /v1/airus/exec-docs/examples auth: public Executable Example Registry: галерея с test_status/freshness/estimated_cost (?sdk=) GET /v1/airus/exec-docs/examples/:key auth: public Пример целиком: code + expected_shape + last_verified (Run in Sandbox = roadmap) GET /v1/airus/exec-docs/changelog auth: public Машиночитаемый changelog API для CI GET /v1/airus/exec-docs/receipt auth: public Developer Experience Receipt: example pass rate + stale + error-contract coverage → status (?sdk=&project_ref=) POST /v1/airus/exec-docs/admin/examples/:key auth: jwt Admin (ADMIN_EMAILS): upsert executable example (code, expected_shape, cost, published) GET /v1/airus/exec-docs/admin/examples auth: jwt Admin: все примеры (вкл. неопубликованные) POST /v1/airus/exec-docs/admin/examples/:key/verify auth: jwt ПРАВИЛО: verify — фактический ответ vs зафиксированная schema → test_status passed/failed + last_verified POST /v1/airus/exec-docs/admin/changelog/:key auth: jwt Admin: upsert changelog entry (requires_ci_action выводится из change_type) GET /v1/airus/exec-docs/admin/metrics auth: jwt examples, published, passed, error reason codes, changelog, ci-action entries GET /v1/airus/integration-ecosystem/reference auth: public Reference: frameworks, cert levels, compat statuses, health factors, rules (install≠активация, update firewall, fail-closed cert), no-duplication map POST /v1/airus/integration-ecosystem/certification/gate auth: public Certification gate (what-if): community/verified/production/enterprise; fail-closed (production требует owner+SLA+telemetry+upgrade+support) POST /v1/airus/integration-ecosystem/update-firewall auth: public Update Firewall (what-if): framework release не Supported пока не прошёл тесты; unknown ≠ compatible (fail-closed) POST /v1/airus/integration-ecosystem/health-score auth: public Integration Health Score (what-if): 7 взвешенных факторов → healthy/degraded/at_risk/incomplete POST /v1/airus/integration-ecosystem/workflow-economics auth: public Workflow-level economics (what-if): стоимость всего multi-step execution — cost_by_step/by_model + remaining budget POST /v1/airus/integration-ecosystem/activation/decide auth: public Production Activation (what-if): install ≠ активация — засчитывается только первый production-результат POST /v1/airus/integration-ecosystem/receipt auth: public Integration Receipt (sha256): integration/package/framework/capability/health/outcomes, authoritative=false GET /v1/airus/integration-ecosystem/packages auth: public Integration Package Registry: официальные пакеты (n8n/langchain/spring) с версией/cert-level/operations (?framework=) GET /v1/airus/integration-ecosystem/packages/:key auth: public Пакет + framework compatibility matrix (версии фреймворка × статус) GET /v1/airus/integration-ecosystem/packages/:key/manifest auth: public Machine-readable manifest (человек/CLI/framework/coding-агент/marketplace-валидатор): operations, credential model, governance POST /v1/airus/integration-ecosystem/admin/packages/:key auth: jwt Admin (ADMIN_EMAILS): upsert пакета; certification_level ВЫЧИСЛЯЕТСЯ гейтом (не gameable) GET /v1/airus/integration-ecosystem/admin/packages auth: jwt Admin: все пакеты (вкл. неопубликованные) POST /v1/airus/integration-ecosystem/admin/packages/:key/compat auth: jwt Admin: framework compatibility (версия → статус + pass rate); supported выводится Update Firewall POST /v1/airus/integration-ecosystem/installations/:key auth: jwt Integration installation: package, environment, partner, credential_verified GET /v1/airus/integration-ecosystem/installations auth: jwt Список установок POST /v1/airus/integration-ecosystem/activations/:key auth: jwt ПРАВИЛО: production activation DERIVED через join Ф72 ProductionWorkflow (controlled_production/certified); executions/outcomes/forecast = declared; accepted<=executions GET /v1/airus/integration-ecosystem/activations auth: jwt Список активаций POST /v1/airus/integration-ecosystem/installations/:key/health auth: jwt ПРАВИЛО: integration health DERIVED из framework-compat + активаций (join) + качественные факторы GET /v1/airus/integration-ecosystem/metrics auth: jwt packages, installations, production installs, activations, Production-Activated ARR GET /v1/airus/tender-intelligence/reference auth: public Reference: procedure types (44-ФЗ/223-ФЗ/commercial), requirement categories, capability types, rules (нет вероятности победы, citations mandatory, human approval) POST /v1/airus/tender-intelligence/document-coverage auth: public Document coverage (what-if): один PDF ≠ вся закупка; coverage<90% → вывод не полный POST /v1/airus/tender-intelligence/hallucination-gate auth: public Hallucination Gate (what-if): вывод блокируется без подтверждённого источника / при низком coverage / смешении редакций (fail-closed) POST /v1/airus/tender-intelligence/bid-decision/evaluate auth: public Explainable Bid/No-Bid (what-if): readiness ОТДЕЛЬНО от confidence; blocking/positive/unknown; БЕЗ вероятности победы; human approval POST /v1/airus/tender-intelligence/requirement-diff auth: public Requirement Change Monitor (what-if): semantic diff редакций → changed/added/removed + invalidated conclusions POST /v1/airus/tender-intelligence/pack-health auth: public Vertical Pack Health Score: extraction/citation/checklist/decision/reliability/cost/adoption GET /v1/airus/tender-intelligence/packs auth: public Vertical Pack Registry: supplier/OEM editions, версии, поддерживаемые процедуры POST /v1/airus/tender-intelligence/admin/packs/:key auth: jwt Admin (ADMIN_EMAILS): upsert vertical pack (edition/version/procedures/published) POST /v1/airus/tender-intelligence/procedures/:key auth: jwt Tender procedure + document graph (discovered/processed → coverage), тип процедуры, срок подачи GET /v1/airus/tender-intelligence/procedures auth: jwt Список процедур + coverage POST /v1/airus/tender-intelligence/requirements/:key auth: jwt Normalized requirement с ЦИТАТОЙ (категория, normalized_value, source document/page, confidence) GET /v1/airus/tender-intelligence/requirements auth: jwt Список требований (?procedure_key=) POST /v1/airus/tender-intelligence/capabilities/:key auth: jwt Company Capability Passport: тип, значение, срок действия (истёкшая = fail) GET /v1/airus/tender-intelligence/capabilities auth: jwt Список capabilities (?company_ref=) POST /v1/airus/tender-intelligence/procedures/:key/bid-decision auth: jwt ПРАВИЛО: bid decision DERIVED из ЗАПИСАННЫХ requirements + capabilities; readiness/confidence раздельно; human approval; БЕЗ вероятности победы POST /v1/airus/tender-intelligence/procedures/:key/approve auth: jwt Human approval gate: подтверждение bid-решения специалистом (approved/rejected) GET /v1/airus/tender-intelligence/procedures/:key/receipt auth: jwt Tender Receipt (sha256): coverage, requirements, blocking, citations, pending human decisions → review_required/complete GET /v1/airus/tender-intelligence/metrics auth: jwt procedures, requirements, bid decisions, bid/conditional/no-bid/review, pending human decisions GET /v1/airus/tender-gtm/reference auth: public GTM Reference: сегменты, триггеры, objection-категории, ICP-веса, conversion floors, offer ladder; тезис Lost Tender Autopsy; карта no-duplication (pilot→enterpriseops, ROI→value/roi, quote→packagingops) GET /v1/airus/tender-gtm/offer-ladder auth: public Offer Ladder (справочные якоря): evidence demo 49k/paid pilot 250-900k/production MRR по сегментам; реальные quote — packagingops/priceops (не дублируется) POST /v1/airus/tender-gtm/account-score auth: public Тендер-ICP score (what-if): fit_score+tier по сигналам (объём процедур/тендер-команда/сложность/боль/бюджет), sales_cycle инвертируется, жёсткий флор ≥40 процедур/≥2 спеца POST /v1/airus/tender-gtm/autopsy/evaluate auth: public Lost Tender Autopsy (what-if): критические требования + commercial_opportunity (paid_pilot/evidence_demo/nurture); НЕ причинность проигрыша, честный дисклеймер POST /v1/airus/tender-gtm/objection-response auth: public Objection registry: категория → канонический ответ (не заменяем поиск / усиление спеца / fail-closed / не гарантируем победу) POST /v1/airus/tender-gtm/pilot-readiness auth: public Pilot readiness gate (what-if, fail-closed, QUOTE→ПИЛОТ): production_quote_attached + baseline + нет бесплатного кастома + цена/скоуп → ready_to_send POST /v1/airus/tender-gtm/funnel-health auth: public Funnel health: конверсии против floor'ов (≥40/60/50/40/60%) → fix_offer_evidence_or_icp / healthy_scale + weakest stage (не лить трафик в дырявую воронку) POST /v1/airus/tender-gtm/accounts/:key auth: jwt Target account: сигналы тендер-ICP → fit_score+tier DERIVED (named-компании = гипотезы фита, не подтверждённый интерес) GET /v1/airus/tender-gtm/accounts auth: jwt Список target accounts по fit_score POST /v1/airus/tender-gtm/triggers/:key auth: jwt Buying trigger (lost_tender/team_expansion/new_ai_initiative) → sales_priority DERIVED из tier аккаунта + типа POST /v1/airus/tender-gtm/autopsies/:key auth: jwt Lost Tender Autopsy DERIVED из Ф77 процедуры + bid-решения (critical/unmet requirements, commercial_opportunity) GET /v1/airus/tender-gtm/autopsies auth: jwt Список разборов проигранных тендеров POST /v1/airus/tender-gtm/objections/:key auth: jwt Objection record: канонический ответ DERIVED из категории + исход (demo_scheduled/advanced/lost) GET /v1/airus/tender-gtm/objections auth: jwt Список возражений + агрегат by_category POST /v1/airus/tender-gtm/pilot-proposals/:key auth: jwt Pilot proposal: ready_to_send DERIVED через fail-closed gate; исполнение пилота — enterpriseops.PilotContract GET /v1/airus/tender-gtm/pilot-proposals auth: jwt Список пилот-предложений (ready_to_send) GET /v1/airus/tender-gtm/evidence-pack auth: jwt Sales Evidence Pack DERIVED из Ф77 bid-decision (document_coverage, verified findings, estimated_time_saved_percent из ROI, customer_specific) GET /v1/airus/tender-gtm/metrics auth: jwt target accounts, tier A, buying triggers, autopsies→paid_pilot, objections logged, pilot proposals ready_to_send GET /v1/airus/tender-sales/reference auth: public Sales Reference: qual-веса, статусы, disqualification-причины, promise-категории, buyer-сигналы; тезис «интерес ≠ pipeline»; карта no-duplication (committee→enterpriseops, baseline→roi, opportunity→buyer-desk, call→calls) POST /v1/airus/tender-sales/qualify auth: public Composite qualification score (what-if, deal-health ось): 8 сигналов (боль/объём/данные/owner/economic buyer/бюджет/срочность/integration) → score+status+gate_autopsy+gate_pilot (fail-closed) POST /v1/airus/tender-sales/promise-guard auth: public Sales Promise Guard (what-if, fail-closed перед proposal): обещание победы/юр.гарантии — запрещено; функции — только supported∧in_scope; цена/SLA — только с approval (реальный floor — marginops) POST /v1/airus/tender-sales/serious-buyer auth: public Serious Buyer Detector (what-if): +/− сигналы → serious/unclear/free_researcher; hard-негатив (нет покупателя/уклонение от даты/расширение free scope) → free_researcher POST /v1/airus/tender-sales/disqualify auth: public Disqualification playbook (what-if): причина (no_budget/no_data/no_owner/no_pain/no_urgency/custom_only/win_guarantee_demand) → рекомендованное действие POST /v1/airus/tender-sales/qualifications/:key auth: jwt Sales qualification: 8 сигналов → score+status+gates DERIVED; has_decision_date выводится из decision_date (не caller-boolean) GET /v1/airus/tender-sales/qualifications auth: jwt Список квалификаций по score (status/gate_autopsy/gate_pilot) GET /v1/airus/tender-sales/qualifications/:key/readiness-receipt auth: jwt Sales Readiness Receipt (sha256, derived, non-authoritative): пересчёт гейтов из записанного → READY_FOR_PAID_PILOT / NOT_READY + блокеры POST /v1/airus/tender-sales/disqualifications/:key auth: jwt Disqualification record: причина → playbook DERIVED; привязка к opportunity переводит её в disqualified (согласованность) GET /v1/airus/tender-sales/disqualifications auth: jwt Список дисквалификаций + агрегат by_reason GET /v1/airus/tender-sales/metrics auth: jwt qualifications, priority, qualified, autopsy_gate_open, pilot_gate_open, disqualifications GET /v1/airus/tender-pilot/reference auth: public Pilot Reference: 21-дневный стандарт (стадии/дни), production decisions (PRODUCTION/CONDITIONAL/STOP), required cohort, scope credits; тезис «пилот = репетиция production»; карта no-duplication (Ф79/Ф77/Ф72/marginops/value) POST /v1/airus/tender-pilot/activation-gate auth: public Pilot Activation Packet gate (what-if, fail-closed): data rights + 60 procedures + 20 outcomes + 2 reviewers + owner/buyer/budget/baseline/decision date + excluded functions + cohort lock → clock_can_start POST /v1/airus/tender-pilot/cohort-stratification auth: public Locked Stratified Cohort (what-if): 60 процедур с жёсткими полами трудных кейсов (10 больших/10 сканов/10 редакций/5 отклонений/5 споров) → balanced/shortfalls POST /v1/airus/tender-pilot/procedure-value auth: public Pilot Procedure Value (what-if): baseline − assisted → time_saved; manual_intervention ≤10 мин → within target (Truth Ledger + Value Clock) POST /v1/airus/tender-pilot/blind-classify auth: public Blind Evaluation (what-if): классификация ТОЛЬКО после фиксации обоих → agreement/human_disagreement/airus_miss/specialist_miss/insufficient_data (human_disagreement ≠ model error) POST /v1/airus/tender-pilot/burn-down auth: public Critical Requirement Burn-Down (what-if): found by AIRUS/specialist/both/missed/disputed/insufficient → recall (честнее «точности 97%») POST /v1/airus/tender-pilot/acceptance-matrix auth: public Pilot Acceptance Matrix (what-if, fail-closed): hard (discovery≥98/citation≥99/recall≥95/unsupported<0.5/isolation=0) + business + production → PRODUCTION/CONDITIONAL/STOP (незамеренный hard = не пройден) POST /v1/airus/tender-pilot/midpoint-gate auth: public Day-10 Midpoint Kill Gate (what-if): early-kill (нет cohort/буайера/бюджета, scope+20%, >30% необработано, feedback 5 дней) → STOP; иначе CONTINUE/CORRECT POST /v1/airus/tender-pilot/scope-credit auth: public Scope Credit Ledger (what-if): 10 configuration credits; запрос сверх остатка → change_order_required (не бесплатный кастом в пилоте) POST /v1/airus/tender-pilot/stage-advance auth: public 21-day Stage Machine (what-if): переход разрешён только на следующую стадию (no-skip, no-backward, fail-closed) POST /v1/airus/tender-pilot/normalized-cost auth: public Normalized Production Cost (what-if): inference+support+retries+OCR+storage+eval+partner margin+резерв (pilot subsidy ≠ production economics; реальный per-request — marginops) POST /v1/airus/tender-pilot/pilots/:key auth: jwt Upsert pilot (owner/admin/security): opportunity/account link, decision date, стадия/production decision DERIVED GET /v1/airus/tender-pilot/pilots auth: jwt Список пилотов (стадия/clock/production/midpoint) POST /v1/airus/tender-pilot/pilots/:key/activation auth: jwt Activation packet: ready DERIVED (включая cohort lock); has_decision_date из