Beta module namespace
knowledge
Beta routes may change with notice and are NOT covered by the 24-month stable window of the core contract.
Every module route is enumerated with method, path, auth and required permission; request/response schemas are not published for the beta surface.
53 operations
| Method | Path | Required permission | Authentication | Summary |
|---|---|---|---|---|
| get | /v1/m/knowledge/context-policies | knowledge:context:read | Bearer token | Lists context policies, optionally filtered by scope. |
| post | /v1/m/knowledge/context-policies | knowledge:context:write | Bearer token | Upserts a context/compaction policy by (scope_kind, scope_ref). |
| get | /v1/m/knowledge/data-products | knowledge:data_product:read | Bearer token | knowledge module route (requires knowledge:data_product:read) |
| post | /v1/m/knowledge/data-products | knowledge:data_product:write | Bearer token | knowledge module route (requires knowledge:data_product:write) |
| get | /v1/m/knowledge/data-products/{id} | knowledge:data_product:read | Bearer token | knowledge module route (requires knowledge:data_product:read) |
| put | /v1/m/knowledge/data-products/{id} | knowledge:data_product:write | Bearer token | knowledge module route (requires knowledge:data_product:write) |
| delete | /v1/m/knowledge/data-products/{id} | knowledge:data_product:admin | Bearer token | knowledge module route (requires knowledge:data_product:admin) |
| post | /v1/m/knowledge/data-products/{id}/archive | knowledge:data_product:admin | Bearer token | knowledge module route (requires knowledge:data_product:admin) |
| get | /v1/m/knowledge/data-products/{id}/contracts | knowledge:data_product:read | Bearer token | knowledge module route (requires knowledge:data_product:read) |
| post | /v1/m/knowledge/data-products/{id}/contracts | knowledge:data_product:write | Bearer token | knowledge module route (requires knowledge:data_product:write) |
| get | /v1/m/knowledge/data-products/{id}/contracts/active | knowledge:data_product:read | Bearer token | knowledge module route (requires knowledge:data_product:read) |
| get | /v1/m/knowledge/data-products/{id}/contracts/{ver} | knowledge:data_product:read | Bearer token | knowledge module route (requires knowledge:data_product:read) |
| post | /v1/m/knowledge/data-products/{id}/deprecate | knowledge:data_product:write | Bearer token | knowledge module route (requires knowledge:data_product:write) |
| get | /v1/m/knowledge/data-products/{id}/events | knowledge:data_product:read | Bearer token | knowledge module route (requires knowledge:data_product:read) |
| get | /v1/m/knowledge/data-products/{id}/health | knowledge:data_product:read | Bearer token | knowledge module route (requires knowledge:data_product:read) |
| post | /v1/m/knowledge/data-products/{id}/publish | knowledge:data_product:write | Bearer token | knowledge module route (requires knowledge:data_product:write) |
| post | /v1/m/knowledge/data-products/{id}/validate | knowledge:data_product:write | Bearer token | knowledge module route (requires knowledge:data_product:write) |
| get | /v1/m/knowledge/dlp/rules | knowledge:dlp:read | Bearer token | Lists the tenant's DLP rules. |
| put | /v1/m/knowledge/dlp/rules | knowledge:dlp:admin | Bearer token | Upserts one DLP rule by class (admin-tier: writing egress policy is privileged governance; self-audited). |
| delete | /v1/m/knowledge/dlp/rules/{id} | knowledge:dlp:admin | Bearer token | Removes one DLP rule by id (admin-tier; self-audited). Removing the last rule disables the gate entirely — the audit row is the record of WHO opened the perimeter. |
| get | /v1/m/knowledge/documents/{id} | knowledge:kb:read | Bearer token | Returns one document's metadata + provenance (no body). |
| get | /v1/m/knowledge/kbs | knowledge:kb:read | Bearer token | Lists knowledge bases, optionally filtered by status. |
| post | /v1/m/knowledge/kbs | knowledge:kb:write | Bearer token | Declares a knowledge base. |
| get | /v1/m/knowledge/kbs/{id} | knowledge:kb:read | Bearer token | knowledge module route (requires knowledge:kb:read) |
| put | /v1/m/knowledge/kbs/{id} | knowledge:kb:write | Bearer token | Updates a KB's governance settings (classification/residency/ embed policy/default ACL/status), version-checked, re-validating the embed gate. |
| delete | /v1/m/knowledge/kbs/{id} | knowledge:kb:admin | Bearer token | Deletes a KB and CASCADES its documents, chunks and document sensitivity labels in one transaction (no orphans). |
| get | /v1/m/knowledge/kbs/{id}/documents | knowledge:kb:read | Bearer token | Lists a KB's ingested documents (metadata only; no body). |
