System

177 operations on 149 paths.

/api/instance/settings

GETRead instance configuration

Sign-in Session cookie or Bearer tokenMCP tool get_instance_settings

Requires a current admin account through a cookie session or bearer token, rechecked on every call. Responses, including refusals, are private, no-store. Returns every instance and platform definition with its effective value, source, stored value (including a shadowed value), lock and invalid-override state. A non-empty environment variable locks the setting even when invalid; invalid numeric overrides use the default without returning the override text. Empty numeric overrides are absent; a set empty assistant model list retains its default model alone. Environment changes require a restart. Provider keys report set or not set; the encryption key reports environment, data-directory or not-yet-present. Address value and defaultValue expose scheme and host only, never user information, paths, queries or fragments; malformed addresses report set and unreadable. A service address or the satellite tile template an admin stored reads as set with its scheme and host, or as set and unreadable once the instance's encryption key no longer opens it; its storedValue is always null. The satellite tile template in effect, stored or set by DEZFIL_SATELLITE_URL, also reads with userInformation true while it carries a user name or password, which is never given: the imagery is not drawn from such an address. The satellite credit an admin stored reads as stored while DEZFIL_SATELLITE_ATTRIBUTION is unset, and as the variable's, with the stored credit as storedValue, while it is set. The template catalogue's address (templatesCatalogueUrl) reads as a service address does; while DEZFIL_TEMPLATES_CATALOGUE names a folder on this server instead of an http or https address, it reads as set with folder true, and the folder's path is never given. Trusted engine memory (trustedMemoryMb) defaults to 3072 MB and Bytes drawn per layer (renderCapBytes) to 134217728 bytes; both are deployment-controlled and reject writes. Data processing time limit (dataProcessingTimeoutS) defaults to 3600 seconds, accepts stored whole seconds from 60 to 21600, and resets with null. Trusted imports, refreshes, geometry and sketch changes, template installation and export conversion use the Data processing time limit. Trusted work shares the configured memory budget and a dedicated scratch allowance of four times that value; restart clears abandoned spill. Exhaustion answers engine_memory_exceeded, naming memory or scratch and DEZFIL_TRUSTED_MEMORY_MB. Upload reception and processing each use the value admitted when reception begins, with separate deadlines. Layer renders and dataset map features count their complete inline answer against Bytes drawn per layer as it is built; above it a layer takes its tile road or answers the errored layer render_bytes_exceeded, and dataset map features answer ok:false with a reason. Slider, Overture and OpenStreetMap previews and the sketch features read count theirs too and answer 422 render_bytes_exceeded above it. The built-in documentedDefault stays as documented, including any path. Contextual defaults carry a rule when there is no single address or value. The read generates no key, writes no configuration file, contacts no service and initializes no engine. Capacities report admitted geocode rows and travel-time origins per run, without promising a configured provider. Also returns the fixed maximum image dimension, package version, stable process start time and warnings when the effective query timeout is at or above the run timeout. Services report each provider cache (geocode, isochrone, overpass) with the bytes its answers take, how many it holds and its budget in MB, and the Overture release list this process keeps: how many releases, the newest and when it was listed, or not listed yet. Parts report each part of this server, starting nothing and running no program: the query engine's library version, whether the engine has started and the extensions it loaded; whether the tile builder and the image renderer's browser are executable files where their settings point, by a file check, the tile builder's version once this server has run it, and Images at once; the metadata database's file name. basemapStyles is the basemap library, oldest first, hidden styles included: each style's id, name, address, credit, whether it is offered and when it was added.

Responses

• 200

  Success.

  application/json

  InstanceSettings

• 401403503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS, PATCH

Example

Read the instance's settings

Needs an admin's token. On a new instance run from a checkout with DEZFIL_DATA_DIR=/data and PORT=3000.

curlJavaScript

curl

Terminal

curl -s http://localhost:3000/api/instance/settings \
  -H "Authorization: Bearer <YOUR_TOKEN>"

Answers 200 application/json

The answer runs to 2,857 lines, so it is a file of its own: get-api-instance-settings-defaults.json.

PATCHChange instance settings

Sign-in Session cookie or Bearer tokenMCP tool update_instance_settings

At most 65,536 wire bytes; a larger body is refused with request_body_too_large before JSON parsing. Requires a current admin through cookie or bearer authentication, rechecked inside the write transaction on every call. Cookie mutations require the same trusted Origin; an admin bearer token calls directly with no additional scope or approval step. Responses, including refusals, are private, no-store. Submit only editable keys; omitted keys stay unchanged and null clears a stored value. The complete body is validated against the committed configuration under one write lock. A refusal or failed commit changes nothing. Non-editable keys answer 400 invalid_request as read-only regardless of their environment. A non-empty environment variable locks an editable setting, including invalid overrides and null writes. A locked editable key answers 409 setting_locked, taking precedence over 400 invalid_request for unknown, non-editable, wrong-kind, non-whole, out-of-range, over-length or invalid-choice entries, a site list entry that is not http or https with a host and an optional port, a resulting queryTimeoutS at or above operationTimeoutS, a resulting security.failedPerAddress below security.failedPerAccount, and a resulting publishing.embedding of listed with no publishing.embedSites. Messages identify all failing known keys and their reasons, unknown keys by their entry position and a refused site by its position, without echoing arbitrary input. The sign-in counts, and embedding with its sites, are checked when a body changes either side. An existing environment timeout mismatch is reported in warnings and blocks no unrelated change. Concurrent different-key edits both land; the last accepted value wins on one key. There is no stale-write rejection or Undo. Stored changes apply live to new work; admitted work keeps its budget. Lowered concurrency cancels nothing, increased concurrency wakes waiters after commit, and lowered queue limits keep accepted waiters. Public limits apply against the existing window count. Environment changes need a restart. Returns the same configuration as the read, with the same secret and address disclosure rules. No secret is accepted. The four service addresses (geocoderUrl, isochroneUrl, overpassUrl, s3Endpoint), the satellite imagery's tile template (satelliteUrl) and the template catalogue's address (templatesCatalogueUrl) are write-only: each is stored encrypted and read back as its scheme and host alone; a refusal names the key and never repeats the address. The catalogue's address is http or https here: a folder on the server is named by DEZFIL_TEMPLATES_CATALOGUE alone. The template must also hold {z}, {x} and {y}, a refusal naming the ones missing, and carry no user name or password, refused before any lookup with a sentence saying the imagery is not drawn from such an address and the key belongs in the path or the query. Before the write, an address is also refused (400 invalid_request, with the egress policy's own sentence) when that policy would refuse a request to it now, a template with each placeholder filled with a digit: a literal in loopback, private, carrier-grade, link-local or metadata, unique-local, unspecified, multicast or reserved space, mapped and NAT64 forms included, or a name all of whose addresses resolve there, unless DEZFIL_EGRESS_ALLOWLIST names it. A name that does not resolve at save is kept; every request to the address is checked again. The embedded assistant asks for confirmation before calling on pages admitting writes; SQL and workflow assistants refuse this update. MCP advertises that policy and adds no confirmation step.