decision_date POST /v1/airus/tender-pilot/pilots/:key/cohort auth: jwt Cohort mix: stratification DERIVED; после lock изменение запрещено (immutable) POST /v1/airus/tender-pilot/pilots/:key/cohort/lock auth: jwt Cohort lock (fail-closed): требует balanced (обязательные трудные страты набраны) POST /v1/airus/tender-pilot/pilots/:key/clock/start auth: jwt Start pilot clock (fail-closed): только при полном packet + залоченном cohort POST /v1/airus/tender-pilot/pilots/:key/stage auth: jwt Advance stage (server-enforced no-skip; требует стартованные часы) POST /v1/airus/tender-pilot/pilots/:key/procedures/:ref auth: jwt Procedure record (Truth Ledger + Value Clock): time_saved DERIVED, ручное вмешательство фиксируется (не скрывается) POST /v1/airus/tender-pilot/pilots/:key/blind-eval/:ref auth: jwt Blind evaluation: discrepancy DERIVED после фиксации обоих; после lock решение неизменяемо (антиподгонка) POST /v1/airus/tender-pilot/pilots/:key/scope-changes/:changeKey auth: jwt Scope change: decision DERIVED; within_scope атомарно списывает кредиты ($transaction) POST /v1/airus/tender-pilot/pilots/:key/midpoint auth: jwt Day-10 midpoint gate: CONTINUE/CORRECT/STOP; STOP → production_decision=stop POST /v1/airus/tender-pilot/pilots/:key/acceptance auth: jwt Persist измеренных acceptance-метрик (hard/business/production) — receipt строит production_decision из ЗАПИСАННОГО, не из body (не caller-gameable) GET /v1/airus/tender-pilot/pilots/:key/burn-down auth: jwt Critical requirement burn-down DERIVED из blind-eval агрегатов (per-procedure decision; per-requirement — roadmap) GET /v1/airus/tender-pilot/pilots/:key/receipt auth: jwt Tender Pilot Receipt (sha256, derived, non-authoritative): recall/time reduction DERIVED из записей + персистные метрики → PRODUCTION/CONDITIONAL/STOP GET /v1/airus/tender-pilot/metrics auth: jwt pilots, clock_started, stopped, production_or_conditional, scope_changes, procedures_recorded GET /v1/airus/tender-production/reference auth: public Production Reference: SLA-профили, adoption-роли, bid-lifecycle, health-веса; тезис «управляемая пропускная способность отдела»; карта no-duplication (Ф72/Ф77/Ф80/Ф54/marginops/routeeconomics/evalops/toolops/advocacyops) POST /v1/airus/tender-production/intake-gateway auth: public Tender Intake Gateway (what-if, fail-closed): dedup/OCR-quality/completeness/malicious → coverage_status ready/review/blocked (прямая отправка всех файлов модели запрещена) POST /v1/airus/tender-production/flow-coverage auth: public Complete-Flow Coverage (what-if): воронка ПОТОКА тендеров (релевантных/передано/обработано/заблокировано/исключено) → automation_rate; <80% → нельзя заявлять автоматизацию отдела POST /v1/airus/tender-production/quality-sampling auth: public Risk-Based Quality Sampling (what-if): 100% high-value/low-confidence/new-category/new-route/human-disagreement + детерминированные 2-5% random (hash ref) POST /v1/airus/tender-production/role-adoption auth: public Role-Based Adoption (what-if): per-role фактическое использование + manual bypass + parallel-Excel → adopted/partial/not_adopted (не по логинам) POST /v1/airus/tender-production/complexity-pricing auth: public Complexity Pricing (what-if): files/pages/OCR/tables/archives/versions → band (standard/large/complex) + estimate ДО анализа; глубокая маржа — TenderPackMarginOps POST /v1/airus/tender-production/passport-freshness auth: public Passport Freshness (what-if): capability → VERIFIED/EXPIRING/STALE/CONFLICTING/MISSING; bid_blocked на устаревшем critical (расширяет Ф77 CompanyCapability) POST /v1/airus/tender-production/unit-economics auth: public Unit Economics (what-if, ТОНКО): per-procedure ingestion/OCR/storage/retrieval/LLM/verification/support/partner → gross_margin; отрицательная маржа помечается POST /v1/airus/tender-production/workflow-health auth: public Workflow Health Score (what-if): composite (coverage/quality/adoption/decision/integration/cost/passport); fail-closed incomplete без всех факторов (паттерн Ф54) POST /v1/airus/tender-production/bid-lifecycle auth: public Bid Decision Lifecycle (what-if): переходы NEW→ANALYZING→…→INVALIDATED_BY_CHANGE/ARCHIVED (расширяет Ф77 TenderBidDecision) POST /v1/airus/tender-production/stage-advance auth: public 90-day stage machine (what-if): stabilize→adopt→prove (no-skip, fail-closed) POST /v1/airus/tender-production/workflows/:key/promote auth: jwt Promote pilot→production (fail-closed: только Ф80-пилот с production/conditional_production; frozen pack version, БЕЗ пересоздания tenant) GET /v1/airus/tender-production/workflows auth: jwt Список production-workflow (stage/sla/reference_status) POST /v1/airus/tender-production/workflows/:key/stage auth: jwt Advance 90-day stage (stabilize→adopt→prove, server-enforced no-skip) POST /v1/airus/tender-production/workflows/:key/intake/:ref auth: jwt Intake record: coverage_status DERIVED (fail-closed) POST /v1/airus/tender-production/workflows/:key/unit-economics/:ref auth: jwt Per-procedure unit economics: gross_margin DERIVED POST /v1/airus/tender-production/workflows/:key/quality-samples/:ref auth: jwt Quality sample: must_review DERIVED из сигналов процедуры (high-value/low-conf/new-route/disagreement/random) POST /v1/airus/tender-production/workflows/:key/adoption/:role auth: jwt Adoption snapshot по роли: status DERIVED (adopted/partial/not_adopted) GET /v1/airus/tender-production/passport/:companyRef auth: jwt Passport freshness компании DERIVED из Ф77 CompanyCapability (bid_blocked на устаревшем critical) POST /v1/airus/tender-production/bid-lifecycle/:procedureKey/:companyRef auth: jwt Advance bid lifecycle Ф77-решения (server-enforced transitions, no-skip) POST /v1/airus/tender-production/workflows/:key/metrics-record auth: jwt Persist accepted_decision_rate/time_reduction/passport_freshness — receipt строит SCALE из ЗАПИСАННОГО, не из body (не caller-gameable) GET /v1/airus/tender-production/workflows/:key/health auth: jwt Workflow health DERIVED из записанного (coverage из intake, adoption, positive-margin, quality sample) POST /v1/airus/tender-production/workflows/:key/receipt auth: jwt Tender Production Receipt (sha256, derived): coverage/accepted/margin/passport → SCALE/SUSTAIN/STOP GET /v1/airus/tender-production/metrics auth: jwt workflows, in_prove_stage, intake_records, intake_blocked, quality_samples, must_review GET /v1/airus/billing-trust/reference auth: public Billing Trust Reference: 12 движков, money_source_of_truth=LedgerService (ADR-002), roadmap (УПД XML+ЭДО, 1С, wiring в LedgerService) POST /v1/airus/billing-trust/quote-to-invoice-gate auth: public Quote-to-Invoice Gate (what-if, fail-closed): строка эмитится только при contract+price_version+usage+complexity+approval+tax+period+description; иначе refuse+missing[] POST /v1/airus/billing-trust/invoice-transition auth: public Invoice state machine (what-if): no-skip DRAFT→ISSUED→{PARTIALLY_PAID→PAID|OVERPAID|OVERDUE|DISPUTED}, CANCELLED из draft/issued; paid→disputed (chargeback) POST /v1/airus/billing-trust/payment-match auth: public Payment match (what-if, fail-closed): amount+payer_inn+purpose → matched/review/split_required/unmatched; неопознанный НЕ зачисляется (credit_authorized=false) POST /v1/airus/billing-trust/credit-exposure auth: public Credit Exposure Guard (what-if): exposure=overdue+unpaid_current+unbilled_usage+forecast≤limit → HEALTHY/WARNING/PAYMENT_REQUIRED/RESTRICTED/SUSPENDED POST /v1/airus/billing-trust/partner-payout auth: public Partner Payout Gate (what-if): payable=max(0,collected−refunded−disputed−taxes−excluded)×%; collected=0⇒0; SUPERSEDES advisory-комиссию revops POST /v1/airus/billing-trust/upd-validation auth: public УПД 5.03 validation (what-if): реквизиты+ИНН checksum+НДС-сверка ДО отправки; XML+подпись+ЭДО=roadmap; ставки illustrative POST /v1/airus/billing-trust/edo-readiness auth: public EDO Readiness (what-if): оператор/роуминг/формат/подписант(сертификат)/МЧД → ready|blockers[] GET /v1/airus/billing-trust/non-billable/:situation auth: public Non-billable classification: parser/provider_5xx/gateway/reprocessing → NON_BILLABLE_AIRUS_REPROCESSING; энфорс через LedgerService.release/refund (append-only) POST /v1/airus/billing-trust/anomaly-scan auth: public Billing anomaly scan (what-if): unknown-payer/usage-after-suspension(critical), duplicate-line/overage-no-approval/discount(high); прод-hookup в finops pipeline=roadmap POST /v1/airus/billing-trust/suspension auth: public Graceful suspension (what-if): warn→restrict_priority→restrict_bulk→read_only→emergency→full_block; оплаченный evidence НЕ отключается POST /v1/airus/billing-trust/trust-receipt auth: public Billing Trust Receipt (what-if): verdict CLEANLY_CLOSED (quote↔invoice∧usage∧invoice∧payment∧УПД∧reconciled∧disputes=0∧collected≥invoice); sha256+payload_version POST /v1/airus/billing-trust/aging auth: public Aging + dunning (what-if): бакеты current/1-7/8-30/31-60/61+/disputed/promised + dunning-стадия + DSO POST /v1/airus/billing-trust/invoices/:key auth: jwt Создать invoice (draft) + evidence-событие GET /v1/airus/billing-trust/invoices auth: jwt Список invoice тенанта (amount — сумма ДОКУМЕНТА, не баланс) POST /v1/airus/billing-trust/invoices/:key/emit-line auth: jwt Эмиссия строки через Quote-to-Invoice Gate (fail-closed: без evidence строка не создаётся) POST /v1/airus/billing-trust/invoices/:key/transition auth: jwt Переход состояния invoice (server-enforced no-skip) + evidence-событие POST /v1/airus/billing-trust/invoices/:key/upd auth: jwt Валидация УПД → upd_status=validated (реальный XML+ЭДО — roadmap) POST /v1/airus/billing-trust/invoices/:key/upd/deliver auth: jwt EDO-readiness чек → пометка delivered (реальная отправка — внешний контур/roadmap) POST /v1/airus/billing-trust/payments/match auth: jwt Persist payment match (idempotent): invoice_amount+payer_inn СЕРВЕР берёт из реальных записей (не gameable); зачисление в баланс=LedgerService (roadmap) POST /v1/airus/billing-trust/partner-payouts auth: jwt Persist partner payout (idempotent): collected/refunded из РЕАЛЬНОГО LedgerEvent (не из body, не revops MRR); выплата=LedgerService (roadmap) GET /v1/airus/billing-trust/credit-status auth: jwt Credit exposure DERIVED из реальных invoice(overdue/unpaid)+UsageEvent(unbilled)+CreditProfile(limit) GET /v1/airus/billing-trust/suspension-status auth: jwt Suspension stage DERIVED из overdue + exposure_status GET /v1/airus/billing-trust/aging auth: jwt Aging-бакеты по реальным неоплаченным invoice тенанта POST /v1/airus/billing-trust/invoices/:key/reconcile auth: jwt Reconcile-действие финанса: append-only evidence 'reconciled' (делает флаг reconciled trust-receipt достижимым). Автоматическая 1С-сверка = roadmap POST /v1/airus/billing-trust/invoices/:key/trust-receipt auth: jwt Issue Trust Receipt: флаги DERIVED из реального состояния (invoice/evidence/BillingDispute/documented-allocation ≤ реального LedgerEvent collected), НЕ из body; CLEANLY_CLOSED verdict + sha256 GET /v1/airus/billing-trust/invoices/:key/trust-receipt/verify auth: jwt Verify receipt: пересчёт sha256 из реального состояния vs сохранённый GET /v1/airus/billing-trust/evidence auth: jwt Append-only lifecycle-журнал биллинга (evidence, НЕ money-ledger; суммы — документированные копии). ?invoice_key= GET /v1/airus/billing-trust/metrics auth: jwt invoices_by_state, cleanly_closed, payments matched/unmatched, payouts payable, credit_status/exposure GET /v1/airus/operating-plan/reference auth: public Reference: 14 движков, self-declared входы, #6 advisory (не server-verified), roadmap (реальные оклады/взносы/льгота/1С-ФОТ/cash runway) POST /v1/airus/operating-plan/founder-bottleneck auth: public Founder Bottleneck (what-if): critical при >20% blocked / >24ч ожидания / >15ч повторяемого POST /v1/airus/operating-plan/function-capacity auth: public Function Capacity (what-if): available vs required → remove→automate→partner→HIRE только по остаточному разрыву POST /v1/airus/operating-plan/fully-loaded-cost auth: public Fully Loaded Cost (what-if): salary×multiplier(1.25-1.35 IT / 1.35-1.5 без)+компоненты, 12мес. Ставки illustrative (нужен бухгалтер). НЕ COGS-per-request POST /v1/airus/operating-plan/make-vs-buy auth: public Make-vs-Buy (what-if): differentiation+security+build/partner cost → build/buy/partner/build_never_outsource POST /v1/airus/operating-plan/hiring-gate auth: public Hiring Gate (what-if, ФЛАГМАН fail-closed): critical bottleneck + не снимаемо removal/automation/partner + fully-loaded + cash≥12мес + signed pipeline → approved; иначе blocked+blockers POST /v1/airus/operating-plan/headcount-budget auth: public Headcount Budget Gate (what-if, ADVISORY): annual fully-loaded ≤ 30% САМОЗАЯВЛЕННОГО collected GP клиента. AIRUS не верифицирует — дисциплина, не server-gate POST /v1/airus/operating-plan/role-scorecard auth: public Role Scorecard (what-if): валидатор полноты 30/60/90 + kill_condition POST /v1/airus/operating-plan/bus-factor auth: public Bus-Factor Gate (what-if): критичный контур → bus_factor≥2 + runbook + recovery; иначе at_risk POST /v1/airus/operating-plan/service-to-product auth: public Service-to-Product Ratio (what-if): professional services ≤25-30%; >35% или >30% 2мес → остановить кастом POST /v1/airus/operating-plan/ownership-map auth: public Ownership Map (what-if): область → owner+backup → coverage + at_risk (без backup) POST /v1/airus/operating-plan/hiring-sequence auth: public Hiring Sequence (what-if): no-skip порядок найма (ядро раньше специализаций; Eval раньше ML) POST /v1/airus/operating-plan/founder-delegation auth: public Founder Delegation (what-if): keep (стратегич.+неповторяемое) vs delegate (повторяемое) POST /v1/airus/operating-plan/role-gate/:role auth: public Role-specific gate (what-if): sre/applied_ai/enterprise_sales/finance/hr — числовые пороги найма POST /v1/airus/operating-plan/bottleneck/:week auth: jwt Persist founder bottleneck за ISO-неделю (status DERIVED) GET /v1/airus/operating-plan/bottleneck/latest auth: jwt Последняя запись bottleneck POST /v1/airus/operating-plan/functions/:key/owner auth: jwt Owner+backup внутренней org-функции (bus_factor DERIVED, at_risk без backup) GET /v1/airus/operating-plan/ownership-map auth: jwt Карта владения org-функциями тенанта + coverage/at_risk POST /v1/airus/operating-plan/functions/:key/capacity auth: jwt Persist function capacity (recommended_action DERIVED) POST /v1/airus/operating-plan/make-vs-buy/:capability auth: jwt Persist make-vs-buy decision POST /v1/airus/operating-plan/roles/:key auth: jwt Role Request (ФЛАГМАН): сводит hiringGate(fail-closed)+headcountBudget(advisory)+sequence над self-declared входами → approved/blocked+reasons GET /v1/airus/operating-plan/roles auth: jwt Список role requests с решениями POST /v1/airus/operating-plan/receipt auth: jwt Operating Plan Receipt: агрегирует approved-роли/payroll/bottleneck; provenance-теги (attested/illustrative); sha256 GET /v1/airus/operating-plan/receipt/verify auth: jwt Verify receipt (read-only пересчёт