switching clears the token & responses
No token
43

Internal discovery & health (ops)

Not user flows — these serve the operator-profile infrastructure: internal liveness, the machine-generated API contract, and interactive exploration. Raw bodies, internal-only ingress.

  1. GET /health → internal liveness (raw object)
  2. GET /v1/openapi.json → OpenAPI 3.1 contract (source of truth)
  3. GET /swagger → Swagger UI (HTML)
GET/healthpublicLiveness probe (operator)

Raw object. The orchestrator restarts the operator pod if this stops returning 200. Internal-only — never routed through the public edge.

ℹ︎Field guide — what each value means & where it comes fromno inputs

No request body. Public liveness probe (operator profile) — no authentication, no path/query params, and no required caller headers. Returns a raw (non-enveloped) object like { "status": "ok", "service": "iam-platform", "version": "0.0.0" }.

→ GET https://api.kerja.team/health
↩︎Response guide — what comes back & what each value means3 fields

200 OK with a RAW JSON object — NOT wrapped in the { data } envelope. Public liveness probe; no notable response headers (no Set-Cookie, no Cache-Control).

statusenumalways
Liveness indicator for the IAM platform process. A successful probe always returns "ok"; clients/orchestrators treat any other value (or non-200) as unhealthy.
  • ok — The service is alive and serving requests.
servicestringalways
Stable identifier of the service emitting the probe response. Always "iam-platform"; used to confirm which service answered.
  • iam-platform — Identifies the responder as the IAM platform service.
versionstringalways
Deployed build/semver of the IAM service (e.g. "0.0.0"). Clients use it to confirm which release is running.
GET/v1/openapi.jsonpublicOpenAPI 3.1 contract

The source-of-truth spec, built from the same Zod schemas that validate input. If the API document and the spec disagree, the spec wins. In a NON-PRODUCTION environment the contract additionally carries the /v1/dev/oob/* helper block — the same helpers this tester surfaces as “⛓ out-of-band” popups — which lets a front-end developer walk every scenario without a mailer, an SMS gateway, or a database client. Environment-gated; never present in production.

ℹ︎Field guide — what each value means & where it comes fromno inputs

No request body, path params, query params, or required caller headers. This is a public endpoint (no Authorization, no x-gateway-context required) that returns the raw OpenAPI 3.1 contract (operator profile) as JSON.

→ GET https://api.kerja.team/v1/openapi.json
↩︎Response guide — what comes back & what each value means13 fields

200 OK with a raw JSON body that IS the OpenAPI 3.1 contract document itself (operator profile) — NOT wrapped in the { data } envelope. Public endpoint; no auth, no Set-Cookie. The body is generated from the same Zod schemas that validate input, so it is the single source of truth for the operator API surface.

openapistringalways
The OpenAPI specification version string for this document. Clients/tooling read it to select the correct parser.
  • 3.1.0 — Document conforms to the OpenAPI 3.1 specification (as stated in the section title).
infoobjectalways
Metadata block describing the API (title, version, description). Tooling shows this as the API heading.
info.titlestringalways
Human-readable name of the API (the operator IAM profile).
info.versionstringalways
Version of the API contract document. Compare across fetches to detect contract changes.
info.descriptionstringconditional
Optional free-text description of the API; present when the generator emits one.
servers[]arrayconditional
List of base-URL server objects the contract is served against; present when servers are declared. Tooling prepends these to operation paths.
servers[].urlstringconditional
Base URL for one server entry; client tooling uses it to build request URLs.
pathsobjectalways
Map of API route templates (e.g. "/v1/admin/operators") to their per-method operation objects. This is the core of the contract — every documented endpoint appears as a key here.
componentsobjectconditional
Reusable definitions (schemas, securitySchemes, parameters, responses) referenced via $ref from paths. Present because the contract is generated from shared Zod schemas.
components.schemasobjectconditional
Map of named JSON Schema (Zod-derived) object definitions used for request/response bodies; referenced by $ref throughout paths.
components.securitySchemesobjectconditional
Declared authentication schemes (e.g. bearer/gateway context) that operations reference; present when the operator surface declares security.
security[]arrayconditional
Top-level default security requirements applied to operations unless overridden; present when global security is declared.
tags[]arrayconditional
List of tag objects used to group operations in UI tooling (e.g. Swagger UI); present when the generator emits grouping tags.
GET/swaggerpublicSwagger UI

Interactive internal exploration of the operator surface (HTML). Not exposed to tenant traffic.

ℹ︎Field guide — what each value means & where it comes fromno inputs

No request body, path params, query params, or required headers. This is a public endpoint (no authentication needed) that returns the Swagger UI HTML page for interactive exploration of the API contract. Intended for internal exploration only.

→ GET https://api.kerja.team/swagger
↩︎Response guide — what comes back & what each value meansno body

200 OK returns an HTML document (the interactive Swagger UI page), NOT JSON — the body is raw HTML and is NOT wrapped in the { data } envelope, so there are no JSON response properties to document. Public, internal-exploration-only endpoint; Content-Type is text/html and no notable Set-Cookie or Cache-Control headers are specified.