HTTP API reference

Authentication and authority

Send x-lsas-api-key. Stored keys must be current, unexpired, unrevoked and grant the route scope: chat, sanitize, scan or connector. Tenant/app/environment come from the stored binding. Tenant/app headers are only an explicit development shortcut; they are not production authentication.

Production/staging require an exact policy assignment. Missing versions, duplicate assignments, unavailable validators and failed authority/configuration lookups stop execution. Legacy or stale active alignment is held. Descriptive alignment rules do not imply implemented runtime predicates.

POST /v1/chat/completions

Accepts system/user/assistant text messages or text content parts. Streaming, tool calls/tool roles, image/audio content and unknown options are rejected. The tenant-configured model is admitted; max_tokens defaults to 1024 and must be an integer from 1 to 8192. Supported generation settings are validated and bounded. Optional response service-tier and fingerprint fields must match the admitted protocol values; arbitrary metadata text is rejected.

Ingress is evaluated before a model effect. A registered text skill binds exact input, scope, policy, endpoint, credential revision and budgets, records derived intent, and rechecks authority before and after execution. Server egress validation governs the actual output. Final inline release rechecks current authority under tenant/app/key locks before and after decision and release-audit persistence; a changed or expired grant withholds the response.

• data: actual normalized released completion, or null when withheld.
• lsas: evaluated decision, risk/findings, required versus applied remediation and actual enforcement outcome.
• ingress: separate input-boundary evaluation when reached.
• HTTP 200 releases content; policy BLOCKED returns 400/null; ESCALATE_HITL or unreleasable transformation returns 409/null. Authentication/configuration failures may have no decision envelope.

An escalation is a hold, not a completed human approval. Unsupported clinical, current-regulatory, generated-code and grounding capabilities cannot be claimed as verified by a low risk score.

Exact-output nonclinical review

An administrator can explicitly enroll an application in the nonclinical-content-release profile. Enrollment requires a real application key and an explicit encrypted tenant provider credential. Otherwise releasable text is then held with HTTP 409, data: null, and a reviewWorkItem containing id, pending status, revision, artifactDigest and expiresAt. Blocked, protected-data, credential, injection, and unsupported-capability results cannot enter this approval path.

A separately assigned current reviewer must inspect the exact encrypted artifact before approving it. Review does not extend the original grant, whose maximum duration is 60 seconds; expired work requires a fresh request. Authority changes, including changing a policy or enrollment and then restoring it, invalidate the earlier grant. Approval is not a clinical qualification.

GET /v1/runtime/releases/:id returns status metadata to the original app/key only. POST /v1/runtime/releases/:id/consume accepts expectedRevision and expectedArtifactDigest. It rechecks the original app/key, audience, policy, alignment, provider binding, reviewer assignment, expiry and artifact validation before committing release. The response is the exact canonical JSON artifact, with x-lsas-release-id and x-lsas-artifact-digest headers and no-store caching. It is not wrapped in the original chat envelope. Consumption is single-use; there is no automatic resume or guarantee that a disconnected caller received the committed response.

POST /v1/payload/sanitize

Accepts {"payload": anyJsonValue}, including false, zero and null. Returns the actually released payload in data and its evaluation in lsas. Required redaction runs on the server and is revalidated; field collisions and unsafe results withhold release. The route does not execute a tool described in JSON.

Guided synthetic demonstration contract

Only the exact configured public-demo key/tenant/app may select an allowlisted demoScenarioId and demoTier pair. Tiers are LOW, STANDARD, REGULATED and LOCKED_DOWN. The server replaces caller content with the versioned static fixture and makes no real provider call.

diagnostics.origin = synthetic_fixture identifies raw comparison data: a chat completion envelope for chat, or fixture JSON for payload. Diagnostics include source, fixture/policy digests and expected-versus-measured labels. Final data/lsas reflect actual server enforcement. A missing capability is explicit in lsas.capabilityAssessment. Freeform omits these selectors and remains subject to application enforcement.

Discovery and Epic sandbox

POST /v1/scan/runs creates a scoped discovery run. POST /v1/scan/ingest accepts validated derived telemetry; protocol version2 distinguishes status updates from full replacement and uses expected revision checks. Do not send source rows or secrets as evidence.

POST /v1/sandbox/connectors/epic/patient-summary preserves configured Epic Patient read/search with ingress and egress evaluation, timeline and raw/governed diagnostic contract. It is restricted to evaluation environments. SIMULATED adapters make no OAuth/FHIR call; REAL adapters use the bound sandbox configuration. No clinical writes or orders are supported.

Provider and transport boundaries

OpenAI, compatible endpoints and Anthropic use the shared bounded HTTPS transport: admitted DNS pinned to TLS, certificate verification, exact destination binding, no redirects, byte limits, cancellation, bounded retry and tenant/credential scoped circuit breakers. Private destinations require an operator allowlist. Hosted TLS, egress and load qualification remain separate.

Tenant credentials are write-only encrypted envelopes tied to tenant/provider/explicit endpoint. Legacy plaintext needs explicit migration. Missing keys, invalid binding or failed decryption do not select another credential/provider. An absent whole configuration can use the intentional deployment default. No provider error body is returned as diagnostic content.