Platform › Connectivity
Published API
What this company allows to leave it, and who may come and get it. Nothing is reachable from outside until somebody publishes it: one screen, its columns and the rows of it that may travel. Software is then registered, given a key, granted specific exposures and pinned to the addresses it may be used from. The same publication serves a REST API, an OpenAPI document generated per key, and an MCP server for an AI agent.
In Platform → Connectivity · 6 screens
WorkspaceAPI StudioOne board for the whole of the published API: what is exposed, who holds a key, what each key could not actually do, and every call made in the last few days with the reason for each refusal.OpenRecordsExposuresA decision, taken once, that one screen may leave this company — which columns of it, which rows of it, and whether anything may be written back. Nothing is reachable from outside until it is published here, and there is no "publish everything".OpenRecordsAPI ClientsThe outside software that holds a key to this company. Every call it makes runs as a named user here, so nothing it can reach is anything that user could not already reach. The key is shown once when it is issued and never again.OpenRecordsAPI GrantsWhich software may reach which exposure, and with which verbs. Two partners can hold keys to this company and reach entirely different data; withdrawing one changes nothing for the other.OpenRecordsAllowed SoftwareWhere a key may be presented from: a browser origin, a host, an address or a network. A key that requires an allowlist and has no entries reaches nothing — "no addresses named" reads as "not reachable yet", never as "anywhere".OpenRecordsAPI Call LogEvery call made with an API key, allowed or refused, with the reason for each refusal. This is not the audit log — that records what the record actually did, because a published call goes through the ordinary route and the ordinary route audits itself. This records what was asked, from where, and by which key.Open
Columns, fields and actions
| Screen | Kind | What it is | Columns | Fields | Actions |
|---|---|---|---|---|---|
| API Studio | Workspace | One board for the whole of the published API: what is exposed, who holds a key, what each key could not actually do, and every call made in the last few days with the reason for each refusal. | 0 | 0 | 0 |
| Exposures | List | A decision, taken once, that one screen may leave this company — which columns of it, which rows of it, and whether anything may be written back. Nothing is reachable from outside until it is published here, and there is no "publish everything". | 11 | 16 | 0 |
| API Clients | List | The outside software that holds a key to this company. Every call it makes runs as a named user here, so nothing it can reach is anything that user could not already reach. The key is shown once when it is issued and never again. | 14 | 13 | 2 |
| API Grants | List | Which software may reach which exposure, and with which verbs. Two partners can hold keys to this company and reach entirely different data; withdrawing one changes nothing for the other. | 12 | 7 | 0 |
| Allowed Software | List | Where a key may be presented from: a browser origin, a host, an address or a network. A key that requires an allowlist and has no entries reaches nothing — "no addresses named" reads as "not reachable yet", never as "anywhere". | 7 | 5 | 0 |
| API Call Log | List | Every call made with an API key, allowed or refused, with the reason for each refusal. This is not the audit log — that records what the record actually did, because a published call goes through the ordinary route and the ordinary route audits itself. This records what was asked, from where, and by which key. | 14 | 0 | 0 |