Request body

At most 65,536 bytes (64 KiB); a larger body is refused with request_body_too_large.

application/json

InstanceSettingsPatch

Responses

• 200

  Success.

  application/json

  InstanceSettings

• 400401403409413500503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS, PATCH

Example

Show 2,000 rows in results

Needs an admin's token. previewRows is the key of Rows shown in results; the answer is every setting, as reading them answers, with the new value stored.

curlJavaScript

curl

Terminal

curl -s -X PATCH http://localhost:3000/api/instance/settings \
  -H "Authorization: Bearer <YOUR_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"previewRows": 2000}'

Answers 200 application/json

The answer runs to 2,857 lines, so it is a file of its own: patch-api-instance-settings-preview-rows.json.

• HEADRead response headers

  Sign-in Session cookie or Bearer tokenAnswers 200, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS, PATCH

  Automatic HEAD uses GET with no response body.

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS, PATCH

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/instance/caches

DELETEClear service caches

Sign-in Session cookie or Bearer tokenMCP tool clear_service_caches

Requires a current admin through cookie or bearer authentication, rechecked on every call. Cookie requests require the same trusted Origin; an admin bearer token calls directly. Responses, including refusals, are private, no-store. Removes cached answers only: with service, that one cache (geocode for the address finder, isochrone for travel time, overpass for OpenStreetMap); without it, all three. Settings, datasets, runs and the Overture release list are unchanged. An answer whose request began before the Clear is not kept, and a write already landing is waited for and then removed. Clearing an empty cache answers the same. Answers with the caches cleared. The embedded assistant asks for confirmation before calling on pages admitting writes; SQL and workflow assistants refuse this operation. MCP advertises that policy and adds no confirmation step.

Parameters

• serviceQuery

  The one cache to clear; omitted, all three.

  string

  One of geocode, isochrone, overpass

Responses

• 200

  Success.

  application/json

  ClearedServiceCaches

• 400401403503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways DELETE, OPTIONS

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow DELETE, OPTIONS

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/instance/services/{service}/test

POSTTest a service

Sign-in Session cookie or Bearer tokenMCP tool test_service

Requires a current admin through cookie or bearer authentication, rechecked on every call. Cookie requests require the same trusted Origin; an admin bearer token calls directly. Responses, including refusals, are private, no-store. Sends the service one fixed request at its address in effect, never one given here: geocode (the address finder) one search for a fixed place, isochrone (travel time) one area on foot round a fixed point for the shortest band, overpass (OpenStreetMap) the smallest Overpass query, overture a listing of the releases, s3 one request to the S3 address's root without credentials, satellite one fixed low-zoom tile (zoom 3, x 4, y 2) at the imagery's tile template within 10 seconds, passing when the answer is an image (a template carrying a user name or password is refused, with the sentence a save refuses it with, and nothing is sent), templates the template catalogue's index, read as a refresh reads it within the link import's time bound (DEZFIL_REMOTE_TIMEOUT_S), or from the folder DEZFIL_TEMPLATES_CATALOGUE names, passing with how many templates it lists, an index this server would refuse being unexpected_answer. It goes the way the service's own requests go: through the egress check, redirects included, and after the gap between requests for the address finder and travel time. It reaches outside this server and stores nothing: no setting changes and no cache is read or written, except that the Overture Test keeps the release list it finds, as Check now does. A second Test of a service while one runs gets the same answer from the same request. A stored address the instance's key no longer opens is refused with service_address_unreadable, as the service refuses it. While an admin has turned the template catalogue off (templates.catalogue), its Test is refused with 409 templates_catalogue_off and sends nothing. The embedded assistant asks for confirmation before calling; SQL and workflow assistants refuse this operation. MCP advertises that policy and adds no confirmation step.

Parameters

• servicePathrequired

  The service to test: geocode, isochrone, overpass, overture, s3, satellite (the imagery's tile template) or templates (the template catalogue).

  string

  One of geocode, isochrone, overpass, overture, s3, satellite, templates

Responses

• 200

  Success.

  application/json

  ServiceTestAnswer

• 400401403404409503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways OPTIONS, POST

