Generated file — do not edit by hand. Produced by tooling/gen-graphql-ref.py from the OSYRA edge GraphQL SDL.

Queries

102 operation(s).

activeDeployment

activeDeployment(workspaceId: ID!, slug: String!, environment: String!): PromptDeployment

The currently-active deployment pointer for a (slug, environment) in the caller's JWT-derived workspace, or null when none has been published. workspaceId is SDL-fidelity only — workspace comes from the JWT.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | environment | String! | | | | slug | String! | | | | workspaceId | ID! | | |

Returns: PromptDeployment

activeGuardrailBundle

activeGuardrailBundle: ActiveGuardrailBundle

The ACTIVE signed guardrail-policy bundle for the JWT workspace. null = no bundle published for this workspace (honest empty). OSY-GUARDRAIL-NOT-WIRED = the AP00019 read surface is not wired yet.

Returns: ActiveGuardrailBundle

activeImpersonationNotice

activeImpersonationNotice: ImpersonationNotice

The I5 impersonation-notice for the caller's JWT org, or null if none. TENANT-SCOPED (no org argument) — a caller can only ever learn about impersonation of THEIR org. Fail-closed until wired.

Returns: ImpersonationNotice

activeRoutingConfig

activeRoutingConfig: ActiveRoutingConfig

The ACTIVE verified routing config for the JWT workspace. null = sync wired but no verified cascade held for this workspace. OSY-ROUTING-CONFIG-NOT-WIRED = sync disabled on this gateway. OSY-ORCR-10802 = cascade held but degraded (fail-static in force).

Returns: ActiveRoutingConfig

agentRunReceipt

agentRunReceipt(runId: String!): AgentRunReceipt

A single Agent Run Receipt by run id.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | runId | String! | | |

Returns: AgentRunReceipt

agentRunReceipts

agentRunReceipts(sessionId: String, pageSize: Int, cursor: String, filter: ConsoleFeedFilter): AgentRunReceiptsPage!

Paginated Agent Run Receipts, optionally filtered by session. filter (ENG-2842 / E6.4) carries the shared Console model/status/cost/latency dimensions; NOT yet honorable server-side here, so a non-empty filter FAILS CLOSED with OSY-CONSOLE-FILTER-NOT-WIRED rather than returning unfiltered receipts as if server-filtered (NO STUBS); a null/all-empty filter is a no-op. See console_filter.graphql for the graduation contract.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | cursor | String | | | | filter | ConsoleFeedFilter | | | | pageSize | Int | | | | sessionId | String | | |

Returns: AgentRunReceiptsPage!

agentRuntimeSession

agentRuntimeSession(id: ID!): AgentSession

A single agent session by id.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: AgentSession

agentRuntimeSessions

agentRuntimeSessions(pageSize: Int, cursor: String, state: AgentSessionState): AgentSessionsPage!

Paginated agent sessions for the caller's workspace.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | cursor | String | | | | pageSize | Int | | | | state | AgentSessionState | | |

Returns: AgentSessionsPage!

aiUsage

aiUsage(workspaceId: ID!, startDate: DateTime, endDate: DateTime): AIUsage!

Get usage statistics for the workspace

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | endDate | DateTime | | | | startDate | DateTime | | | | workspaceId | ID! | | |

Returns: AIUsage!

amgateDecisions

amgateDecisions(since: DateTime, until: DateTime, stage: String, allowed: Boolean, limit: Int, cursor: String): AmgateDecisionConnection!

Paginated Attested-Memory-Gate decision history (admits AND denials), scoped to the caller's workspace (derived from the JWT, never from input — defense-in-depth per ENG-777 SEC-H1; mirrors verifyRetrieval / receipts / driftTrajectory). Powers the attested-memory-I/O dashboard (ENG-2421).

HONEST-SCOPE (ADR-177 D5, NON-NEGOTIABLE; /osyra-legal ENG-1741): the returned rows are CHANNEL-ENFORCEMENT records of the memory I/O channel (input-provenance admission on READ + output-receipt binding on WRITE) — NOT cognition-control, and NOT a claim that the model only reasons over attested memory.

Filters (AND-combined): since / until (inclusive decision-time bounds), stage (one of CAPABILITY..COMMIT), allowed (true = admits only, false = denials only, absent = both). limit is server-clamped to [1, 200] (default 50). cursor is the opaque keyset token from a previous page's nextCursor (omit for page 1).

Returns OSY-AMGATE-NOT-WIRED until OME_ENABLED and an OMEClient is configured (dev path).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | allowed | Boolean | | | | cursor | String | | | | limit | Int | | | | since | DateTime | | | | stage | String | | | | until | DateTime | | |

Returns: AmgateDecisionConnection!

apiKeys

apiKeys(workspaceId: ID!, includeRevoked: Boolean = false, view: ApiKeyInventoryView = MY_KEYS): [ApiKey!]!

List the calling user's API keys in a workspace. Plaintext is never returned; callers see {keyHint, prefix, scope, …} only.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | includeRevoked | Boolean | false | | | view | ApiKeyInventoryView | MY_KEYS | | | workspaceId | ID! | | |

Returns: [ApiKey!]!

art12Record

art12Record(systemId: ID!, from: Long!, until: Long!): A12crManifest

The Art-12(2) conformity-record binding index for a (system, [from, until)) window (GetArt12Record). from / until are epoch-SECONDS (the edge ×1000 to the proto epoch-ms bounds). Tenancy from the JWT; systemId is RLS-scoped by AP00005. Fails closed to OSY-EUCOMPLIANCE-NOT-WIRED when the edge is unwired / the deployed audit-svc predates GetArt12Record / PMM is disabled server-side. An unknown / cross-tenant system maps to a NULL record (record-not-found — no existence oracle, never a fabricated binding index), while an inverted / out-of-range window or an absent covering checkpoint is a client-actionable validation error.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | from | Long! | | | | systemId | ID! | | | | until | Long! | | |

Returns: A12crManifest

attestedLogTrajectory

attestedLogTrajectory(agentDid: String!, since: DateTime, until: DateTime, limit: Int, filter: ConsoleFeedFilter): AttestedLogTrajectory!

Bounded attested-log trajectory for one agent stream, scoped to the caller's tenant (derived from the JWT, never from input — defense-in-depth per ENG-777 SEC-H1; mirrors driftTrajectory / receipts / verifiedMemoryReceipts).

