Task 1
API authentication
Use a scoped API key and explicit Organization and Workspace context for every request.
Permission boundary
api_keys.manage.organization to create or revoke keysSteps
- 1Create an API key from an authorized Organization context. The plaintext secret is returned only once.
- 2Store the secret outside source control and send it as a Bearer token.
- 3Send the Organization and Workspace slugs explicitly; neither header is authorization proof by itself.
- 4Handle permission_denied separately from validation and service failures.
List Decisions
curl "https://www.decisionlog.ai/api/graphql" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $DECISION_LOG_API_KEY" \
-H "x-decision-log-org: $DECISION_LOG_ORG" \
-H "x-decision-log-workspace: $DECISION_LOG_WORKSPACE" \
--data '{"query":"query Decisions($orgSlug: String!) { decisions(orgSlug: $orgSlug) }","variables":{"orgSlug":"your-org"}}'API key creation and revocation are audited. Rotate a key by creating a replacement and revoking the old key.
Task 2
CLI setup
Run the current CLI from this repository with environment-based credentials and no plaintext credential store.
Steps
- 1Use Node 24, pnpm 10, and the checked-in lockfile.
- 2Set the API base URL, API key, Organization slug, and Workspace slug.
- 3Run whoami to inspect configuration, then invoke a read operation before a write.
Repository-local setup
pnpm install --frozen-lockfile
export DECISION_LOG_GRAPHQL_URL=https://www.decisionlog.ai/api/graphql
export DECISION_LOG_API_KEY=...
export DECISION_LOG_ORG=your-org
export DECISION_LOG_WORKSPACE=product
pnpm decision-log whoami
pnpm decision-log decisions listThe CLI package is currently private and repository-local; no public package or standalone binary is claimed.
Task 3
Resource contracts
Use canonical entity names, error codes, permission boundaries, and append-only semantics across every surface.
Steps
- 1Treat Organization and Workspace as request context, then authorize the Actor independently.
- 2Expect data under the API response envelope and structured error codes for rejected requests.
- 3Use Idempotency-Key for writes and retain the key when safely retrying the same payload.
- 4Do not infer a mutation from a read or silently change Decision meaning.
Public service checks
GET https://www.decisionlog.ai/api/health
GET https://www.decisionlog.ai/api/ready
GET https://www.decisionlog.ai/.well-known/mcp.jsonGraphQL schema source and tests are authoritative for API behavior; these guides describe supported runtime contracts.