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow OPTIONS, POST

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/instance/storage

GETRead how the data folder is used

Sign-in Session cookie or Bearer tokenMCP tool read_storage

Requires a current admin through cookie or bearer authentication, rechecked on every call. A cookie request must show it comes from this instance's own page, by an Origin that is this instance's, Sec-Fetch-Site same-origin or the X-Dezfil-Account header its pages send; one with none of them, or with another origin's Origin or a cross-site or same-site Sec-Fetch-Site, is refused. An admin bearer token calls directly. Responses, including refusals, are private, no-store. Walks the data folder and answers, for each kind of file, the bytes its files take and how many there are: tables (dataset files the metadata registers), tile_archives (archives with a tile record and what they were built from), service_caches (the three caches' answers), thumbnails (map card images), profile_pictures (each person's current picture), templates (downloaded templates, and the copies of an installed template's data the query engine reads), metadata_database (the database and its journal files), leftover_files (what the next restart's sweeps would remove: upload, download and tile scratch, staged project exports with their ownership records, table files no dataset or installed template uses, archives no layer uses, unfinished thumbnail writes, pictures that are no one's current picture; it includes work in progress) and other (the rest, such as the key file and the server's records); with every kind together and the free and total space on the folder's volume. Each file counts once, however many names it has. It takes names and sizes, which files the metadata references and which the installed templates' records name, opening no other file and following no link, and answers no name, owner, account, map, dataset, path or file name. One walk runs at a time: a read during a walk gets that walk's answer, and a read within 30 seconds of it gets the same answer, unless a service cache was cleared since the walk began: a Clear ends a walk under way at once, the reads already joined to it getting what it had counted, and a read after the Clear never gets a walk begun before it but joins one fresh walk. Every read's deadline is 10 seconds from its asking: the walk that answers it cuts every filesystem call and the disk's statistics by then and stops the reference read at the first of its slices of 200 rows to end past it. A walk stopped by its deadline or ended by a Clear gives each kind it had not finished as at least what it counted, finished false, and the disk as null when its statistics had not come. It changes nothing and sends nothing outside this server. The embedded assistant asks for confirmation before calling; SQL and workflow assistants refuse this operation. MCP advertises that policy and adds no confirmation step.

Responses

• 200

  Success.

  application/json

  StorageRead

• 401403503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS

• HEADRead response headers

  Sign-in Session cookie or Bearer tokenAnswers 200, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic HEAD uses GET with no response body.

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/instance/parts/{part}/test

POSTTest a part of this server

Sign-in Session cookie or Bearer tokenMCP tool test_part

Requires a current admin through cookie or bearer authentication, rechecked on every call. Cookie requests require the same trusted Origin; an admin bearer token calls directly. Responses, including refusals, are private, no-store. Runs one small fixed check on one part of this server as it is configured now, never one given here: data_folder writes and removes one empty file in the data folder, as the readiness check does, within 5 seconds; query_engine asks the engine that runs people's SQL one fixed spatial question with a known answer within 30 seconds, interrupting it a second before them, and starts a cold engine for it loading only the extensions already installed: it installs nothing, so without the spatial extension it answers not_found and leaves the engine for the next query to start, and a missing optional extension stays off until the next start; tile_builder asks the tile builder for its version, then builds a small archive from a few fixed points in a folder of its own under the tile scratch and removes it, within 30 seconds, beside any layer build, neither waiting behind one nor holding one up; a tile builder still running 3 seconds before the limit is asked to stop, ended outright if it has not 2 seconds later, and its folder removed once it is gone, all within the 30 seconds; image_renderer has the image renderer's browser photograph a small fixed picture of this server's own, from no map or data, and reads its mark's color back, within 10 seconds, only on an image slot free now with no image waiting: otherwise it answers busy at once, launching nothing, and an image asked while it runs waits for it as behind any image; its browser is closed, or ended, within those 10 seconds, and only then is its slot free again; metadata_database takes the metadata database's write lock, reads the schema's version and gives the lock back, writing nothing, answering busy when other work holds the lock past the database's 5-second wait. It changes no setting, leaves no file and sends nothing outside this server. A second Test of a part asked while one runs, its part's work still ending included, gets that run's answer. The embedded assistant asks for confirmation before calling; SQL and workflow assistants refuse this operation. MCP advertises that policy and adds no confirmation step.

Parameters

• partPathrequired

  The part to test: data_folder or query_engine or tile_builder or image_renderer or metadata_database.

  string

  One of data_folder, query_engine, tile_builder, image_renderer, metadata_database

Responses

• 200

  Success.

  application/json

  PartTestAnswer

• 400401403404503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways OPTIONS, POST

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow OPTIONS, POST

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/instance/basemaps

POSTAdd a style to the basemap library

Sign-in Session cookie or Bearer tokenMCP tool add_basemap_style

At most 65,536 wire bytes; a larger body is refused with request_body_too_large before JSON parsing. Requires a current admin through cookie or bearer authentication, rechecked inside the write on every call. Cookie requests require the same trusted Origin; an admin bearer token calls directly. Responses, including refusals, are private, no-store. Adds a MapLibre style by its address, for everyone choosing a basemap: the builder's picker lists it after the built-in styles, and a map that takes it keeps its own copy of the name, the address and the credit. The server reads the address once, now: first the egress policy's own check, so an address in loopback, private, link-local, metadata or other blocked space, or a name all of whose addresses resolve there, is refused with that check's sentence before anything is sent, unless DEZFIL_EGRESS_ALLOWLIST names it; then one request through the egress-governed client, redirects included, within 8 seconds and 2 MB. A valid style is kept with its sources' credit, else its host. Refused with 400 invalid_request, nothing kept: a name outside 1 to 60 characters, an address that is not http or https with a host or is longer than 2,048 characters, an address the library already holds, a 51st style, an answer that is not a MapLibre style, and a style that cannot be read now: there is no force, because an offered style must draw in the server's images too. No refusal repeats the address. Nothing reads the address again: no schedule and no recheck. Its address is public to whoever draws a map on it, published readers included. The embedded assistant asks for confirmation before calling on pages admitting writes; SQL and workflow assistants refuse this operation. MCP advertises that policy and adds no confirmation step.

Request body

At most 65,536 bytes (64 KiB); a larger body is refused with request_body_too_large.

application/json

LibraryStyleAdd

Responses

• 201

  Added.

  application/json

  LibraryStyle

• 400401403413503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways OPTIONS, POST

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow OPTIONS, POST

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/instance/basemaps/{id}

PATCHOffer or hide a library style

Sign-in Session cookie or Bearer tokenMCP tool set_basemap_style_offered

At most 65,536 wire bytes; a larger body is refused with request_body_too_large before JSON parsing. Requires a current admin through cookie or bearer authentication, rechecked inside the write on every call. Cookie requests require the same trusted Origin; an admin bearer token calls directly. Responses, including refusals, are private, no-store. Sets whether an added style is offered where a basemap is chosen. Hidden, it leaves the builder's picker and the runtime configuration; maps that took it keep their copy and draw it. Answers the style as it is now; an unknown id answers 404 not_found. The embedded assistant asks for confirmation before calling on pages admitting writes; SQL and workflow assistants refuse this operation. MCP advertises that policy and adds no confirmation step.

