Swagger

The OpenAPI 3.0.3 document is src/SharedData/API/apidocs.yml. Flasgger loads it in SharedData.API and serves Swagger UI at /apidocs. Use the document served by your deployed server for its version, request fields and response schemas.

Send a token on every call except the public ones (health, heartbeat, the worker installer, enroll):

• X-Custom-Authorization: <token> (preferred)
• x-api-key: <token>
• ?token= is accepted and should be avoided, because URLs land in logs

Containers are {database}/{period}/{source}/{name}. Bulk table and collection bodies are BSON compressed with LZ4. The description at the top of the YAML is the permission tree: a path is matched as master > api > ....

Paths that match the Flask routes

Tag	Routes
Tables	/api/tables, /api/table/{database}/{period}/{source}/{tablename}
Timeseries	/api/timeseries, /api/timeseries/{database}/{period}/{source}, .../write, .../{tag}
Collections	/api/collections, /api/collection/..., .../indexes
SQLite	/api/sqlite, /api/sqlite/..., .../indexes
Cache	/api/cache/..., /flush, /{key}, /exists, /ttl
Data	/api/data/sources, /symbols, /symbol/{symbol}, /marketdata/{symbol}, /signals/{symbol}, /portfolios/{portfolio}, /riskfactors/{factor}, /vol/{symbol}
Metadata	/api/metadata, /api/metadata/{name}
Logs	/api/logs
Workers	/api/workerpool, /api/workers, install codes, enroll, git credentials, join tokens, command tokens, shared tokens
Schedules	/api/schedules, /api/schedules/{name}, .../mode
Jobs	/api/jobs, /api/jobs/groups
Routes	/api/routes, /api/routes/{route_id}, /api/routes/activation/verify
Downloads	/api/list, /api/download
System	/api/health, /api/heartbeat, /api/auth, /api/auth/invalidate, /api/traffic_stats, /api/webhooks

Additional documented endpoints

These endpoints are served by handlers in src/SharedData/API/routes/:

• GET and POST /api/workers/shared-tokens, DELETE /api/workers/shared-tokens/{label} — one token for a group of workers (Auth.workers.create_shared_token). Master only. The token is returned once.
• POST /api/routes/activation/verify — probes SHAREDDATA_WEB_PROXY_PROBES and reports whether each proxy is serving the current route generation. Master only. GET /api/routes also returns activation (applied_generation, desired_generation, state).

When a route is added under src/SharedData/API/routes/, its path must be documented in the OpenAPI document as well, with info.version bumped alongside setup.py.