Filters: since / until (inclusive record-time bounds, honored NOW). limit clamps the requested record count to [1, 500], default 50. The frontend polls this query to render the forensic attested-log viewer (AP00012 has no push RPC for the attested log). Records are returned NEWEST-FIRST.

filter (ENG-2842 / E6.4) carries the shared Console model/status/cost/latency dimensions. These are NOT yet honorable server-side on this projection, so a non-empty filter FAILS CLOSED with OSY-CONSOLE-FILTER-NOT-WIRED rather than returning unfiltered records as if server-filtered (NO STUBS); a null/all-empty filter is a no-op. See console_filter.graphql for the graduation contract.

Returns OSY-ATTLOG-NOT-WIRED until OSYRASTREAM_SERVICE_ADDR is configured (dev path).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | agentDid | String! | | | | filter | ConsoleFeedFilter | | | | limit | Int | | | | since | DateTime | | | | until | DateTime | | |

Returns: AttestedLogTrajectory!

auditEvents

auditEvents(since: DateTime, until: DateTime, actor: String, actionPrefix: String, category: AuditCategory, outcome: AuditOutcome, correlationKey: String, limit: Int, cursor: String): AuditEventsPage!

Paginated, faceted audit feed scoped to the caller's workspace (workspace derived from the JWT, never from input — defense-in-depth per ENG-777 SEC-H1).

Filters: since / until (epoch-ms range), actor (exact ORN), actionPrefix (forward-permissive), category, outcome. All optional. limit is clamped to [1, 200]; default 50. cursor is opaque (from a prior nextCursor).

Returns OSY-AUDIT-NOT-WIRED until AUDIT_SERVICE_ADDR is configured (dev path).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | actionPrefix | String | | | | actor | String | | | | category | AuditCategory | | | | correlationKey | String | | | | cursor | String | | | | limit | Int | | | | outcome | AuditOutcome | | | | since | DateTime | | | | until | DateTime | | |

Returns: AuditEventsPage!

billingPlan

billingPlan(organizationId: ID!): BillingPlan

Get current billing plan details Requires: billing:read permission

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | organizationId | ID! | | |

Returns: BillingPlan

billingSubscription

billingSubscription(organizationId: ID!): BillingSubscription

Get current subscription for an organization Requires: billing:read permission

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | organizationId | ID! | | |

Returns: BillingSubscription

budget

budget(id: ID!): Budget

One budget by id, confined to the caller's org (IDOR-safe: another org's id is NOT_FOUND → null, never a cross-tenant leak). Requires: osyra:billing:*:read.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: Budget

budgets

budgets(scopeType: BudgetScope): [Budget!]!

The caller-org's budgets (ORG / WORKSPACE / PROVIDER / API_KEY scoped) with live utilization + committed/reserved spend. Org is derived from the JWT; the optional scopeType filters client-side. Requires: osyra:billing:*:read (the backend additionally requires a BILLING_ROLES admin role).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | scopeType | BudgetScope | | |

Returns: [Budget!]!

cacheSavingsTimeseries

cacheSavingsTimeseries(workspaceId: ID, startIso: String!, endIso: String!, granularity: UsageGranularity!): CacheSavingsTimeseries!

ENG-3223: time-bucketed CACHE savings series (dashboard "cache $ over time"). SUM(saved_microcents) for mechanism='cache' from the append-only savings ledger, bucketed like usageTimeseries. Org-scoped from the authenticated identity; workspaceId (optional) narrows to one workspace (null = all in the org). FACTUAL figures only (ENG-1741 gates the marketing CLAIM). Returns an EMPTY series / $0 until the served model is priced+signed (ENG-3216) — the honest gated state the panel labels, NEVER fabricated rows.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | endIso | String! | | | | granularity | UsageGranularity! | | | | startIso | String! | | | | workspaceId | ID | | |

Returns: CacheSavingsTimeseries!

complianceControlEvidence

complianceControlEvidence(controlId: String!, scope: ComplianceScope!, limit: Int): [ComplianceEvidenceRecord!]!

The collected-CER evidence history for ONE control (the ENG-2982 drill-down). Tenancy from the JWT (no workspace arg); limit bounds the page (default 50, max 200). Each record carries the RE-DERIVED signatureValid + the signed cti. Fails closed to OSY-COMPLIANCE-NOT-WIRED when unwired/unanchored; PLATFORM scope is admin-gated (OSY-AUDIT-7260) until the AP00009 verifier lands (ENG-2034). An empty history is an authoritative empty list — never a fabricated evidence record.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | controlId | String! | | | | limit | Int | | | | scope | ComplianceScope! | | |

Returns: [ComplianceEvidenceRecord!]!

complianceControls

complianceControls(scope: ComplianceScope!): ComplianceControlMatrix!

The compliance control-matrix for the given scope: the digest-anchored Control Registry catalog joined with the latest per-control ControlStatus. Tenancy from the JWT (no workspace arg). Fails closed to OSY-COMPLIANCE-NOT-WIRED when the edge is unwired / the registry is unanchored / the backend predates ListControls — never a fabricated matrix.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | scope | ComplianceScope! | | |

Returns: ComplianceControlMatrix!

connectors

connectors: [Connector!]!

The connector catalog + real per-connector status for the caller's workspace (JWT-scoped; NO ws argument).

Returns: [Connector!]!

contentBoundEnablement

contentBoundEnablement: ContentBoundEnablement

The CONTENT_BOUND enablement record for the caller's JWT workspace, or null if none exists. Returns OSY-CBE-NOT-WIRED until the IAM RPCs are reachable.

Returns: ContentBoundEnablement

costBreakdown

costBreakdown(startIso: String!, endIso: String!, dimension: String!, granularity: String, workspaceId: ID): CostBreakdown!

Org-wide spend rolled up by a dimension (provider / model / workspace) over a window. costStatus fail-closes to COST_UNAVAILABLE when the signed pricing catalog can't price a row — NEVER a fabricated 0. Org from the JWT; the optional workspaceId scopes provider/model dimensions. granularity is accepted for forward-compat and currently unused (the rollup is window-total). Requires: osyra:billing:*:read (backend requires a BILLING_ROLES admin role).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | dimension | String! | | | | endIso | String! | | | | granularity | String | | | | startIso | String! | | | | workspaceId | ID | | |

Returns: CostBreakdown!

costSavings

costSavings(window: String): CostSavings

Cost savings vs the priciest-baseline routing strategy. Requires: authentication only — no specific permission. Workspace isolation is enforced by deriving the workspace from the JWT, with a resolver-level guard that rejects tokens lacking the workspace_id claim (defense-in-depth; see SEC-H1 in PR #16's security review).

