{
  "service": "api",
  "name": "PlatPhorm API",
  "policyVersion": "2026-05-19",
  "publicRead": [
    "homepage",
    "API catalog",
    "service catalog",
    "API product catalog",
    "OpenAPI registry",
    "schema registry",
    "event/webhook contract registry",
    "MCP mapping registry",
    "governance",
    "parity",
    "health",
    "docs",
    "recipes",
    "clients",
    "discovery files",
    "well-known policy",
    "read-only MCP introspection"
  ],
  "protectedActions": [
    "registry mutation",
    "OpenAPI import/write/update",
    "schema write/update/delete",
    "protected route proxying",
    "downstream protected API/MCP calls",
    "report generation with sensitive data",
    "SDK publishing",
    "webhook triggering",
    "admin sync jobs",
    "private audit logs",
    "private trace views",
    "token/key issuing or rotation"
  ],
  "authHeaders": [
    "Authorization: Bearer $PLATPHORM_API_KEY",
    "X-PlatPhorm-API-Key: $PLATPHORM_API_KEY"
  ],
  "noFakeData": true,
  "ja4DigestPolicy": "x-vercel-ja4-digest is fingerprint-adjacent metadata. Raw values are hashed or redacted before public display and never emitted into public artifacts.",
  "crawlerUserAgentPolicy": "Exact crawler/user-agent strings are not asserted without current official documentation verification."
}