sha256) GET /v1/airus/operating-plan/metrics auth: jwt roles_by_decision, annual_fully_loaded_payroll, org_functions/at_risk, founder_bottleneck_status GET /v1/airus/renewal-defense/reference auth: public Reference: 11 движков, спина=Ф54 read-only, server-derived vs declared, #18 eligibility, roadmap (downgrade/give-to-get/competitive-scan/category-defense/portability/reconstruction) POST /v1/airus/renewal-defense/renewal-clock auth: public Renewal Clock (what-if, #1): часы от САМОГО РАННЕГО события (budget/security review), не конца лицензии; фазы T-180…T-0 POST /v1/airus/renewal-defense/risk-taxonomy auth: public Renewal Risk Taxonomy (what-if, #2): 8 типов (product/value/sponsor/commercial/procurement/security/competitive/strategic), primary=наивысший, НЕ общий AT_RISK POST /v1/airus/renewal-defense/procurement-calendar auth: public Procurement Calendar (what-if, #3): 6 датированных событий (payment_schedule — roadmap) → упорядоченный timeline + самое раннее действие + просрочки POST /v1/airus/renewal-defense/buyer-committee auth: public Buyer Committee (what-if, #4): 7 обязательных ролей; пустая критичная (sponsor/budget/procurement) → high risk POST /v1/airus/renewal-defense/forecast-confidence auth: public Forecast Confidence (what-if, #17): COMMITTED/HIGH/MEDIUM/LOW/CHURN_LIKELY; value_confirmed — server-derived, остальное declared POST /v1/airus/renewal-defense/decision-board auth: public Renewal Decision Board (what-if, #12): RENEW/RIGHT_SIZE/EXPAND/RECOVERY/COMPETITIVE_REVIEW/PLANNED_EXIT; health — advisory POST /v1/airus/renewal-defense/multi-year-gate auth: public Multi-Year Gate (what-if, #16): 24-36мес только при value_confirmed + структурных (indexation/exit); health ADVISORY, НЕ гейт (5/7 declared) POST /v1/airus/renewal-defense/procurement-ready-arr auth: public Procurement-Ready ARR (what-if, ФЛАГМАН #18): ARR ready ТОЛЬКО при 8 условиях; ELIGIBILITY-флаг на declared ARR (не деньги); fail-closed value_unverified POST /v1/airus/renewal-defense/recovery-sprint auth: public 30-Day Recovery Sprint (what-if, #13): diagnose→fix→verify_value→decide; T-30 принудительное решение, не бесконечный proserv POST /v1/airus/renewal-defense/exit-detector auth: public Exit Preparation Detector (what-if): ≥3 сигналов → likely; одиночный экспорт НЕ churn POST /v1/airus/renewal-defense/accounts/:accountId/plan auth: jwt Upsert defense plan (declared) по UUID клиентского аккаунта Ф54; computed forecast/primary_risk/decision из server-derived value GET /v1/airus/renewal-defense/accounts/:accountId/status auth: jwt Полный статус (live): server-derived из Ф54 + clock/calendar/committee/taxonomy/forecast/board/multi-year/#18 ARR-gate POST /v1/airus/renewal-defense/accounts/:accountId/receipt auth: jwt Renewal Defense Receipt (#19): sha256, authoritative:false; value_multiple server-derived, budget/procurement/security/competitive declared GET /v1/airus/renewal-defense/accounts/:accountId/receipt/verify auth: jwt Verify receipt (read-only, tamper-evident): пересчёт sha256 из ЗАПЕЧАТАННЫХ полей, не из живых чтений Ф54 GET /v1/airus/renewal-defense/accounts auth: jwt Список defense-планов (renewal_confidence/primary_risk/board_decision/declared ARR) GET /v1/airus/renewal-defense/metrics auth: jwt renewable_arr(declared), arr_by_confidence, churn_likely_arr, decisions. Money N/A GET /v1/airus/security/reference auth: public Reference: 4 контура, таксономия энфорса (inline/analyzer/mitigation/roadmap), инварианты, roadmap. Инъекции = митигация, не security-control GET /v1/airus/security/invariants auth: public 8 fail-closed инвариантов зеро-траст плоскости с классом энфорса POST /v1/airus/security/assemble-prompt auth: public Structured Prompt Assembly (what-if, класс C): делимитеры+нейтрализация недоверенного контента. Митигация, НЕ предотвращение POST /v1/airus/security/scan-output auth: public Output Safety Gateway (what-if, класс B): скан готового ответа на секреты/PII/эксфильтрацию. НЕ инлайн-стрим POST /v1/airus/security/canary-check auth: public Security Canary (what-if, класс B): verbatim-эхо канарейки в выводе = эксфильтрация POST /v1/airus/security/tenant-isolation auth: public Tenant Isolation Proof (what-if, класс A): реконструкция из tenant_id ресурсов, без ресурсов → measured=false POST /v1/airus/security/receipt auth: public Aggregated Security Receipt (what-if): SAFE_TO_REVIEW = AND(measured ∧ passed) по A+B; любой неизмеренный → false POST /v1/airus/security/evaluate auth: jwt Реальная оценка запроса: изоляция+скан+брокер+реестр модели → запечатанный fail-closed рецепт (seal-once, sha256, authoritative:false) GET /v1/airus/security/evaluations auth: jwt Список запечатанных security-оценок (safe_to_review/unmeasured/failed/sha256) GET /v1/airus/security/evaluations/:id/verify auth: jwt Verify-from-sealed: реконструкция sha256 из запечатанной строки (tamper-evident), НЕ переоценка GET /v1/airus/reliability/reference auth: public Reference: движки, провенанс сигналов (live_measured/computed/declared/roadmap), reuse-реестр, 3 рецепта разграничены POST /v1/airus/reliability/workflow-availability auth: public Verified Workflow Availability (what-if): доступно только если ВСЕ обязательные шаги ok; partial=completed_with_gaps POST /v1/airus/reliability/deadline-priority auth: public Deadline-Aware Priority (what-if): дедлайн+severity+tier+value+age, не громкость клиента POST /v1/airus/reliability/error-budget auth: public Error Budget (what-if): SLO burn → release_freeze при исчерпании POST /v1/airus/reliability/decision-divergence auth: public Decision Divergence (what-if): два переданных решения расходятся → REVIEW_REQUIRED POST /v1/airus/reliability/backup-proof auth: public Backup Restore Proof (what-if): без реального restore-теста → UNVERIFIED (declared, вердикт не поднимает) POST /v1/airus/reliability/receipt auth: public Reliability Receipt (what-if): ENTERPRISE_READY = AND(measured ∧ passed) по каноническим; любой неизмеренный → false POST /v1/airus/reliability/evaluate auth: jwt Реальная оценка workflow: availability+unsafe-fallback+exactly-once(live)+semantic/circuit/retry → запечатанный fail-closed рецепт POST /v1/airus/reliability/effects auth: jwt Exactly-Once бизнес-эффект (CRM/email/receipt/decision/callback): повтор ключа = duplicate, действие не выполняется дважды. Billing отклоняется (деньги — LedgerService) GET /v1/airus/reliability/evaluations auth: jwt Список запечатанных reliability-оценок GET /v1/airus/reliability/evaluations/:id/verify auth: jwt Verify-from-sealed: реконструкция sha256 из запечатанной строки, НЕ переоценка GET /v1/airus/provider-governance/reference auth: public Reference: движки, провенанс (live COGS/attested/declared/roadmap), лимиты концентрации, reuse POST /v1/airus/provider-governance/concentration auth: public Concentration Guard (what-if): доля vs лимит; нет данных → insufficient_data (инвертированный fail-closed, не allow) POST /v1/airus/provider-governance/tier auth: public Provider Tier (what-if): strategic/core/approved/experimental/exit POST /v1/airus/provider-governance/scorecard auth: public Provider Scorecard (what-if): взвешенный композит → PREFERRED/HEALTHY/WATCH/RESTRICTED/EXIT; пустой→null POST /v1/airus/provider-governance/adjusted-cost auth: public Provider-Adjusted Cost (what-if): МНОЖИТЕЛЬ риска (retry+verification+incident+liquidity+concentration+migration), не абсолютные ₽ POST /v1/airus/provider-governance/contract-matrix auth: public Contract Control Matrix (what-if, declared): недостающие