Formula: Σ (priciest_model_baseline_cost - actual_routed_cost) across all broker requests in the window. Computation is broker-side; this resolver only projects the result.

Workspace is derived from the JWT (no input arg). Returns null when the window contains no traffic. Returns the OSY-BROKER-NOT-WIRED error code until the upstream broker RPC is implemented.

Window: "7d" / "30d" / "90d". Default "30d". Invalid values → OSY-VALID-4001.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | window | String | | |

Returns: CostSavings

coverage

coverage(window: CoverageWindowInput): Coverage!

The coverage/gap summary for the caller's workspace, optionally narrowed to one window (JWT-scoped).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | window | CoverageWindowInput | | |

Returns: Coverage!

cuaActionReceipts

cuaActionReceipts(sessionId: String, pageSize: Int, cursor: String): CuaActionReceiptsPage!

Paginated per-action cua-action receipts for the caller's workspace (ENG-2464 / AP00018), optionally filtered to one session's append-only chain. Ordered most-recent first. Each row is the console-facing projection of a signed cua-action receipt; encodedCbor is the offline-verifiable COSE_Sign1 wire.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | cursor | String | | | | pageSize | Int | | | | sessionId | String | | |

Returns: CuaActionReceiptsPage!

driftTrajectory

driftTrajectory(agentDid: String!, since: DateTime, until: DateTime, limit: Int, filter: ConsoleFeedFilter): DriftTrajectory!

Bounded drift trajectory for one agent, scoped to the caller's workspace + tenant (both derived from the JWT, never from input — defense-in-depth per ENG-777 SEC-H1; mirrors receipts / verifiedMemoryReceipts).

Filters: since / until (inclusive window-time bounds, honored NOW). limit clamps the requested point count to [1, 500], default 50. The frontend polls this query to render the "real-time" drift dashboard (AP00012 has no push RPC). Points are returned NEWEST-FIRST.

filter (ENG-2842 / E6.4) carries the shared Console model/status/cost/latency dimensions. These are NOT yet honorable server-side on this projection, so a non-empty filter FAILS CLOSED with OSY-CONSOLE-FILTER-NOT-WIRED rather than returning unfiltered points as if server-filtered (NO STUBS); a null/all-empty filter is a no-op. See console_filter.graphql for the graduation contract.

Returns OSY-DRIFT-NOT-WIRED until OSYRASTREAM_SERVICE_ADDR is configured (dev path).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | agentDid | String! | | | | filter | ConsoleFeedFilter | | | | limit | Int | | | | since | DateTime | | | | until | DateTime | | |

Returns: DriftTrajectory!

dryRunEvaluate

dryRunEvaluate(scope: ScopeInput!, inputJson: String!): DecisionPreview!

Preview a decision against a candidate input at the JWT-derived scope.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | inputJson | String! | | | | scope | ScopeInput! | | |

Returns: DecisionPreview!

dsarRequest

dsarRequest(id: ID!): DsarRequest

One data-subject request's status by id (GetDsarRequest). Tenancy from the JWT; the id is RLS-scoped by AP00005 (a cross-tenant / unknown id → null). Fails closed to OSY-EUCOMPLIANCE-NOT-WIRED when unwired.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: DsarRequest

dsarRequests

dsarRequests(filter: DsarFilter, first: Int, after: String): DsarConnection!

The DSAR intake queue (data-subject requests), newest first. Tenancy from the JWT (no workspace arg); the rows are RLS-scoped by AP00005. Fails closed to OSY-EUCOMPLIANCE-NOT-WIRED when the edge is unwired / the deployed audit-svc predates ComplianceDsarService / DSAR is disabled server-side — never a fabricated request. A malformed filter / cursor is a client-actionable validation error.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | after | String | | | | filter | DsarFilter | | | | first | Int | | |

Returns: DsarConnection!

eligibleDefaultProviders

eligibleDefaultProviders(workspaceId: ID!, model: String!): [EligibleDefaultProvider!]!

Providers eligible to be set as the default for model, ORDERED ALPHABETICALLY BY PROVIDER SLUG (FROZEN, price-neutral — §4.4.5: the server orders, the edge preserves it and NEVER re-sorts). An unknown model surfaces OSY-VALID-4042 verbatim. Requires: osyra:billing:*:read.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | model | String! | | | | workspaceId | ID! | | |

Returns: [EligibleDefaultProvider!]!

erasureFulfilment

erasureFulfilment(dsarId: ID!): ErasureFulfilment

The persisted Art-17 Erasure Fulfilment Record read-model for a FULFILLED erasure (ENG-2998 — GetErasureFulfilment): the console renders it AFTER the destructive ceremony. Tenancy from the JWT; dsarId is RLS-scoped by AP00005. A pure idempotent READ that RE-ASSEMBLES the EFR from the persisted dsar_request + erasure_surface_result rows — a cross-tenant / unknown id, a non-erasure request, or a not-yet-fulfilled erasure → null (never a fabricated EFR). Fails closed to OSY-EUCOMPLIANCE-NOT-WIRED when the edge is unwired / the deployed audit-svc predates GetErasureFulfilment / DSAR is disabled server-side.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | dsarId | ID! | | |

Returns: ErasureFulfilment

estimateCost

estimateCost(input: EstimateCostInput!): CostEstimate!

Pre-flight cost estimate for a completion request WITHOUT invoking the model (ENG-3042 — wires AP00006-model-broker's EstimateCost RPC, live server-side since ENG-2147: policy-gated on llm:EstimateCost + tenant- audited; consumes NO quota — it is a read).

Workspace is derived from the JWT (never from input); the resolver rejects tokens lacking the workspace_id claim (defense-in-depth, mirrors routingDecision SEC-H1). Edge-side structural limits (defense-in-depth; broker is the authoritative cap): total message content ≤ 64 KiB, systemPrompt ≤ 16 KiB, model ≤ 256 B.

A broker that does not serve the RPC (deploy-skew) returns OSY-BROKER-NOT-WIRED (→ <FallbackBanner kind="not-wired">).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | input | EstimateCostInput! | | |

Returns: CostEstimate!

eventSubscriptions

eventSubscriptions: [EventSubscription!]!

The caller's org's outbound event subscriptions. Registry rows are never deleted — disabled rows are returned with enabled=false.

