HTTP API overview

Complete contract

The generated API reference documents all 35 operations in the checked-in openapi.v1.json. Request bodies, parameters, response schemas, security schemes, and error statuses come directly from that artifact. Download OpenAPI for client generation.

The explorer is read-only: no public registry endpoint is assumed and request execution is disabled. Configure your own generated client with an operator-supplied registry URL.

Authentication boundaries

Public registry reads and local discovery require no session. Protected registry mutations require a scoped MARS capability and Idempotency-Key. SIWS challenges/verification bootstrap a session; signed federation endpoints authenticate peer envelopes. Deep health and peer diagnostics require operator capability.

Client conventions

Use JSON content types, URL-encode DIDs as path segments, retain exact schema field casing, apply request timeouts, and distinguish an empty result from a transport or server error. Do not log bearer tokens or signing secrets.

Source authority

This page describes the checked-in implementation, not the availability of a public registry.

• mars-server/src/api/mod.rs
• mars-server/src/contracts.rs
• docs/api/openapi.v1.json

Session logout is an authentication operation, not a registry mutation: its contract does not require an Idempotency-Key. Follow each generated operation definition.