clauses → gaps POST /v1/airus/provider-governance/change-notice auth: public Model Change Notice (what-if, declared): required (60/30/…) vs contractual → gap POST /v1/airus/provider-governance/exit-readiness auth: public Exit Readiness (what-if, declared): критичный без плана → block; НИКОГДА VERIFIED из body POST /v1/airus/provider-governance/independence auth: public Provider Independence (genuine reuse resilienceops.detectCommonMode): общий failure domain = не резерв POST /v1/airus/provider-governance/receipt auth: public Governance Receipt (what-if): GOVERNED = AND(measured ∧ passed); неизмеренная концентрация → CANNOT_CERTIFY POST /v1/airus/provider-governance/evaluate auth: jwt Реальная оценка портфеля: concentration из РЕАЛЬНОГО spend (usageEvent) + exit/scorecard → запечатанный fail-closed рецепт GET /v1/airus/provider-governance/evaluations auth: jwt Список запечатанных governance-оценок GET /v1/airus/provider-governance/evaluations/:id/verify auth: jwt Verify-from-sealed: реконструкция sha256 из запечатанной строки GET /v1/airus/model-catalog/reference auth: public Reference: lifecycle, провенанс (verified_persisted/declared/roadmap), eval-harness packs, honesty POST /v1/airus/model-catalog/truth-gate auth: public Catalog Truth Gate (флагман): PRODUCTION только при персистном eval; declared → максимум TESTING (badge = тест, не заявление) POST /v1/airus/model-catalog/identity auth: public Canonical Model Identity: alias ≠ identity (provider/upstream/version/fingerprint) POST /v1/airus/model-catalog/card auth: public Verified Model Card: provider claim vs AIRUS verification — РАЗНЫЕ поля; verified только из персистного eval POST /v1/airus/model-catalog/parity auth: public OpenAI Parity Matrix: совместимый endpoint ≠ паритет; verified только из теста POST /v1/airus/model-catalog/price-normalize auth: public Price Normalization: ₽/1M в Decimal (не float); разные единицы тарификации сопоставимы POST /v1/airus/model-catalog/price-freshness auth: public Price Freshness: цена старше max-age → устарела (quote может быть неверным) POST /v1/airus/model-catalog/recommend auth: public Unbiased Recommendation: quality-ранжирование СТРУКТУРНО без маржи (commercial_influence=none_structural) POST /v1/airus/model-catalog/integrity-receipt auth: public Catalog Integrity Receipt (what-if): TRUSTED ⟺ unverified_claims=0 (нет fake PRODUCTION) POST /v1/airus/model-catalog/evaluate auth: jwt Реальная оценка каталога: каждая модель через Truth Gate → запечатанный fail-closed Integrity Receipt GET /v1/airus/model-catalog/evaluations auth: jwt Список запечатанных catalog-integrity оценок GET /v1/airus/model-catalog/evaluations/:id/verify auth: jwt Verify-from-sealed: реконструкция sha256 из запечатанной строки GET /v1/airus/model-evaluation/reference auth: public Reference: risk C0-C4, канонические гейты по классу, провенансы, roadmap (реальные judge/human прогоны) POST /v1/airus/model-evaluation/risk-classify auth: public Risk classes C0-C4: детерминированные правила → канонический набор release-гейтов POST /v1/airus/model-evaluation/rubric-validate auth: public Rubric Registry: weights=1, шкалы монотонны, anchors обязательны; rubric_sha256 = версия POST /v1/airus/model-evaluation/deterministic-score auth: jwt Deterministic score: РЕАЛЬНЫЙ вызов evalops.scoreExample (JWT: пользовательский regex — не для анонимного вызова) POST /v1/airus/model-evaluation/hybrid-score auth: public Hybrid scoring: deterministic+judge+human; declared/некалиброванный judge → advisory_only (не release-grade) POST /v1/airus/model-evaluation/judge-agreement auth: public Judge governance: Cohen's kappa vs эксперты; generator≠judge; <50 пар → not_calibrated (fail-closed) POST /v1/airus/model-evaluation/worst-slice auth: public Worst-slice gate: вердикт по ХУДШЕМУ slice; недомеренный slice → cannot_certify (не вакуумный pass) POST /v1/airus/model-evaluation/statistical-gate auth: public Statistical regression gate: delta+95% CI; inconclusive = BLOCKED (не pass), required_n оценка POST /v1/airus/model-evaluation/pass-at-k auth: public Multi-run consistency: pass@1/pass_all_k/flaky_rate — ловит модель, проходящую тест «иногда» POST /v1/airus/model-evaluation/cost-per-outcome auth: public Cost per Accepted Outcome: BigInt nano-₽; accepted=0 → cannot_compute (не «бесплатно») POST /v1/airus/model-evaluation/release-gate auth: public Release gate (what-if): AND(measured∧passed) по канону класса; unmeasured/declared → false POST /v1/airus/model-evaluation/canary-plan auth: public Canary план-валидатор: монотонные ступени+гейты+rollback обязательны (исполнение roadmap) POST /v1/airus/model-evaluation/shadow-plan auth: public Shadow план-валидатор: mirror_fraction/retention/compare_metric (исполнение roadmap) POST /v1/airus/model-evaluation/core300-coverage auth: public Core-300 coverage: покрытие слотов спецификации (оси из evalops.EVAL_PACKS); частичный golden set не сертифицирует POST /v1/airus/model-evaluation/evaluate auth: jwt Release-вердикт: гейты пересчитаны из сырья (declared не принимается) → запечатанный Evaluation Receipt (seal-once) GET /v1/airus/model-evaluation/verdicts auth: jwt Список запечатанных release-вердиктов GET /v1/airus/model-evaluation/verdicts/:id/verify auth: jwt Verify-from-sealed: реконструкция sha256 из запечатанной строки GET /v1/airus/production-quality/reference auth: public Reference: signal types, feedback hierarchy, drift taxonomy, restriction states, hard rules (silence ≠ acceptance) POST /v1/airus/production-quality/signal-validate auth: public Production Signal envelope: request_id обязателен; сигнал = событие для расследования, не команда POST /v1/airus/production-quality/feedback-strength auth: public Feedback hierarchy: business outcome > correction > override > retry/abandonment > thumbs; пусто → no_evidence POST /v1/airus/production-quality/correction-diff auth: public Field-level Correction Diff → regression case ТОЛЬКО после adjudication (confirmed) POST /v1/airus/production-quality/first-pass-metrics auth: public First-Pass Acceptance / Retry-to-Success / abandonment из переданных событий (computed) POST /v1/airus/production-quality/drift-classify auth: public Drift taxonomy (10 типов) + data-vs-model attribution: смена данных не лечится откатом модели POST /v1/airus/production-quality/baseline-compare auth: public 3 baseline-окна + сезонная супрессия; slice min-n; alert всегда указывает окно расхождения POST /v1/airus/production-quality/active-sample auth: public Active Review queue: информативные кейсы (complaint/disagreement/new intent), не случайный 1% POST /v1/airus/production-quality/feedback-integrity auth: public Feedback Integrity Score: защита от отравления; quarantined не идёт в drift/golden set POST /v1/airus/production-quality/route-restriction auth: public Route Restriction state machine (WATCH..GLOBAL_QUARANTINE): hysteresis/cooldown/blast radius/flapping-freeze; план, не действие POST /v1/airus/production-quality/golden-lifecycle auth: public Golden Set lifecycle: dedup/stale/contamination retirement — set без pruning деградирует POST /v1/airus/production-quality/evaluation-debt auth: public Evaluation Debt: CONTROLLED..RELEASE_FREEZE; неизмеренный долг ≠ нулевой (fail-closed) GET /v1/airus/production-quality/first-pass-live auth: jwt live_measured: РЕАЛЬНАЯ агрегация quality_feedback + usage_events (success/corrected/coverage) POST /v1/airus/production-quality/evaluate auth: jwt Production Feedback Receipt: live+computed секции → запечатанный receipt (seal-once, HEALTHY не из пустоты) GET /v1/airus/production-quality/receipts auth: jwt Список запечатанных production-feedback receipts GET /v1/airus/production-quality/receipts/:id/verify auth: jwt Verify-from-sealed: реконструкция sha256 из запечатанной строки GET /v1/airus/agents auth: jwt Агентские ключи и статистика GET /v1/airus/agent-runs auth: jwt Run trace по metadata.run_id POST /v1/airus/agents/:agentId/kill auth: jwt Kill switch (необратимо) POST /v1/airus/agents/:agentId/pause auth: jwt Пауза агента POST /v1/airus/agents/:agentId/resume auth: jwt Возобновить агента POST /v1/airus/batches auth: jwt Создать batch-задание (скидки economy −30%/standard −15%) POST /v1/airus/batches/estimate auth: jwt Калькулятор экономии до запуска GET /v1/airus/batches/:id auth: jwt Статус батча GET /v1/airus/batches/:id/results auth: jwt Результаты NDJSON GET /v1/airus/batches/:id/receipt auth: jwt Чек экономии POST /v1/airus/batches/:id/cancel auth: jwt Отменить батч GET /v1/airus/webhooks/endpoints auth: jwt Webhook-endpoints POST /v1/airus/webhooks/endpoints auth: jwt Создать endpoint (HMAC-подпись, secret один раз) GET /v1/airus/webhooks/events auth: jwt Журнал событий с доставками POST /v1/airus/webhooks/events/:id/replay auth: jwt Переотправить событие GET /v1/airus/webhooks/health auth: jwt Доставляемость, очередь, DLQ GET /v1/airus/webhooks/dead-letters auth: jwt Dead-letter queue: мёртвые доставки (format=json|csv) GET /v1/airus/webhooks/event-types auth: jwt Каталог типов событий GET /v1/airus/templates auth: public Каталог готовых сценариев (фильтр ?integration=) GET /v1/airus/templates/runs/:runId/receipt auth: jwt Receipt прогона шаблона POST /v1/airus/tenders/analyze auth: api_key Полный анализ тендера: summary, требования, дедлайны, риски, go/no-go POST /v1/airus/tenders/risk-score auth: api_key Карта рисков закупки с risk_score 0–100 POST /v1/airus/tenders/go-no-go auth: api_key Go/no-go решение по закупке POST /v1/airus/tenders/batch auth: jwt Пакетный анализ архива закупок (Batch со скидкой) POST /v1/airus/calls/analyze auth: api_key Полный разбор транскрипта звонка: summary, scorecard, qa_score, риски, next steps POST /v1/airus/calls/qa-score auth: api_key QA-scorecard звонка по критериям + суммарный qa_score 0–100 POST /v1/airus/calls/extract-actions auth: api_key Договорённости и next steps (owner/due) + highlights из транскрипта POST /v1/airus/calls/risk-flags auth: api_key Риски и compliance звонка: жалобы, отказы, запрещённые обещания POST /v1/airus/calls/batch auth: jwt Пакетный QA-разбор архива звонков (Batch со скидкой) POST /v1/airus/documents/extract auth: api_key Извлечение полей документа с evidence (value/confidence/страница) POST /v1/airus/documents/validate auth: api_key Детерминированная валидация: ИНН/КПП, НДС, суммы, обязательные поля POST /v1/airus/documents/risk-score auth: api_key Document Risk Taxonomy: risk_score 0–100 и флаги по severity POST /v1/airus/documents/process auth: api_key Полный конвейер: извлечение → валидация → риски → human-review → actions → receipt POST /v1/airus/documents/batch auth: jwt Пакетная обработка архива документов (Batch со скидкой) GET /v1/airus/documents/review auth: jwt Очередь human-review: документы, требующие ручной проверки GET /v1/airus/documents/risk-taxonomy auth: public Document Risk Taxonomy v0 (справочник рисков) GET /v1/airus/documents/ocr-routes auth: public OCR Route Registry: каталог движков распознавания (provided_text доступен, провайдеры roadmap) GET /v1/airus/incidents/timeline auth: jwt Incident Timeline: хронология инцидентов безопасности/надёжности/финопса GET /v1/airus/security/keys auth: jwt Ключи со scope, статусом, расходом за день и risk-score GET /v1/airus/security/spend-risk auth: jwt Spend Risk Score по ключам (сигналы, уровни) GET /v1/airus/security/risk-signals auth: jwt Справочник сигналов и уровней spend-risk POST /v1/airus/security/keys/:id/scope auth: jwt Задать scope ключа: allowed/blocked models, ₽-кап, лимиты токенов POST /v1/airus/security/keys/:id/freeze auth: jwt Заморозить ключ (AbuseGuard) — шлюз мгновенно отклоняет POST /v1/airus/security/keys/:id/unfreeze auth: jwt Разморозить ключ GET /v1/airus/siem/sources auth: jwt Источники и форматы выгрузки событий безопасности (self-describing) GET /v1/airus/siem/export auth: jwt Выгрузка событий безопасности в SIEM: format=json|jsonl|cef|syslog, фильтры from/to/categories/min_severity GET /v1/airus/sdk/configs auth: public Каталог конфигов интеграции AIRUS (OpenAI SDK, LangChain, LiteLLM, Cursor, Cline, n8n, k8s…) GET /v1/airus/sdk/configs/:tool auth: public Готовый конфиг подключения для конкретного инструмента GET /v1/airus/sdk/postman auth: public Postman Collection v2.1 всех эндпоинтов (импорт в Postman/Insomnia/Bruno) GET /v1/airus/sdk/n8n-workflow auth: public Готовый n8n workflow (HTTP Request → AIRUS chat) POST /v1/airus/creative/campaign-pack auth: api_key Бриф → варианты копирайта по каналам с brand/legal-проверкой и Creative Receipt POST /v1/airus/creative/assets/generate auth: api_key Генерация вариантов рекламного копирайта по брифу + проверки + approval-статус POST /v1/airus/creative/brand-check auth: api_key Детерминированная проверка копирайта на соответствие Brand Kit POST /v1/airus/creative/legal-check auth: api_key Legal Flags: маркировка рекламы, рисковые/медицинские заявления, ПДн POST /v1/airus/creative/batch auth: jwt Пакетная генерация под архив брифов (Batch со скидкой) GET /v1/airus/creative/review auth: jwt Очередь согласования: креативы, требующие marketer/legal review GET /v1/airus/creative/legal-taxonomy auth: public Legal Flags v0 + approval-статусы (справочник) GET /v1/airus/creative/image-routes auth: public Image Route Registry: copy_only доступен, YandexART/Kandinsky/GPT Image — roadmap GET /v1/airus/creative/brand-kits auth: public Примеры Brand Kit (персистентная библиотека — roadmap) GET /v1/airus/pricing/plans auth: public Тарифы и SLA-классы POST /v1/airus/pricing/estimate auth: public Калькулятор месячного бюджета POST /v1/airus/quotes auth: jwt Запросить КП (Deal Desk) GET /v1/airus/credentials auth: jwt Provider-ключи в vault (секрет не показывается) POST /v1/airus/credentials auth: jwt Сохранить provider-ключ (AES-256-GCM), managed fallback POST /v1/airus/credentials/:id/test auth: jwt Health-check ключа GET /v1/airus/byok/usage auth: jwt Сводка по источникам оплаты GET /v1/airus/org/members auth: jwt Участники и роли POST /v1/airus/org/invites auth: jwt Пригласить участника (роль) GET /v1/airus/org/audit-log auth: jwt Admin audit log (format=jsonl) GET /v1/airus/org/readiness auth: jwt Production readiness чек-лист POST /v1/airus/org/cost-centers auth: jwt Cost center с бюджетом GET /v1/airus/org/key-rotation auth: jwt Отчёт по ключам к ротации (возраст/простой/без владельца) GET /v1/airus/data-routing/summary auth: jwt Сводка маршрутов данных (hybrid) GET /v1/airus/data-routing/boundary-summary auth: jwt Data Boundary Control: распределение по route_type, blocked, unknown class POST /v1/airus/data-routing/detect auth: jwt Sensitive Data Auto-Tagger: детектор ПДн/финданных → suggested data_class GET /v1/airus/firewall/summary auth: jwt AI Firewall: abuse-события, блокировки GET /v1/airus/firewall/key-scores auth: jwt Key Abuse Score POST /v1/airus/simulate auth: jwt Policy Simulator: dry-run запроса через firewall/hybrid/data-boundary/allow-list без вызова модели GET /v1/airus/approved-ai/model-catalog auth: public Approved AI: каталог role-packs (модели/маршруты по отделам) POST /v1/airus/approved-ai/apply-pack auth: jwt Применить role-pack отдела к политике проекта (реальный enforcement) GET /v1/airus/approved-ai/control auth: jwt Approved AI Control dashboard: отделы, risky prompts, покрытие политиками POST /v1/airus/knowledge-bases auth: jwt Создать базу знаний POST /v1/airus/knowledge-bases/:id/documents auth: jwt Проиндексировать документ (ACL scope) POST /v1/airus/knowledge-bases/:id/query auth: jwt RAG-запрос с citations и grounding score GET /v1/airus/knowledge-bases/:id/health auth: jwt Knowledge health (stale/conflict/cost per answer) GET /v1/airus/knowledge-bases/:id/issues auth: jwt Actionable issues: устаревшие/дубли/конфликтующие версии + рекомендации GET /v1/airus/knowledge/connectors auth: public Connector Registry: manual_upload доступен, Confluence/Notion/1С/Drive — roadmap GET /v1/airus/knowledge/sources auth: jwt Реестр источников знаний с freshness-разбивкой GET /v1/airus/knowledge/quality auth: jwt RAG Quality Metrics: stale_chunk_rate, acl_leak_rate, cost per answer POST /v1/airus/knowledge/answer auth: jwt Trusted Answer: решение (trusted/low_confidence/no_answer) + chunk evidence + receipt GET /v1/airus/errors auth: public Error Doctor: каталог кодов с диагнозом POST /v1/airus/migrations/check auth: public Migration Cockpit: живая проверка совместимости ключом GET /v1/airus/evals auth: public Eval Pack (методология) GET /v1/airus/evals/evaluator-types auth: public Типы evaluator'ов, gate-операторы и действия POST /v1/airus/evals/run auth: api_key Прогон golden-датасета через маршрут → Eval Run Receipt (pass_rate, gate) POST /v1/airus/evals/compare auth: api_key Model-vs-model: baseline vs candidate → quality_delta + gate_decision GET /v1/airus/evals/packs auth: public Готовые eval-паки под use-case (evaluators + gate + пример датасета) POST /v1/airus/evals/suites auth: jwt Сохранить eval-suite (golden dataset + gate) для регрессии GET /v1/airus/evals/suites auth: jwt Список сохранённых eval-suites POST /v1/airus/evals/suites/:id/run auth: api_key Перезапуск сохранённого suite (регрессия во времени) GET /v1/airus/docs/quality-gate auth: public Docs Quality Gate: drift между документацией и роутером GET /v1/airus/docs/snippets auth: public Verified snippets каталог GET /v1/airus/docs/endpoints auth: public Машинный список эндпоинтов (source of truth) POST /mcp auth: public Docs MCP Server (JSON-RPC 2.0): search_airus_docs, explain_airus_error, get_airus_snippet для AI-агентов ## Model aliases - cheap-chat: быстрая недорогая chat-модель - strong-chat: сильная chat-модель для сложных задач - embeddings-small: модель эмбеддингов - airus:auto: авто-роутинг по task_type и политике - airus:auto-support: короткие ответы поддержки - airus:auto-rag: ответы по источникам (RAG) - airus:auto-code: код-ревью - airus:auto-legal: юридические/договорные тексты - airus:auto-classify: классификация - airus:auto-cheap: самый дешёвый проходной вариант ## Metadata keys (передавайте в поле metadata) feature, client_id, workflow_id, run_id, environment, task_type, business_unit, quality_target, routing_policy, prompt_version, template_id, template_run_id, data_class, sensitivity, contains_personal_data ## Error codes (полный диагноз: GET /v1/airus/errors) - 401 invalid_api_key: Ключ не найден или неверного формата. Fix: Проверьте заголовок: Authorization: Bearer airus_sk_… - 401 revoked_api_key: Ключ отозван. Fix: Создайте новый ключ в кабинете - 401 expired_api_key: Срок действия ключа истёк. Fix: Создайте новый ключ - 402 insufficient_balance: Недостаточно средств на prepaid-балансе. Fix: Пополните баланс в кабинете (Биллинг) - 404 model_not_found: Модель не найдена в каталоге. Fix: Список доступных моделей: GET /v1/models - 403 model_not_allowed_by_policy: Модель запрещена политикой проекта. Fix: Проверьте политику проекта (Кабинет → Политики) - 402 policy_budget_exceeded: Бюджет проекта исчерпан. Fix: Увеличьте бюджет в политике проекта - 429 rate_limit_exceeded: Превышен rate limit ключа. Fix: Повторите с экспоненциальным backoff - 429 project_rpm_exceeded: Превышен RPM-лимит проекта. Fix: Дождитесь следующей минуты (Retry-After в ответе) - 429 project_tpm_exceeded: Превышен TPM-лимит проекта. Fix: Уменьшите max_tokens - 400 context_too_large: Контекст больше лимита проекта. Fix: Сократите промпт или используйте суммаризацию - 503 circuit_breaker_open: Маршрут модели временно закрыт. Fix: Повторите через 30 секунд (half-open проба закроет breaker при успехе) - 451 sensitive_data_blocked: Запрос заблокирован hybrid-политикой. Fix: Это защита, а не сбой: проверьте правила в политике проекта - 403 abuse_detected: Запрос заблокирован AI Firewall. Fix: Это защита: проверьте входящие данные от конечных пользователей - 403 model_disabled: Модель отключена для проекта. Fix: Выберите активную модель из GET /v1/models - 429 project_concurrency_exceeded: Превышен лимит одновременных запросов проекта. Fix: Уменьшите параллелизм клиента - 403 agent_paused: Агентский ключ на паузе. Fix: Возобновите агента: POST /v1/airus/agents/{id}/resume - 402 agent_budget_exceeded: Бюджет агента исчерпан. Fix: Увеличьте бюджет агента в его конфиге - 402 agent_run_budget_exceeded: Бюджет одного run агента исчерпан. Fix: Поднимите max_run_cost_rub - 403 agent_chain_limit_exceeded: Превышена глубина цепочки агента. Fix: Поднимите max_chain_steps - 403 model_not_allowed_for_agent: Модель запрещена для агента. Fix: Добавьте модель в allowed_models агента - 500 billing_reservation_failed: Не удалось зарезервировать средства. Fix: Повторите запрос — деньги не списаны - 500 billing_finalize_failed: Не удалось финализировать списание. Fix: Ответ вы получили; сверка баланса произойдёт автоматически - 451 data_boundary_blocked: Заблокировано политикой границ данных. Fix: Это защита данных, а не сбой: проверьте data_class запроса и правила Data Boundary в политике - 502 provider_unavailable: Провайдер модели недоступен. Fix: Повторите с backoff — деньги за неуспешный запрос не списываются - 504 upstream_timeout: Провайдер не ответил вовремя. Fix: Уменьшите max_tokens - 502 stream_interrupted: Стрим оборвался на стороне провайдера. Fix: Повторите запрос - 403 key_model_not_allowed: Модель запрещена scope этого ключа (AbuseGuard). Fix: Используйте модель из allowed_models ключа (GET /v1/airus/security/keys) - 402 key_spend_cap_exceeded: Достигнут дневной ₽-кап ключа (AbuseGuard). Fix: Дождитесь начала следующих суток (кап дневной) - 403 key_frozen: Ключ заморожен (AbuseGuard). Fix: Разморозьте ключ, если это ложное срабатывание: POST /v1/airus/security/keys/{id}/unfreeze ## Integration rules for AI agents - Никогда не хардкодь ключ — читай из env AIRUS_API_KEY. - Для backend/n8n/CI используй service account ключи (keyType: service), а не личные. - Логируй request_id из ответа (заголовок x-request-id) для трассировки и сверки списаний. - Ставь timeout >= 60s на production-вызовы (генерация бывает долгой). - Обрабатывай коды: 401, 402, 403, 429, 451, 500, 502, 503, 504 — см. GET /v1/airus/errors (Error Doctor). - Передавай metadata (feature, client_id, environment) — это включает cost-атрибуцию и receipts. - Не полагайся на плавающие алиасы (airus:auto*) в проде без явного запроса пользователя — фиксируй модель, если нужна воспроизводимость. - Задай дневной бюджет в политике проекта и подпишись на webhook budget.threshold_reached. - Стриминг: stream:true, читай SSE до data: [DONE]; usage приходит в финальном чанке.