Parameters

• idPathrequired

  The style's identity in the library.

  string

Request body

At most 65,536 bytes (64 KiB); a larger body is refused with request_body_too_large.

application/json

LibraryStyleOffered

Responses

• 200

  Success.

  application/json

  LibraryStyle

• 400401403404413503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways DELETE, OPTIONS, PATCH

DELETERemove a library style

Sign-in Session cookie or Bearer tokenMCP tool remove_basemap_style

Requires a current admin through cookie or bearer authentication, rechecked inside the write on every call. Cookie requests require the same trusted Origin; an admin bearer token calls directly. Responses, including refusals, are private, no-store. Removes an added style from the library. Maps that took it keep their copy of its name, address and credit and keep drawing it; nothing else changes. An unknown id answers 404 not_found. The embedded assistant asks for confirmation before calling on pages admitting writes; SQL and workflow assistants refuse this operation. MCP advertises that policy and adds no confirmation step.

Parameters

• idPathrequired

  The style's identity in the library.

  string

Responses

• 200

  Success.

  application/json

  LibraryStyleRemoved

• 401403404503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways DELETE, OPTIONS, PATCH

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow DELETE, OPTIONS, PATCH

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/health

GETReadiness check

Sign-in No sign-inMCP tool check_health

Readiness reports whether socket provenance is installed, the data directory is usable, and, once a query has started the query engine that runs SQL, whether that engine can serve. Readiness starts no engine before a query does. A started engine is asked a trivial statement on its own connection, not behind any account's queries: a statement that fails reads unready, and one with no answer within 2 seconds reads ready, since a busy engine is not a dead one. An engine whose last start failed reads unready, and readiness starts it again at most once every 30 seconds, so an instance taken out of rotation recovers once the cause clears. Unready, the reason names storage or the query engine, never a path or the engine's own words.

Responses

• 200

  Ready.

  application/json

  Health

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS

• 503

  The ingress preload, storage or the query engine is unavailable.

  application/json

  HealthUnready

• default

  Error with a machine-readable code and human message.

  application/json

  Error

Example

Check that the instance is ready

Needs nothing: the check takes no sign-in.

curlJavaScript

curl

Terminal

curl -s http://localhost:3000/api/health

Answers 200 application/json

Response

{
  "status": "ready"
}

• HEADRead response headers

  Sign-in No sign-inAnswers 200, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic HEAD uses GET with no response body.

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/config

GETRuntime client configuration

Sign-in Session cookie or Bearer tokenMCP tool get_config

Instance-wide basemaps, built-in palettes, client limits, the defaults new maps, layers and screens start with, whether the template catalogue is in use, the rules every account follows and the shortest password, shared by every authenticated account. Includes deployment-configured basemap choices and provider availability, never server-side AI or geocoder credentials. Private, no-store.

Responses

• 200

  Success.

  application/json

  Config

• 401403503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS

Example

Read the values in effect

Needs a token. On a new instance, with its palettes trimmed to two of the twenty-three.

curlJavaScript

curl

Terminal

curl -s http://localhost:3000/api/config \
  -H "Authorization: Bearer <YOUR_TOKEN>"

Answers 200 application/json

Response

{
  "basemapUrl": "https://tiles.openfreemap.org/styles/dark",
  "basemapOverrideUrl": null,
  "basemaps": [
    {
      "key": "dark",
      "label": "Dark",
      "url": "https://tiles.openfreemap.org/styles/dark",
      "kind": "vector",
      "attribution": [
        {
          "label": "© OpenMapTiles",
          "href": "https://openmaptiles.org"
        },
        {
          "label": "© OpenStreetMap",
          "href": "https://www.openstreetmap.org/copyright"
        }
      ]
    },
    {
      "key": "light",
      "label": "Light",
      "url": "https://tiles.openfreemap.org/styles/positron",
      "kind": "vector",
      "attribution": [
        {
          "label": "© OpenMapTiles",
          "href": "https://openmaptiles.org"
        },
        {
          "label": "© OpenStreetMap",
          "href": "https://www.openstreetmap.org/copyright"
        }
      ]
    },
    {
      "key": "streets",
      "label": "Streets",
      "url": "https://tiles.openfreemap.org/styles/liberty",
      "kind": "vector",
      "attribution": [
        {
          "label": "© OpenMapTiles",
          "href": "https://openmaptiles.org"
        },
        {
          "label": "© OpenStreetMap",
          "href": "https://www.openstreetmap.org/copyright"
        }
      ]
    }
  ],
  "basemapStyles": [],
  "singleMapStyles": true,
  "palettes": [
    {
      "name": "sunrise",
      "label": "Sunrise",
      "kind": "sequential",
      "group": "sequential",
      "colorblindSafe": false,
      "colors": [
        "#355C7D",
        "#C06C84",
        "#F8B195"
      ]
    },
    {
      "name": "bold",
      "label": "Bold",
      "kind": "categorical",
      "group": "qualitative",
      "colorblindSafe": false,
      "colors": [
        "#7f3c8d",
        "#11a579",
        "#3969ac",
        "#f2b701",
        "#e73f74",
        "#80ba5a",
        "#e68310",
        "#008695",
        "#cf1c90",
        "#f97b72"
      ]
    }
  ],
  "renderCapFeatures": 250000,
  "previewRows": 1000,
  "geocoderConfigured": false,
  "defaults": {
    "newMap.basemap": "auto",
    "newMap.latitude": 40,
    "newMap.longitude": 0,
    "newMap.zoom": 1.3,
    "newMap.legendCorner": "bottom-left",
    "newLayer.colorCycle": "uber_viz_qualitative",
    "newLayer.pointOpacity": 72,
    "newLayer.lineOpacity": 95,
    "newLayer.areaOpacity": 50,
    "newLayer.lineWidth": 2,
    "newLayer.pointRadius": 3,
    "canvas.opens": "full",
    "canvas.minimap": "auto",
    "canvas.resultsBand": "closed",
    "sqlConsole.textSize": "12",
    "sqlConsole.lineWrap": false,
    "imageExport.width": "1920",
    "imageExport.shape": "4:3"
  },
  "templates": {
    "catalogue": true
  },
  "rules": {
    "tokens.create": "everyone",
    "tokens.expiry": "never",
    "publishing.publish": "everyone",
    "publishing.embedding": "any",
    "connections.create": "everyone",
    "imports.links": "everyone"
  },
  "passwordMin": 8
}