Returns: [EventSubscription!]!

getPolicy

getPolicy(scope: ScopeInput!, policyId: String!): Policy

Fetch one policy source document by id (scoped to the caller's JWT scope).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | policyId | String! | | | | scope | ScopeInput! | | |

Returns: Policy

impersonationOp

impersonationOp(opId: String!): ImpersonationOp

The privileged-op status for an opId (operator console). Returns the fail-closed code until a sanctioned admin transport exists (ADR-359); never a fabricated op.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | opId | String! | | |

Returns: ImpersonationOp

invoice

invoice(id: ID!): Invoice

Get a specific invoice by ID Requires: billing:read permission

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: Invoice

invoices

invoices(organizationId: ID!, limit: Int = 20, offset: Int = 0): InvoiceConnection!

List invoices for an organization Requires: billing:read permission

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | limit | Int | 20 | | | offset | Int | 0 | | | organizationId | ID! | | |

Returns: InvoiceConnection!

listBundleVersions

listBundleVersions(scope: ScopeInput!): BundleVersionList!

List the bundle version history + active version at the JWT-derived scope.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | scope | ScopeInput! | | |

Returns: BundleVersionList!

listPolicies

listPolicies(scope: ScopeInput!, pageSize: Int, pageToken: String): PolicyConnection!

List policy source documents at the JWT-derived scope. pageSize clamped to [1, 100] (default 50); pageToken is opaque.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | pageSize | Int | | | | pageToken | String | | | | scope | ScopeInput! | | |

Returns: PolicyConnection!

loopRecurrences

loopRecurrences(pageSize: Int, minRecurrenceCount: Int): LoopRecurrencesPage!

The OBCA RunFingerprint recurrence-DETECTION rows for the caller's workspace, ordered most-recurrent first (ties broken by most-recently-seen). DETECTION-only; nothing here gates spend (ADR-301 §5). minRecurrenceCount optionally filters to rows that have recurred at least this many times (a fleet operator typically watches >= 2, an actual recurrence with rho > 0).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | minRecurrenceCount | Int | | | | pageSize | Int | | |

Returns: LoopRecurrencesPage!

me

me: User!

Current authenticated user

Returns: User!

memoryEvents

memoryEvents(since: String, kind: String, actor: String, claimKeyPrefix: String, limit: Int, cursor: String): MemoryEventsPage!

Paginated memory-engine event feed scoped to the caller's workspace (workspace_id derived from JWT, never from input — defense-in-depth per ENG-777 SEC-H1 pattern; mirrors auditEvents at audit.graphql:60-81).

Filters: since (ISO-8601 UTC, exclusive lower bound), kind (exact match against MemoryEventKind), actor (exact), claimKeyPrefix (prefix match on the osyra.claim key). All optional. Unknown filter values are silently ignored (forward-compat). kind is typed String, not MemoryEventKind, so a future enum value from a newer frontend doesn't fail GraphQL parsing here.

limit is clamped to [1, 200]; default 50.

Returns OSY-OSYMEM-NOT-WIRED until AP00011-osymem ships the MemoryEvents query RPC (read surface not yet wired).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | actor | String | | | | claimKeyPrefix | String | | | | cursor | String | | | | kind | String | | | | limit | Int | | | | since | String | | |

Returns: MemoryEventsPage!

models

models(workspaceId: ID!): [Model!]!

List available models for the workspace

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | workspaceId | ID! | | |

Returns: [Model!]!

oadrAdmissionReceipt

oadrAdmissionReceipt(id: ID!): OadrAdmissionReceipt

Fetch a persisted OADR admission receipt by lowercase-hex CTI, scoped to the caller's workspace (JWT-derived; NO ws argument). Returns null when the receipt is not visible in the caller's workspace scope (RLS-filtered or genuinely absent — both surface as null so cross-tenant existence cannot be probed). The signed envelope is returned for export + independent verification, alongside the authoritative AP00016-recomputed verdict.

Returns OSY-OADR-NOT-WIRED until VIR_SERVICE_ADDR is configured (dev path).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: OadrAdmissionReceipt

oadrReceiptMlBom

oadrReceiptMlBom(cti: ID!): MlBomDownload

Project the CycloneDX-1.7 ML-BOM from a PERSISTED, already-verified receipt by lowercase-hex CTI (ENG-2652) — the nonce-free sibling of the downloadMlBom mutation. The client presents NO fresh envelope, so no single-use eat_nonce is at stake: it is a genuine side-effect-free READ (hence a query, not a mutation), and verify / download-ML-BOM are no longer mutually exclusive on one envelope — "Download ML-BOM" works on any persisted receipt independent of the verify action.

The edge composes GetReceipt(cti) → GetMlBom(stored encoded_cbor) inside the frozen wire contract; the workspace is JWT-derived (NO ws argument — this must not become a cross-tenant existence oracle). Returns null when the receipt is not visible in the caller's workspace scope (RLS-filtered or genuinely absent — both null). FAIL-CLOSED: a projection reject (e.g. the persisted receipt's disclosure not yet resolvable server-side — the AP00016 half of ENG-2652) surfaces as accepted=false + null mlBomB64 + the AP00016 reason; NEVER a hollow regulator artifact (NO STUBS).

Returns OSY-OADR-NOT-WIRED until VIR_SERVICE_ADDR is configured (dev path).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | cti | ID! | | |

Returns: MlBomDownload

oadrReceipts

oadrReceipts(first: Int, after: String): OadrReceiptPage!

Paginated, newest-first oadr.v1 admission-receipt summaries scoped to the caller's workspace (ENG-2651) — the browse-by-list projection for the supply-chain console (the FE drops its paste-a-cti-only affordance on this path). SUMMARY-ONLY: rows carry the decoded mint-time views (cti / emittedAtMs / subject / contentHashHex / signer), never the signed wire — the full envelope + the authoritative re-verified verdict come from oadrAdmissionReceipt(cti).

Tenant isolation: the workspace is JWT-derived (ctxkeys.WorkspaceID) and there is intentionally NO ws argument — this list must never become a cross-tenant existence oracle. after is an opaque cursor from a prior nextPageToken and carries NO AUTHORITY (AP00016 re-scopes every page by req.Ws server-side). first is clamped server-side by AP00016; omit for the server default.

Returns OSY-OADR-NOT-WIRED until VIR_SERVICE_ADDR is configured (dev path) — the FE keeps its sanctioned supply-chain FallbackBanner on this code.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | after | String | | | | first | Int | | |

Returns: OadrReceiptPage!

ocarTrustConfig

ocarTrustConfig: OcarTrustConfig

The APPLIED OCAR trust config for the caller's (JWT-derived) workspace. Null when none has ever been set. Returns OSY-OCAR-CONFIG-NOT-WIRED until VIR_SERVICE_ADDR is set.