| post | /v1/m/knowledge/kbs/{id}/ingest | knowledge:kb:write | Bearer token | Ingests content into a knowledge base: it gathers documents (from a registered source or inline), REDACTS each body, chunks it, embeds the chunks via the wired embedder OUTSIDE the store transaction (the network/ egress call must never hold the single SQLite writer — the deploy discipline), and persists documents + chunks in one transaction. |
| post | /v1/m/knowledge/kbs/{id}/query | knowledge:retrieval:read | Bearer token | knowledge module route (requires knowledge:retrieval:read) |
| post | /v1/m/knowledge/kbs/{id}/reindex | knowledge:kb:write | Bearer token | Re-embeds a KB's chunks that have no embedding yet (the recovery path for a partial ingest where the embed call failed). |
| post | /v1/m/knowledge/kbs/{id}/scan | knowledge:scan:write | Bearer token | Runs the at-rest discovery scan over one KB's stored documents: classify every chunk's (redacted) text, label each document, count redaction markers, append the scan evidence row. |
| post | /v1/m/knowledge/kbs/{id}/sync | knowledge:kb:write | Bearer token | Handles POST /kbs/{id}/sync. |
| get | /v1/m/knowledge/labels | knowledge:scan:read | Bearer token | Lists sensitivity labels, optionally filtered by subject_kind and/or kb_id (labels are governance metadata — counts and rules, no content). |
| get | /v1/m/knowledge/lineage | knowledge:lineage:read | Bearer token | Lists lineage records, optionally filtered by kb_id, agent_ref or decision. |
| get | /v1/m/knowledge/lineage/{id} | knowledge:lineage:read | Bearer token | Returns one lineage record (self-audited). |
| get | /v1/m/knowledge/memory | knowledge:memory:read | Bearer token | Lists the memory visible to the DECLARED read context (?agent_ref= plus the ?user_ref=/?session_ref= namespace), EXCLUDING expired entries (lazy expiry), entries above the reader's classification clearance, and entries that fail the integrity self-check (fail closed; withheld count reported, detection audited). |
| post | /v1/m/knowledge/memory | knowledge:memory:write | Bearer token | Upserts an agent memory entry (by agent_ref + namespace + key), redacting the content and enforcing the per-agent quota. |
| get | /v1/m/knowledge/memory/all | knowledge:memory:admin | Bearer token | knowledge module route (requires knowledge:memory:admin) |
| get | /v1/m/knowledge/memory/export | knowledge:memory:read | Bearer token | Streams the caller's clearance-visible memory as signed JSONL: line 1 is the signed manifest, each following line one memPortRow. |
| post | /v1/m/knowledge/memory/import | knowledge:memory:write | Bearer token | Ingests a signed memory-portability bundle. |
| post | /v1/m/knowledge/memory/purge | knowledge:memory:admin | Bearer token | Materializes expiry: it deletes expired memory entries of BOTH scopes (optionally for one agent). |
| post | /v1/m/knowledge/memory/verify | knowledge:memory:admin | Bearer token | knowledge module route (requires knowledge:memory:admin) |
| get | /v1/m/knowledge/memory/{id} | knowledge:memory:read | Bearer token | Returns one memory entry. |
| delete | /v1/m/knowledge/memory/{id} | knowledge:memory:write | Bearer token | Removes one memory entry. |
| get | /v1/m/knowledge/prompts | knowledge:prompt:read | Bearer token | knowledge module route (requires knowledge:prompt:read) |
| post | /v1/m/knowledge/prompts | knowledge:prompt:write | Bearer token | Creates a prompt and its first immutable revision. |
| get | /v1/m/knowledge/prompts/{id} | knowledge:prompt:read | Bearer token | Returns one prompt (its current pointer + status). |
| get | /v1/m/knowledge/prompts/{id}/revisions | knowledge:prompt:read | Bearer token | Lists a prompt's immutable revision history. |
| post | /v1/m/knowledge/prompts/{id}/revisions | knowledge:prompt:write | Bearer token | Appends an immutable revision and advances the current pointer. |
| get | /v1/m/knowledge/prompts/{id}/revisions/{rev} | knowledge:prompt:read | Bearer token | Returns one immutable revision by number. |
| post | /v1/m/knowledge/prompts/{id}/rollback | knowledge:prompt:write | Bearer token | Points the prompt's current revision at a prior, existing revision. |
| get | /v1/m/knowledge/scans | knowledge:scan:read | Bearer token | Lists the append-only discovery scan evidence. |
| post | /v1/m/knowledge/sources/{name}/scan | knowledge:scan:write | Bearer token | Runs discovery ACROSS a configured document store WITHOUT ingesting: it pulls the source's documents (bounded like ingest), classifies the RAW bodies in memory and persists labels + the scan evidence — the bodies themselves are never stored, logged or embedded (zero egress, minimal data). |