• HEADRead response headers

  Sign-in Session cookie or Bearer tokenAnswers 200, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic HEAD uses GET with no response body.

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/basemaps/satellite

GETThe configured imagery style

Sign-in Session cookie or Bearer token

A MapLibre style document for the imagery this instance configures, with the provider's credit. Its raster source names this instance's own tile address, /api/basemaps/satellite/tiles/{z}/{x}/{y}{ratio}, never the configured tile template: the server fetches each tile from the template, so the template and a key in it never leave the server. It answers signed-in accounts only; an anonymous request is refused. No imagery ships with the app, so an instance that configures none answers 404 and offers no imagery basemap, as does one whose tile template carries a user name or password. A stored template the instance's key no longer opens is refused with service_address_unreadable, never answered with another style. A published page's reader has the publication's own style address. Private, no-store.

Responses

• 200

  The style document.

  application/json

  object

• 400401403503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 404

  No imagery is configured.

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS

• HEADRead response headers

  Sign-in Session cookie or Bearer tokenAnswers 200, 400, 401, 403, 404, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic HEAD uses GET with no response body.

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/basemaps/satellite/tiles/{z}/{x}/{y}

GETOne tile of the configured imagery

Sign-in Session cookie or Bearer token

Fetched now by the server from the tile template this instance configures and passed back, so the template and a key in it never leave the server. Use the tile address the imagery style names. Only the tile's z, x and y reach the template, each a whole number in plain decimal, z from 0 to 19 and x and y below 2 to the power of z, the row followed by @2x for a high-density tile or by nothing; anything else is refused with invalid_request before the imagery is asked. The template is filled from these alone as MapLibre fills a raster template: {z}, {x}, {y} (counted by the style source's scheme), {ratio} (@2x or nothing), {quadkey}, {prefix} and {bbox-epsg-3857}. No query, header or credential of the request goes with them. The fetch takes the egress policy at every hop, waits at most ten seconds and reads at most 4 MiB; only a whole PNG, JPEG, GIF, WebP or AVIF image passes back, with the type its bytes are, and no tile is stored. Every failure upstream answers imagery_unavailable, whose message says what went wrong and never the tile address or its key; a template carrying a user name or password is not drawn and answers the same. Private, no-store. An instance that configures no imagery answers 404 as the style does; a stored template the instance's key no longer opens is refused with service_address_unreadable. Signed-in accounts only; an anonymous request is refused and asks the imagery nothing. A published page's reader has the publication's own tile address.

Parameters

• zPathrequired

  Tile zoom, 0 to 19.

  string

• xPathrequired

  Tile column, below 2 to the power of z.

  string

• yPathrequired

  Tile row, below 2 to the power of z, followed by @2x for a high-density tile.

  string

Responses

• 200

  The tile, as the imagery drew it.

  image/png

  stringformat binary

  image/jpeg

  stringformat binary

  image/gif

  stringformat binary

  image/webp

  stringformat binary

  image/avif

  stringformat binary

• 400401403503504default

  Error with a machine-readable code and human message.

  application/json

  Error

• 404

  No imagery is configured.

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS

• 502

  imagery_unavailable: the imagery failed, or this instance's egress policy refused its address.

  application/json

  Error

  • X-Dezfil-Egress-RefusedHeader

    imagery where the egress policy refused the imagery's address, at its host or at a redirect; absent for every other failure. An image export that meets it refuses its image rather than make it without the imagery.

    stringalways imagery

• HEADRead response headers

  Sign-in Session cookie or Bearer tokenAnswers 200, 400, 401, 403, 404, 405, 502, 503, 504, defaultAllow GET, HEAD, OPTIONS

  Automatic HEAD uses GET with no response body.

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/palettes

GETList palettes

Sign-in Session cookie or Bearer tokenMCP tool list_palettes

Shared by every authenticated account. The full palette offer: the curated catalogue plus every saved custom palette. Either kind's name works as palette in the fill operation.

Responses

• 200

  Success.

  application/json

  PaletteOffer

• 401403503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS, POST

POSTSave a custom palette

Sign-in Session cookie or Bearer tokenMCP tool create_palette

At most 16,777,216 wire bytes; a larger body is refused with request_body_too_large before JSON parsing. Every authenticated account may save a named gradient of ordered color stops. Instance-global: it appears in every map's picker and works in continuous and classified fills alike. Returns the saved palette with its assigned name.

Request body

At most 16,777,216 bytes (16 MiB); a larger body is refused with request_body_too_large.

application/json

object

• labelstringrequiredmax length 60

• stopsarrayrequiredmin items 2max items 16

  • (each item)object

    • colorstringrequired

      #rrggbb

    • positionnumberrequiredminimum 0maximum 1

Responses

• 201

  Saved.

  application/json

  CustomPalette

• 401403413503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS, POST

• HEADRead response headers

  Sign-in Session cookie or Bearer tokenAnswers 200, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS, POST

  Automatic HEAD uses GET with no response body.

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS, POST

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/palettes/{name}

DELETEDelete a custom palette

Sign-in Session cookie or Bearer tokenMCP tool delete_palette

Every authenticated account may remove any saved custom palette from the shared picker. Styles that used it keep rendering — their colors were baked in at classification time. Curated palettes cannot be deleted.