Returns: OcarTrustConfig

ocnpRevokedLeases

ocnpRevokedLeases: OcnpRevokedLeaseConnection!

The workspace's CURRENTLY-REVOKED OCNP lease set (JWT-derived workspace; NO ws argument), read from the authoritative VC-Status feed the Admit gate consults. This is the one enumerable per-workspace lease source — active (non-revoked) leases have no list-source (per-request in-band CN-CBC envelopes) so the console FallbackBanners the active view.

Returns OSY-OCNP-NOT-WIRED until the OCNP gate is enabled and the ENG-2490 revoker is wired (dev path).

Returns: OcnpRevokedLeaseConnection!

oirTrustAnchors

oirTrustAnchors: OirTrustAnchors!

Publish the OIR trust anchors for offline receipt verification. Requires authentication; the anchors are global (not workspace-scoped). Proxies the AP00016 GetOirTrustAnchors RPC.

Returns: OirTrustAnchors!

orgQuotaStatus

orgQuotaStatus: OrgQuotaStatus!

Get current organization quota status Returns usage for workspaces, users, and API requests Requires: Authenticated user with org context

Returns: OrgQuotaStatus!

organization

organization(id: ID!): Organization

Organization queries

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: Organization

organizations

organizations: [Organization!]!

Returns: [Organization!]!

otccCertificate

otccCertificate(id: ID!): OtccCertificate

Fetch a persisted OTCC certificate by lowercase-hex CTI, scoped to the caller's workspace (JWT-derived; NO ws argument). Returns null when not visible in the caller's scope (RLS-filtered or absent — both null so cross-tenant existence cannot be probed). Returns the signed envelope + the authoritative re-verified verdict.

Returns OSY-OTCC-NOT-WIRED until the AP00011-ome VerifyTokenCapital RPC (ENG-2524) is published and an OMEClient is wired (dev path / current state).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: OtccCertificate

otccCorpusBundle

otccCorpusBundle(id: ID!): OtccCorpusBundle

Export the .ome corpus bundle for a certificate (the signed osyra.otcc.{ensemble,member,benchmark} corpus a third party re-derives Δ from). JWT-derived workspace; RLS-scoped. Returns null when the certificate is not visible. NO STUBS — never a fabricated/empty bundle.

Returns OSY-OTCC-NOT-WIRED until ENG-2524 is published + wired.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: OtccCorpusBundle

oterExposure

oterExposure(receiptId: ID!): OterExposureProjection

ENG-2723 / ADR-327 D9 — server-side projection of a signed oter.v1 exposure receipt ("agent saw K of N tools"). Workspace derived from the JWT; the receipt's signed ws claim is additionally pinned to it.

Returns null on not-found (RLS-filtered or genuinely absent — both surface as null so cross-tenant existence cannot be probed). A persisted envelope that fails the strict canonical decode surfaces a generic internal error (backend-data integrity bug, mirroring receipt(id:)'s display-decode handling) — never a partially-fabricated projection.

Returns OSY-VIR-NOT-WIRED until VIR_SERVICE_ADDR is configured (dev path).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | receiptId | ID! | | |

Returns: OterExposureProjection

paymentMethods

paymentMethods(organizationId: ID!): [PaymentMethod!]!

Get payment methods for an organization Requires: billing:read permission

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | organizationId | ID! | | |

Returns: [PaymentMethod!]!

pendingInvitations

pendingInvitations: [PendingInvitation!]!

Pending (not-yet-accepted) invitations for the caller's workspace, resolved from the JWT. Admin-facing (the members screen).

Returns: [PendingInvitation!]!

pmmRecord

pmmRecord(windowId: ID!): PmmrDetail

The disclosure-body drill-down for ONE post-market-monitoring window (GetPmmr). Tenancy from the JWT; windowId is RLS-scoped by AP00005 (a cross-tenant / unknown id → null). Returns null when the window is not a SEALED window carrying a disclosure body — never a fabricated scalar. Fails closed to OSY-EUCOMPLIANCE-NOT-WIRED when the edge is unwired / the deployed audit-svc predates GetPmmr's disclosure fields / PMM is disabled server-side.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | windowId | ID! | | |

Returns: PmmrDetail

pmmWindows

pmmWindows(systemId: ID!, first: Int, after: String): PmmWindowConnection!

The post-market-monitoring reporting windows for one registered high-risk system, newest first. Tenancy from the JWT (no workspace arg); systemId is filtered + RLS-scoped by AP00005. Fails closed to OSY-EUCOMPLIANCE-NOT-WIRED when the edge is unwired / the deployed audit-svc predates ListPmmWindows / PMM is disabled server-side — never a fabricated window.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | after | String | | | | first | Int | | | | systemId | ID! | | |

Returns: PmmWindowConnection!

previewApiKeyBulkRevocation

previewApiKeyBulkRevocation(input: PreviewApiKeyBulkRevocationInput!): ApiKeyBulkRevocationPreview!

Server-derived count, typed confirmation, and operation binding for the exact tenant scope. No tenant identifiers are accepted from the client.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | input | PreviewApiKeyBulkRevocationInput! | | |

Returns: ApiKeyBulkRevocationPreview!

privateEndpoint

privateEndpoint(id: ID!): PrivateEndpoint!

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: PrivateEndpoint!

privateEndpoints

privateEndpoints(status: PrivateEndpointStatus): [PrivateEndpoint!]!

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | status | PrivateEndpointStatus | | |

Returns: [PrivateEndpoint!]!

projectInferenceReceipt

projectInferenceReceipt(oirB64: String!): OirReceiptProjection!

Project an inference OIR receipt's sanitized display fields server-side. Requires authentication. NOT a verdict — the authoritative check is the FE offline verifyOirReceipt under oirTrustAnchors. Fail-closed OSY-OIR-NOT-WIRED when OIR verification is not configured (the verifier/anchors are unwired, so the FE could not verify the projection anyway).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | oirB64 | String! | | |

Returns: OirReceiptProjection!

promptVersionDiff

promptVersionDiff(fromCid: String!, toCid: String!): PromptDiff!

The source diff between two template versions addressed by content hash. A CID not present in the caller's workspace is a clear error (never a fabricated side). Both CIDs are resolved within the JWT-derived workspace.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | fromCid | String! | | | | toCid | String! | | |

Returns: PromptDiff!

promptVersionHistory

promptVersionHistory(workspaceId: ID!, slug: String!): [PromptTemplateVersion!]!

