Vadyl
Operate & govern

Auth

Foundational kernel: connectors, ActorContext, runtime-compiled policy, scope-chain merge.

This page is the documentation contract for the Auth surface in Vadyl's final form. It is not a marketing summary: it names the authorities, projections, runtime behavior, examples, limits, errors, and observability expectations that every product implementation must honor.

What this surface owns

  • Auth owns the canonical product-facing contract described here; provider-specific machinery stays behind capability declarations.
  • Foundational kernel: connectors, ActorContext, runtime-compiled policy, scope-chain merge.
  • The final docs treat this as complete: REST, GraphQL, gRPC, SDK, CLI, MCP, dashboard, observability, limits, errors, and explainability are all covered as projections of one authority.

Canonical authorities

AuthorityRole
ProjectRuntimeDescriptorPins Auth to a publication, runtime descriptor, worker, or substrate realization.
SnapshotManifestCanonical owner for Auth; downstream surfaces derive from this rather than inventing their own truth.
Branching CASCanonical owner for Auth; downstream surfaces derive from this rather than inventing their own truth.
EffectiveGovernanceEnvelopeCanonical owner for Auth; downstream surfaces derive from this rather than inventing their own truth.
Usage ledgerCanonical owner for Auth; downstream surfaces derive from this rather than inventing their own truth.

Projection coverage

Surface kindsGovernancePolicySurface, BillingMeterSurface, IdentityProviderSurface, AuthSchemeSurface, ObservabilitySurface, ExplainabilitySurface
Projection facetsBranches, Publications, Observability, Explainability, Installations, ExposureBindings
ProtocolsRest, OpenApi, Sdk, Cli, Dashboard
Public projectionsproject APIs; branch APIs; version APIs; identity/auth APIs; usage APIs; explainability APIs

Project-scope parity

    Publish, install, consume

      Consumption evidence

        Runtime behavior

        • branch-aware descriptor compilation
        • publication pinning
        • hierarchy inheritance
        • quota reservation
        • observability relay

        REST and controller surface

        Code-backed controllers are listed here so the docs menu does not hide the real endpoint surface. The complete route-by-route table remains in the REST controller atlas.

        ControllerBase routeEndpoint countExamples
        Projects/api/projects14
        POST create
        GET resolve
        POST {parentProjectId}/children
        GET {projectId}/provider-bindings
        Branch/api/Branch64
        GET branches
        POST branches
        GET branches/{id}
        DELETE branches/{id}
        VersionGovernance/api/version13
        GET /
        GET projects/{projectId}
        GET projects/{projectId}/publication/{publicationVersion:long}
        GET platform-baseline
        IdentityManagement/api/IdentityManagement7
        GET subjects
        GET subjects/{id}
        POST subjects/{id}/deactivate
        GET memberships
        Usage/api/Usage7
        GET {projectId}/events
        GET {projectId}/rollups
        GET {projectId}/quotas
        POST {projectId}/quotas
        Observability/api/Observability8
        GET Entries
        GET Entries/{id}
        GET Trail/{entityName}
        GET Trails
        Explainability/api/Explainability15
        GET surface
        GET project-runtime
        GET publication/latest
        GET publication/{publicationVersion:long}
        IdentityEntrypoint/api/identity9
        GET discovery
        POST login
        POST register
        POST refresh
        CredentialReveal/api/CredentialReveal1
        POST {tokenId}/reveal

        SDK and CLI surface

        ProjectionNamespace / groupCoverage
        SDKbranchingbranches, commits, workspaces, sandboxes, proposals, environments, deploy, rollback. Rendered methods: 5.
        SDKobservabilityaudit, operational, debug, metrics, traces, diagnostics, reason-code correlation. Rendered methods: 4.
        SDKexplainabilityaccess, read-plan, surface, publication, analytics, automation, PCG, measure explanations. Rendered methods: 3.
        SDKplatformprovider health/capabilities, runtime fabric scaling, distribution, version governance, data portability. Rendered methods: 12.
        CLIvadyl projectCreate, suspend, archive, traverse the project hierarchy. Rendered commands: 7.
        CLIvadyl branchManage branches and workspaces for the canonical contract. Rendered commands: 6.
        CLIvadyl publicationProject runtime publications. Rendered commands: 5.
        CLIvadyl deployPlan, apply, ramp, and roll back deployments. Rendered commands: 5.
        CLIvadyl auditTail / search the canonical audit log. Rendered commands: 2.
        CLIvadyl explainProject canonical decision reasoning. Rendered commands: 4.
        CLIvadyl authSign in, manage tokens, switch tenant/project scope. Rendered commands: 5.

        Input request and output

        POST /api/projects/create HTTP/1.1
Host: api.vadyl.app
Authorization: Bearer $VADYL_TOKEN
X-Vadyl-Tenant: acme
X-Vadyl-Project: billing
Content-Type: application/json

{
  "surface": "auth",
  "publicationVersion": 412,
  "explain": true
}

        Limits and quotas

          Error model

          ErrorMeaning

          Observability and explainability

            Related references

            Previous
            Full surface atlas
            Next
            Exposure bindings