Parameters

• namePathrequired

  Custom palette name.

  string

Responses

• 200

  Deleted.

  application/json

  object

  • deletedboolean

• 401403503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways DELETE, OPTIONS

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow DELETE, OPTIONS

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/settings

GETWorkspace settings

Sign-in Session cookie or Bearer tokenMCP tool get_settings

The signed-in account's display name, per-screen view/sort preferences, how the SQL console's source list groups datasets and its look (color, contrast, typeface, background, corners, side menu and panels), plus the instance name shown beside the wordmark and in browser titles (null when unnamed). Cookie or bearer authentication is required. Responses, including refusals, are private, no-store.

Responses

• 200

  Success.

  application/json

  WorkspaceSettings

• 400401403503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS, PATCH

Example

Read your own settings

Needs a token. A new account's settings.

curlJavaScript

curl

Terminal

curl -s http://localhost:3000/api/settings \
  -H "Authorization: Bearer <YOUR_TOKEN>"

Answers 200 application/json

Response

{
  "displayName": "Ana Diaz",
  "instanceName": null,
  "viewPrefs": {},
  "sourceGrouping": "person",
  "look": {
    "color": "kelp",
    "contrast": "standard",
    "font": "inter",
    "background": "atlantic",
    "corners": "rounded",
    "rail": "hover",
    "panels": "glass",
    "transparency": "clear"
  }
}

PATCHUpdate your settings

Sign-in Session cookie or Bearer tokenMCP tool update_settings

At most 16,777,216 wire bytes; a larger body is refused with request_body_too_large before JSON parsing. Updates only the authenticated account's display name and preferences. Only admins can change instanceName. The entire patch is validated and authorized before any write; a forbidden or invalid field leaves every field unchanged. The look takes any of its picks; an unknown pick or value inside look refuses the patch, while an unknown field outside it is ignored. Cookie mutations require the same trusted Origin. Explicit bearer requests need no cookie or Origin. Responses, including refusals, are private, no-store.

Request body

At most 16,777,216 bytes (16 MiB); a larger body is refused with request_body_too_large.

application/json

object

• displayNamestringmax length 80

  Your account display name.

• instanceNamestringor nullmax length 80

  Admin-only optional instance name. Empty, whitespace or null clears it; the instance is then unnamed.

• viewPrefsobject

  Per-screen view preferences; slices merge into what is stored, and the read carries every slice written so far.

  • mapsobject

    The Maps list.

    • viewstring

      One of grid, list

    • sortstring

      One of edited, created, name

  • dataobject

    The Data page.

    • viewstring

      One of grid, list

    • sortstring

      One of updated, name, rows, size

  • workflowsobject

    The workflows list.

    • viewstring

      One of grid, list

    • sortstring

      One of edited, created, name

  • projectsobject

    The Projects list.

    • viewstring

      One of grid, list

    • sortstring

      One of updated, name, largest

• sourceGroupingstringdefault person

  How the SQL console's source list groups datasets: by person (your own, then each other person's under their name and SQL name) or by project. Your own choice, never another account's; person until you choose otherwise.

  One of person, project

• lookobject

  Any of your look's picks; the others stay as they are. A value outside a pick's choices, or a key that is not one of the picks, refuses the whole update: a bad value is named as look.<key>, an unknown key by its position.

  • colorstringdefault kelp

    Color. The interface's tint: accents, primary buttons, active marks, focus and the background's ink. Never a data color.

    One of kelp, harbor, heather, slate

  • contraststringdefault standard

    Contrast. Borders, dividers and quieter text; more makes them stronger in both themes.

    One of standard, more

  • fontstringdefault inter

    Typeface. The face of everything read: Inter, or the computer's own. Identifiers and values keep the mono face.

    One of inter, system

  • backgroundstringdefault atlantic

    Background. The texture behind the workspace and in the header bar; plain is none.

    One of atlantic, plain, graticule, hex

  • cornersstringdefault rounded

    Corners. Rounded edges of cards, fields, buttons and panels; soft is tighter.

    One of rounded, soft

  • railstringdefault hover

    Side menu. How the side menu opens: on a resting pointer or focus, always open with labels, or icons only.

    One of hover, open, icons

  • panelsstringdefault glass

    Panels. How cards and panels are drawn: frosted glass, liquid glass with a light on its rim, or opaque paper with no blur.

    One of glass, liquid, paper

  • transparencystringdefault clear

    Transparency. How much of the map shows through Liquid's cards and panels: clear, medium or firm. Only while Panels is Liquid.

    One of clear, medium, firm

  No other keys.

Responses

• 200

  Success.

  application/json

  WorkspaceSettings

• 400401403413503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS, PATCH

Example

Show the Maps page as a list, by name

Needs a token. The slice you send merges into what is stored.

curlJavaScript

curl

Terminal

curl -s -X PATCH http://localhost:3000/api/settings \
  -H "Authorization: Bearer <YOUR_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"viewPrefs": {"maps": {"view": "list", "sort": "name"}}}'

Answers 200 application/json

Response

{
  "displayName": "Ana Diaz",
  "instanceName": null,
  "viewPrefs": {
    "maps": {
      "view": "list",
      "sort": "name"
    }
  },
  "sourceGrouping": "person",
  "look": {
    "color": "kelp",
    "contrast": "standard",
    "font": "inter",
    "background": "atlantic",
    "corners": "rounded",
    "rail": "hover",
    "panels": "glass",
    "transparency": "clear"
  }
}

• HEADRead response headers

  Sign-in Session cookie or Bearer tokenAnswers 200, 400, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS, PATCH

  Automatic HEAD uses GET with no response body.

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS, PATCH

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

/api/openapi.json

GETThis OpenAPI description

Sign-in Session cookie or Bearer tokenMCP tool get_api_description

The same API reference for every authenticated account. Contains operation contracts, never private resource listings or credential values. Private, no-store.