The immutable version history of a template family (by slug) in the caller's JWT-derived workspace, newest semver first. workspaceId is SDL-fidelity only — the resolver sources the workspace from the JWT, NEVER this argument. Empty list when the family has no claims (NO STUBS).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | slug | String! | | | | workspaceId | ID! | | |

Returns: [PromptTemplateVersion!]!

providerCatalog

providerCatalog: [ProviderCatalogEntry!]!

Provider catalog + signed-registry provenance (ENG-2789 / ADR-323). Projects AP00006-model-broker's GetProviderCatalog RPC — a DELIBERATE sibling of GetProviderHealth: health is a runtime-status surface, the catalog carries the registry-provenance projection (normalizer id, registry digest, version, cascade level) the Console's /console/providers view renders alongside health, joining the two lists by providerId.

NO-STUBS honesty contract (ADR-323 D7): registryInfo is PRESENT only when the provider is spec-born (instantiated from a verified signed ProviderSpec bundle). An absent registryInfo honestly means "no signed-registry provenance exists for this provider" (a hand-written adapter or an inert registry) — provenance is NEVER fabricated. registryDigestHex is the lowercase hex of the 32-byte manifest.specs_sha256 verified at boot.

Workspace is derived from the JWT (no input arg); the resolver rejects tokens lacking the workspace_id claim (defense-in-depth, mirrors providerHealth / costSavings SEC-H1). Returns OSY-BROKER-NOT-WIRED (→ <FallbackBanner kind="not-wired">) until the broker implements the GetProviderCatalog RPC.

Returns: [ProviderCatalogEntry!]!

providerHealth

providerHealth: [ProviderHealth!]!

Provider catalog + observed health for the spec-instantiated providers the broker has registered (ARC-61 ProviderSpec). Projects AP00006-model-broker's GetProviderHealth RPC — the Edge does not recompute any metric, it reflects what the broker reports.

TRUST-EDGE CAVEAT (honest, ADR-323): this is the broker's FLEET view of the providers it instantiated from ProviderSpecs and the health it observed — it is NOT a per-request authorization that the caller's workspace policy ALLOWs every listed provider/model. In trust-edge-decision mode the broker delegates per-request policy to the Edge, so the authoritative allow/deny is applied at request time (routingDecision / complete), not here. Treat this as a catalog, not an entitlement.

TENANT-SCOPING CONTRACT (ENG-2699 review): the Edge forwards the caller's WorkspaceContext but cannot verify how the broker uses it — AP00006 MUST tenant-scope the returned fleet to that context, OR the fleet is an intentionally shared/global catalog. (Today the provider fleet is shared; if it ever becomes per-tenant this records the cross-service assumption so a member of workspace A cannot enumerate workspace B's providers here.)

Workspace is derived from the JWT (no input arg); the resolver rejects tokens lacking the workspace_id claim (defense-in-depth, mirrors costSavings SEC-H1). Returns OSY-BROKER-NOT-WIRED (→ <FallbackBanner kind="not-wired">) if the broker has not yet implemented the GetProviderHealth RPC.

Returns: [ProviderHealth!]!

publicPlans

publicPlans: [PublicPlan!]!

PUBLIC + UNAUTHENTICATED (ENG-3124). Projects the enforced plan catalog (billing ListPlans, public plans only). No org/JWT context is read — the same catalog for every caller — so it is safe to expose anonymously (the edge auth + OPA middleware allowlist it exactly like the public resendVerificationEmail mutation). Returns an EMPTY list when the billing catalog is empty — the honest result, never fabricated tiers.

Returns: [PublicPlan!]!

receipt

receipt(id: ID!): Receipt

Single-receipt detail lookup by lowercase hex VIR id. Returns null when the receipt is not visible in the caller's workspace scope (RLS-filtered or genuinely absent — both surface as null so cross-tenant existence cannot be probed). Fetches the signed envelope, decodes it for display, and attaches the authoritative AP00016 verification status.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: Receipt

receipts

receipts(sinceTs: DateTime, untilTs: DateTime, sourceKind: String, pageSize: Int, pageToken: String): ReceiptConnection!

Paginated, newest-first VIR receipts scoped to the caller's workspace (workspace derived from the JWT, never from input — defense-in-depth per ENG-777 SEC-H1; mirrors verifiedMemoryReceipts).

Filters: sinceTs / untilTs (inclusive emitted-at bounds), sourceKind (exact-match; forward-permissive String). pageSize is clamped to [1, 100], default 50. pageToken is opaque (from a prior nextPageToken).

Returns OSY-VIR-NOT-WIRED until VIR_SERVICE_ADDR is configured (dev path).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | pageSize | Int | | | | pageToken | String | | | | sinceTs | DateTime | | | | sourceKind | String | | | | untilTs | DateTime | | |

Returns: ReceiptConnection!

recentActivity

recentActivity(limit: Int): [ActivityEvent!]!

Recent activity for the caller's workspace, newest-first.

Returns ONLY events the Edge gateway genuinely observed and recorded into its Redis-backed capped per-workspace store. Returns an EMPTY list (not an error) when the workspace has no recorded activity yet — the honest result.

Workspace is derived from the JWT (workspace_id claim), NEVER from input. A token lacking the claim is rejected with OSY-VALID-4001 (defense-in-depth, mirrors costSavings / auditEvents).

limit is clamped to [1, 200] (the store cap); default 50.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | limit | Int | | |

Returns: [ActivityEvent!]!

routingDecision

routingDecision(prompt: String!, policy: String!, modelHint: String): RoutingDecision!

Dry-run routing + policy verdict for the Policy Lab playground (ENG-778). Side-effect free: the broker MUST NOT invoke any model or write audit / billing events. Workspace is derived from the JWT; the resolver rejects tokens lacking the workspace_id claim (defense-in-depth, mirrors costSavings SEC-H1).

Edge-side structural limits (defense-in-depth; broker is the authoritative cap): prompt ≤ 64 KiB, policy ≤ 32 KiB, modelHint ≤ 256 B. Empty-string modelHint is normalized to nil (matches a cleared frontend input field).

Returns OSY-BROKER-NOT-WIRED until AP00006-model-broker ships the upstream EstimateRoutingDecision RPC. The frontend's broker-fallback.ts NOT_WIRED_CODES set detects this code and renders <FallbackBanner kind="not-wired">.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | modelHint | String | | | | policy | String! | | | | prompt | String! | | |

Returns: RoutingDecision!

slugAvailability

slugAvailability(slug: String!): SlugAvailabilityResult!

