> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jaasskills.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API reference

> Registry and guardrails HTTP endpoints

## Registry endpoints

Selected — the full contract lives in the backend's `design.md`.

| Method                      | Path                                                    | Purpose                                                                              |
| --------------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| `GET`                       | `/api/v1/skills`                                        | Search — anonymous-reachable; scoped to public entries for an unauthenticated caller |
| `GET`                       | `/api/v1/skills/{id}/versions/{version}`                | Full manifest metadata + resolved dependencies; never the executable payload         |
| `POST`                      | `/api/v1/skills/{id}/versions/{version}/artifact-token` | Validates authorization, issues a short-lived artifact access token                  |
| `GET`                       | `/api/v1/artifacts/{token}`                             | Redeems a token; reusable until expiry, not single-use                               |
| `GET / POST / DELETE`       | `/api/v1/skills/{id}/shares[/{grantId}]`                | List, create, or revoke a share grant                                                |
| `POST`                      | `/api/v1/skills/{id}/versions/{version}/yank · /unyank` | Withdraw or restore a published version                                              |
| `PUT`                       | `/api/v1/skills/{id}/governance`                        | Update ownership/governance metadata                                                 |
| `GET / PUT`                 | `/api/v1/tenants/{tenantId}/guardrail-policy`           | Read or update which configurable guardrail checks a tenant has opted into           |
| `GET / POST / PUT / DELETE` | `/api/v1/tenants/{tenantId}/repo-links[/{skillId}]`     | Register, update, or remove a git-native release link                                |
| `GET / POST`                | `/api/v1/tenants/{tenantId}/members`                    | List or invite tenant members                                                        |
| `GET`                       | `/api/v1/tenants/{tenantId}/audit-export`               | Export the tenant's audit log                                                        |
| `POST / GET / PUT / DELETE` | `/api/v1/drafts[/{draftId}]`                            | Create, read, edit, or discard a draft                                               |
| `POST`                      | `/api/v1/drafts/{draftId}/validate`                     | Structural validation + guardrails scan, no publish                                  |
| `POST`                      | `/api/v1/drafts/{draftId}/publish`                      | Re-validates, then publishes; a BLOCK finding halts before any write                 |
| `POST`                      | `/api/v1/auth/google · /login · /refresh`               | Sign-in and session refresh                                                          |

## Guardrails service endpoints

| Method | Path             | Purpose                                                          |
| ------ | ---------------- | ---------------------------------------------------------------- |
| `GET`  | `/catalog`       | Every rule's metadata — no auth, static data                     |
| `POST` | `/scan`          | Runs the catalog (+ any `customRules`) against a package's files |
| `POST` | `/validate-rule` | Schema + config + regex check on one rule — no files, no scan    |
| `GET`  | `/healthz`       | `{ "status": "ok", "ruleCount": 19 }` — for readiness probes     |