Responses

• 200

  The machine-readable API description.

  application/json

  object

• 401403503default

  Error with a machine-readable code and human message.

  application/json

  Error

• 405

  method_not_allowed: the method is unsupported for this path.

  application/json

  Error

  • AllowHeader

    Exactly the documented methods for this path.

    stringalways GET, HEAD, OPTIONS

Example

Read this API description

Needs a token. An excerpt: the answer is the whole description, as this document.

curlJavaScript

curl

Terminal

curl -s http://localhost:3000/api/openapi.json \
  -H "Authorization: Bearer <YOUR_TOKEN>"

Answers 200 application/json

Response

{
  "openapi": "3.1.0",
  "info": {
    "title": "Dezfil API",
    "version": "0.1.0"
  },
  "paths": {
    "/api/query": {
      "post": {
        "summary": "Run read-only SQL",
        "requestBody": {
          "x-byte-limit": 16777216,
          "x-byte-error": "request_body_too_large"
        }
      }
    }
  }
}

• HEADRead response headers

  Sign-in Session cookie or Bearer tokenAnswers 200, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic HEAD uses GET with no response body.

• OPTIONSRead allowed methods

  Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, defaultAllow GET, HEAD, OPTIONS

  Automatic OPTIONS returns no body and the Allow header. Authentication is required.

Automatic methods on other paths

The description files the automatic OPTIONS operations of these paths under System; each path's other methods are on the page named beside it.

OPTIONSRead allowed methods

Sign-in Session cookie or Bearer tokenAnswers 204, 401, 403, 405, 503, default

Automatic OPTIONS returns no body and the Allow header. Authentication is required.