R7 no-existence-oracle availability check for the authenticated caller's own org context. Returns ONLY a uniform boolean (see SlugAvailabilityResult). AUTHED-only.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | slug | String! | | |

Returns: SlugAvailabilityResult!

ssoConfig

ssoConfig: SsoConfig

Returns: SsoConfig

terminationReceipt

terminationReceipt(workflowId: ID!, receiptId: ID): TerminationReceipt

The Agent Termination Receipt for a workflow's termination (GetTerminationReceipt). receiptId optional (the workflow's receipt when absent). Null when none exists (the run was not terminated). Requires workflow:read.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | receiptId | ID | | | | workflowId | ID! | | |

Returns: TerminationReceipt

topModels

topModels(workspaceId: ID, periodStart: String!, periodEnd: String!, limit: Int!): [TopModel!]!

Top models by request volume for a workspace and time window (D2 read-RPC wiring — dashboard "Provider mix" widget).

Sourced from the AUTHORITATIVE usage store (billing's per-model usage breakdown). Workspace defaults to the JWT's workspace_id when null; an explicit workspaceId is honoured but tenant isolation is enforced downstream. periodStart / periodEnd are ISO-8601 strings (frontend contract verbatim — String, not DateTime — so the widget activates without a frontend bump; type unification is a follow-up). limit is clamped to [1, 100].

Returns an EMPTY list when the window has no per-model traffic — that is the honest result, never fabricated rows.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | limit | Int! | | | | periodEnd | String! | | | | periodStart | String! | | | | workspaceId | ID | | |

Returns: [TopModel!]!

topWorkspaces

topWorkspaces(periodStart: String!, periodEnd: String!, limit: Int!): [TopWorkspace!]!

ENG-2072: org-wide top-N workspaces ranked by request volume over a window. Counts/tokens come from the authoritative per-event usage store (billing GetTopWorkspaces); the workspace NAME is resolved from IAM. NO cost (per-workspace cost is deferred to ENG-2075). Org-scoped — ranks the caller's own org only. periodStart/periodEnd are RFC3339 strings. Requires: billing:read permission

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | limit | Int! | | | | periodEnd | String! | | | | periodStart | String! | | |

Returns: [TopWorkspace!]!

traceFeedback

traceFeedback(subjectCid: ID!, subjectKind: TraceSubjectKind!): [TraceFeedbackAnnotation!]!

The latest otfa.v1 annotation per author for (ws, subject) — ws-scoped from the JWT. Each carries its verifiable receipt so the browser re-decides offline (verify-on-read). The "current feedback" view is a projection over the latest signed annotation; the receipt is source-of-truth, the row a rebuildable cache. Empty list when the surface is unwired (honest absence; NO STUBS).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | subjectCid | ID! | | | | subjectKind | TraceSubjectKind! | | |

Returns: [TraceFeedbackAnnotation!]!

usage

usage(workspaceId: ID!, startDate: DateTime, endDate: DateTime): Usage!

Get usage data (ENG-2104). workspaceId is now honored as a real filter: the billing GetUsageMetrics RPC scopes the metrics to that single workspace (derived from the per-event usage store) and the returned Usage.scope is "workspace". The org is JWT-derived; a caller-supplied workspaceId must match the JWT workspace (IDOR guard). per-workspace numbers also ride Usage.byWorkspace. Requires: billing:read permission

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | endDate | DateTime | | | | startDate | DateTime | | | | workspaceId | ID! | | |

Returns: Usage!

usageSavings

usageSavings(workspaceId: ID!, from: DateTime!, to: DateTime!): UsageSavings!

Per-workspace cost-savings: the customer's REAL actual spend vs the gpt-4 baseline over a window. Factual figures only (ENG-1741: no marketing claim).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | from | DateTime! | | | | to | DateTime! | | | | workspaceId | ID! | | |

Returns: UsageSavings!

usageTimeseries

usageTimeseries(workspaceId: ID, startIso: String!, endIso: String!, granularity: UsageGranularity!): UsageTimeseries!

Time-bucketed usage series (request counts, token sums, and an overall cache-hit %) derived from the authoritative per-event usage store. The series carries NO cost — per-bucket cost requires the pricing ADR (ENG-1904) and is deliberately omitted (the dashboard sources cost separately). workspaceId null = all workspaces in the caller's org. Requires: billing:read permission

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | endIso | String! | | | | granularity | UsageGranularity! | | | | startIso | String! | | | | workspaceId | ID | | |

Returns: UsageTimeseries!

user

user(id: ID!): User

User queries (admin only)

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: User

users

users(organizationId: ID!, limit: Int = 50, offset: Int = 0): UserConnection!

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | limit | Int | 50 | | | offset | Int | 0 | | | organizationId | ID! | | |

Returns: UserConnection!

validatePolicy

validatePolicy(scope: ScopeInput!, sourceFormat: PolicySourceFormat!, source: String!): ValidationReport!

Validate/lint a candidate source without persisting it.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | scope | ScopeInput! | | | | source | String! | | | | sourceFormat | PolicySourceFormat! | | |

Returns: ValidationReport!

verifiedMemoryHistogram

verifiedMemoryHistogram(since: String, until: String, purposeDid: String, retrieverDid: String, quarantineClass: String, verdict: String): VerifiedMemoryHistogram!

Server-aggregated histogram of imitation_distance over the filtered receipt set. Same filter shape as verifiedMemoryReceipts (no pagination — aggregate is bounded). P50/P99 budget guidelines for the chart annotations.

Returns OSY-VERIFIED-MEMORY-NOT-WIRED until VM-6.2 wires the OME aggregation RPC.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | purposeDid | String | | | | quarantineClass | String | | | | retrieverDid | String | | | | since | String | | | | until | String | | | | verdict | String | | |

Returns: VerifiedMemoryHistogram!

verifiedMemoryReceipt

verifiedMemoryReceipt(id: ID!): VerifiedMemoryReceiptNode

Single-receipt lookup by lowercase hex SHA-256 of the outer envelope. Returns null if not found (post-VM-6.1 implementation; today returns OSY-VERIFIED-MEMORY-NOT-WIRED). Frontend's detail-pane uses this.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: VerifiedMemoryReceiptNode

verifiedMemoryReceipts

verifiedMemoryReceipts(since: String, until: String, purposeDid: String, retrieverDid: String, quarantineClass: String, verdict: String, limit: Int, cursor: String): VerifiedMemoryReceiptsConnection!

Paginated Verified Memory receipts scoped to the caller's workspace (workspace_id derived from JWT, never from input — defense-in-depth per ENG-777 SEC-H1; mirrors auditEvents at audit.graphql:60-81).