Path	Allow	Other methods
/api/auth/entry	GET, HEAD, OPTIONS	Accounts
/api/auth/setup	OPTIONS, POST	Accounts
/api/auth/sign-in	OPTIONS, POST	Accounts
/api/auth/redeem	OPTIONS, POST	Accounts
/api/auth/session	GET, HEAD, OPTIONS	Accounts
/api/auth/sign-out	OPTIONS, POST	Accounts
/api/account	GET, HEAD, OPTIONS, PATCH	Accounts
/api/account/password	OPTIONS, POST	Accounts
/api/account/tokens	GET, HEAD, OPTIONS, POST	Accounts
/api/account/tokens/{id}	DELETE, OPTIONS	Accounts
/api/users/{id}/deletion-preview	GET, HEAD, OPTIONS	Accounts
/api/users/deletions/{id}	GET, HEAD, OPTIONS	Accounts
/api/users/deletions/{id}/finish	OPTIONS, POST	Accounts
/api/users	GET, HEAD, OPTIONS, POST	Accounts
/api/users/{id}	DELETE, OPTIONS, PATCH	Accounts
/api/users/{id}/sign-in-link	OPTIONS, POST	Accounts
/api/templates	GET, HEAD, OPTIONS	Templates
/api/templates/refresh	OPTIONS, POST	Templates
/api/templates/downloads	DELETE, OPTIONS	Templates
/api/templates/{id}	GET, HEAD, OPTIONS	Templates
/api/templates/{id}/fetch	OPTIONS, POST	Templates
/api/templates/{id}/copy	OPTIONS, POST	Templates
/api/templates/{id}/picture	GET, HEAD, OPTIONS	Templates
/api/tables/{name}/geometry	DELETE, GET, HEAD, OPTIONS, PUT	Tables
/api/tables/{name}/geometry/preview	OPTIONS, POST	Tables
/api/geometry/projections	GET, HEAD, OPTIONS	Tables
/api/tables	GET, HEAD, OPTIONS, POST	Tables
/api/imports/url	OPTIONS, POST	Tables
/api/imports/overture	OPTIONS, POST	Tables
/api/imports/overture/count	OPTIONS, POST	Tables
/api/imports/overture/preview	OPTIONS, POST	Tables
/api/imports/overture/divisions/countries	GET, HEAD, OPTIONS	Tables
/api/imports/overture/divisions/levels	GET, HEAD, OPTIONS	Tables
/api/imports/overture/divisions/states	GET, HEAD, OPTIONS	Tables
/api/imports/overture/divisions/search	GET, HEAD, OPTIONS	Tables
/api/imports/osm	OPTIONS, POST	Tables
/api/imports/osm/preview	OPTIONS, POST	Tables
/api/imports/overture/releases	GET, HEAD, OPTIONS	Tables
/api/connections/postgis	GET, HEAD, OPTIONS, POST	Connections
/api/connections/postgis/{id}	DELETE, OPTIONS, PATCH	Connections
/api/connections/postgis/{id}/test	OPTIONS, POST	Connections
/api/connections/postgis/{id}/tables	GET, HEAD, OPTIONS	Connections
/api/connections/postgis/{id}/preview	OPTIONS, POST	Connections
/api/connections/postgis/{id}/snapshots	GET, HEAD, OPTIONS	Connections
/api/imports/postgis	OPTIONS, POST	Tables
/api/tables/{name}/refresh	OPTIONS, POST	Tables
/api/tables/{name}/features	GET, HEAD, OPTIONS	Tables
/api/tables/{name}/export	GET, HEAD, OPTIONS	Tables
/api/tables/{name}	DELETE, GET, HEAD, OPTIONS	Tables
/api/operations	GET, HEAD, OPTIONS	Operations
/api/operations/run	OPTIONS, POST	Operations
/api/operations/runs	GET, HEAD, OPTIONS	Operations
/api/operations/runs/{id}	GET, HEAD, OPTIONS	Operations
/api/operations/runs/{id}/cancel	OPTIONS, POST	Operations
/api/recipes	GET, HEAD, OPTIONS, POST	Recipes
/api/recipes/{id}	DELETE, GET, HEAD, OPTIONS, PATCH	Recipes
/api/recipes/{id}/duplicate	OPTIONS, POST	Recipes
/api/recipes/{id}/dependencies	GET, HEAD, OPTIONS	Recipes
/api/recipes/{id}/layout	GET, HEAD, OPTIONS, PUT	Recipes
/api/recipes/{id}/steps	OPTIONS, POST	Recipes
/api/recipes/{id}/steps/{stepId}	DELETE, GET, HEAD, OPTIONS, PATCH	Recipes
/api/recipes/{id}/steps/{stepId}/proposal	DELETE, OPTIONS	Recipes
/api/recipes/{id}/steps/{stepId}/move	OPTIONS, POST	Recipes
/api/recipes/{id}/steps/{stepId}/run	OPTIONS, POST	Recipes
/api/recipes/{id}/runs	GET, HEAD, OPTIONS, POST	Recipes
/api/recipes/{id}/runs/{runId}	GET, HEAD, OPTIONS	Recipes
/api/recipes/{id}/runs/{runId}/cancel	OPTIONS, POST	Recipes
/api/query	OPTIONS, POST	Query
/api/query/export	GET, HEAD, OPTIONS, POST	Query
/api/maps	GET, HEAD, OPTIONS, POST	Maps
/api/projects	GET, HEAD, OPTIONS, POST	Projects
/api/projects/{id}	DELETE, GET, HEAD, OPTIONS, PATCH	Projects
/api/projects/{id}/members	GET, HEAD, OPTIONS, PATCH	Projects
/api/projects/{id}/export	GET, HEAD, OPTIONS, POST	Projects
/api/projects/{id}/leave	OPTIONS, POST	Projects
/api/projects/{id}/people	GET, HEAD, OPTIONS	Projects
/api/projects/{id}/people/{sqlName}	DELETE, OPTIONS, PUT	Projects
/api/projects/{id}/transfer	OPTIONS, POST	Projects
/api/maps/{id}/transfer	OPTIONS, POST	Maps
/api/recipes/{id}/transfer	OPTIONS, POST	Recipes
/api/accounts/search	GET, HEAD, OPTIONS	Accounts
/api/account/picture	DELETE, OPTIONS, PUT	Accounts
/api/users/{id}/picture	DELETE, OPTIONS	Accounts
/api/accounts/{sqlName}/picture	GET, HEAD, OPTIONS	Accounts
/api/icons/sanitize	OPTIONS, POST	Layers
/api/basemap/inspect	OPTIONS, POST	Maps
/api/maps/{id}	DELETE, GET, HEAD, OPTIONS, PATCH	Maps
/api/maps/{id}/picture/refresh	OPTIONS, POST	Maps
/api/maps/{id}/thumbnail	GET, HEAD, OPTIONS, PUT	Maps
/api/maps/{id}/widget-values	OPTIONS, POST	Maps
/api/maps/{id}/search	GET, HEAD, OPTIONS	Maps
/api/maps/{id}/dependencies	GET, HEAD, OPTIONS	Maps
/api/maps/{id}/duplicate	OPTIONS, POST	Maps
/api/maps/{id}/history	GET, HEAD, OPTIONS	Maps
/api/maps/{id}/undo	OPTIONS, POST	Maps
/api/maps/{id}/redo	OPTIONS, POST	Maps
/api/maps/{id}/sketches	GET, HEAD, OPTIONS, POST	Sketches
/api/sketches/{name}/features	GET, HEAD, OPTIONS, POST	Sketches
/api/sketches/{name}/features/{featureId}	DELETE, OPTIONS, PATCH	Sketches
/api/sketches/{name}	DELETE, OPTIONS	Sketches
/api/maps/{id}/layers	GET, HEAD, OPTIONS, POST	Layers
/api/layers/{id}	DELETE, GET, HEAD, OPTIONS, PATCH	Layers
/api/layers/{id}/duplicate	OPTIONS, POST	Layers
/api/layers/{id}/extent	OPTIONS, POST	Layers
/api/maps/look	OPTIONS, POST	Maps
/api/maps/look/{renderId}	GET, HEAD, OPTIONS	Maps
/api/maps/{id}/export/image	OPTIONS, POST	Maps
/api/layers/{id}/export/{format}	GET, HEAD, OPTIONS	Layers
/api/layers/{id}/render	GET, HEAD, OPTIONS, POST	Layers
/api/layers/{id}/slider-preview	GET, HEAD, OPTIONS	Layers
/api/layers/{id}/tiles/{z}/{x}/{y}	GET, HEAD, OPTIONS	Layers
/api/layers/{id}/fields	GET, HEAD, OPTIONS	Layers
/api/layers/{id}/fields/{field}	GET, HEAD, OPTIONS	Layers
/api/layers/{id}/fill	OPTIONS, POST	Layers
/api/layers/{id}/scale	OPTIONS, POST	Layers
/api/maps/{id}/publish	DELETE, GET, HEAD, OPTIONS, POST	Publish
/api/maps/{id}/published-fields	GET, HEAD, OPTIONS	Publish
/api/publications/{token}	DELETE, OPTIONS	Publish
/api/catalogue/tables	GET, HEAD, OPTIONS	Tables
/api/assistant/runs	OPTIONS, POST	Agents
/api/assistant/runs/{id}	DELETE, GET, HEAD, OPTIONS	Agents
/api/assistant/runs/{id}/cancel	OPTIONS, POST	Agents
/api/assistant/pending	GET, HEAD, OPTIONS	Agents
/api/assistant	GET, HEAD, OPTIONS	Agents
/api/assistant/policy	GET, HEAD, OPTIONS	Agents
/api/assistant/messages	OPTIONS, POST	Agents
/api/mcp	OPTIONS, POST	Agents
/api/published/{token}	GET, HEAD, OPTIONS	Publish
/api/published/{token}/extent/{layerId}	OPTIONS, POST	Published
/api/published/{token}/widget-values	OPTIONS, POST	Publish
/api/published/{token}/render/{layerId}	OPTIONS, POST	Publish
/api/published/{token}/tiles/{layerId}/{z}/{x}/{y}	GET, HEAD, OPTIONS	Publish
/api/published/{token}/basemaps/satellite	GET, HEAD, OPTIONS	Publish
/api/published/{token}/basemaps/satellite/tiles/{z}/{x}/{y}	GET, HEAD, OPTIONS	Publish