Filters: since / until (ISO-8601), purposeDid / retrieverDid (exact), quarantineClass / verdict (typed String for forward- compat — see precedent comment on memoryEvents). limit is clamped to [1, 200], default 50. cursor is opaque.

Returns OSY-VERIFIED-MEMORY-NOT-WIRED until VM-6.1 wires the OME receipt-store query RPC. The frontend's verified-memory-fallback.ts NOT_WIRED_CODES set classifies this and renders the calm "Dev preview" banner (NOT the scary "schema mismatch" banner).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | cursor | String | | | | limit | Int | | | | purposeDid | String | | | | quarantineClass | String | | | | retrieverDid | String | | | | since | String | | | | until | String | | | | verdict | String | | |

Returns: VerifiedMemoryReceiptsConnection!

virtualKeys

virtualKeys(workspaceId: ID!): [VirtualKey!]!

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | workspaceId | ID! | | |

Returns: [VirtualKey!]!

warehouseDeliveryHealth

warehouseDeliveryHealth(destinationId: ID!): WarehouseDeliveryHealth

One destination's live delivery health (GetWarehouseDeliveryHealth). Tenancy from the JWT; destinationId is RLS-scoped by AP00005 (a cross-tenant / unknown id → null). Fails closed to OSY-WAREHOUSE-NOT-WIRED when unwired.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | destinationId | ID! | | |

Returns: WarehouseDeliveryHealth

warehouseDestinations

warehouseDestinations(first: Int, after: String): WarehouseDestinationConnection!

The tenant's registered warehouse destinations, newest first. Tenancy from the JWT (no workspace arg); the rows are RLS-scoped by AP00005. Fails closed to OSY-WAREHOUSE-NOT-WIRED when the edge is unwired / the deployed audit-svc predates the registry / it is disabled server-side — never a fabricated destination.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | after | String | | | | first | Int | | |

Returns: WarehouseDestinationConnection!

warehouseEgressIdentity

warehouseEgressIdentity: WarehouseEgressIdentity!

The global Osyra egress principal the customer's role trust policy must admit (GetWarehouseEgressIdentity). Not tenant-scoped. Fails closed to OSY-WAREHOUSE-NOT-WIRED when unwired; an unconfigured platform egress identity is a client-actionable precondition error — never a fabricated ARN.

Returns: WarehouseEgressIdentity!

windowReceipts

windowReceipts(window: CoverageWindowInput!): WindowReceipts!

The per-window receipt bundle for the caller's workspace (JWT-scoped) — what a regulator re-verifies offline.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | window | CoverageWindowInput! | | |

Returns: WindowReceipts!

witnessEvents

witnessEvents(since: String, operator: String, signer: String, claimKind: String, verdict: String, limit: Int, cursor: String): WitnessEventsPage!

Paginated Receipt-Lattice witness-events feed scoped to the caller's workspace (workspace_id derived from JWT, NEVER from input — defense-in-depth per the ENG-777 SEC-H1 pattern; mirrors memoryEvents at memory.graphql:63-87).

Filters: since (ISO-8601 UTC, exclusive lower bound), operator (exact), signer (exact), claimKind (exact), verdict (exact; typed String not the enum so a newer FE enum value never fails parsing). All optional; unknown values silently ignored (forward-compat). limit clamped to [1, 200]; default 50.

Wired to AP00011-ome's ListWitnessEvents RPC (ENG-2073). verdict reflects REAL per-row re-verification (tombstone→sealed; signature + content-hash binding→valid/invalid; pre-V12 claim bytes absent→pending). Returns OSY-WITNESS-NOT-WIRED only when AP00011-ome is unreachable / OME disabled / pre-GA.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | claimKind | String | | | | cursor | String | | | | limit | Int | | | | operator | String | | | | signer | String | | | | since | String | | | | verdict | String | | |

Returns: WitnessEventsPage!

workflowPendingApprovals

workflowPendingApprovals(workflowId: ID!, runId: ID): [WorkflowApproval!]!

The pending HITL approvals for a run (QueryWorkflow pendingApprovals). Requires workflow:read. Returns [] when the run has no gates awaiting a decision.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | runId | ID | | | | workflowId | ID! | | |

Returns: [WorkflowApproval!]!

workflowRun

workflowRun(workflowId: ID!, runId: ID): WorkflowRun

A single run's status projection (DescribeWorkflow). runId optional (the latest run of the workflowId when absent). Null when the run is not found. Requires workflow:read.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | runId | ID | | | | workflowId | ID! | | |

Returns: WorkflowRun

workflowRuns

workflowRuns(statusFilter: WorkflowStatus, workflowType: String, limit: Int, cursor: String): WorkflowRunsPage!

Paginated workflow run timeline scoped to the caller's workspace namespace (bound from the JWT, never input). limit clamped to [1, 100]; default 25. Requires the workflow:read scope. Returns OSY-WORKFLOW-NOT-WIRED until WORKFLOW_SERVICE_ADDR is configured (dev path; NO STUBS).

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | cursor | String | | | | limit | Int | | | | statusFilter | WorkflowStatus | | | | workflowType | String | | |

Returns: WorkflowRunsPage!

workspace

workspace(id: ID!): Workspace

Workspace queries

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | id | ID! | | |

Returns: Workspace

workspaceDefaultProviders

workspaceDefaultProviders(workspaceId: ID!, includeHistory: Boolean = false): [WorkspaceDefaultProvider!]!

Open declarations (or full history when includeHistory=true) for the workspace, across models. workspaceId is IDOR-guarded against the JWT workspace. Requires: osyra:billing:*:read.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | includeHistory | Boolean | false | | | workspaceId | ID! | | |

Returns: [WorkspaceDefaultProvider!]!

workspaceSlugAvailability

workspaceSlugAvailability(slug: String!): SlugAvailabilityResult!

ENG-3234 (ADR-368 R7): no-existence-oracle availability check for a WORKSPACE slug in the caller's org. Workspace slugs are unique PER-ORG; IAM derives the org from the JWT context (never a request field). Returns ONLY a uniform boolean (SlugAvailabilityResult, shared with the org slugAvailability query): false for a taken (in-org), reserved, OR invalid slug alike, so a caller cannot enumerate which workspace skeletons exist. AUTHED-only. Unblocks the ENG-3115 editor.

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | slug | String! | | |

Returns: SlugAvailabilityResult!

workspaces

workspaces(organizationId: ID!): [Workspace!]!

Arguments

| Name | Type | Default | Description | | --- | --- | --- | --- | | organizationId | ID! | | |

Returns: [Workspace!]!