OpenAPI reference

HTTP contract between the BAML control plane and data plane

14operations

48schemas

4security schemes

Contract

Version: 0.3.0-proposal
OpenAPI: 3.1.0
JSON Schema: https://json-schema.org/draft/2020-12/schema

Proposal, 2026-09-09. Revised 2026-09-10 for the publisher design. Supersedes the 2026-09-01 scale-out contract (0.2.0-poc). It incorporates the query proof of concept and the S3 storage experiment. The hosted system is not built. Clients generated from earlier versions must regenerate their types and fixtures.

The upload path is one authorize call per flush and one create-only S3 PUT per object. The publisher is the in-process background task that ships the profiler's closed files. Every flush it lists the objects it wants to write: meta segments, data segments, one value pack of small values, and large values and function tables as content-addressed objects. The customer gateway computes each object key from the authenticated scope, checks S3 for each key, and answers per object with a presigned URL or stored. A successful PUT is the end of the upload. There is no per-upload record in Boundary. S3 notifies the projection queue for meta segments and value packs only. The projector ingests packs into the values dataset, projects each execution when its RootEnded record arrives, sends public facts to Boundary and appends private rows to Lance datasets in the customer's bucket.

Boundary services do not connect to the data plane. Data-plane workloads call Boundary over outbound HTTPS and send only registered non-value fields. Evidence, source material, arguments, outputs and errors stay in the customer's bucket.

There are two HTTP surfaces and one queue message in this document:

1. Customer data-plane endpoints are called by the publisher, Studio, the CLI or an agent. They are implemented by the gateway and the query coordinator. 2. Boundary workload endpoints are called by the projector and the query coordinator over outbound HTTPS. 3. The projection queue carries the standard S3 object-created notification.

The identity hierarchy is tenant -> project -> environment. PlanetScale is the system of record for ownership, deployments, catalog versions and the active projection generation per scope. It holds no per-object state. Request scope is always checked against authenticated identity; request JSON is not authority by itself.

Permission names marked by x-baml-permission are provisional and non-exhaustive. Define the final permission set and endpoint mapping during implementation.

Exact surface groups

- id: public-data-plane
  label: Public data-plane API
- id: boundary-workload
  label: Boundary workload API
- id: queue-message
  label: Queue messages

Invariants

Scope comes from authenticated identity, not request JSON alone.
Customer-facing services never expose PlanetScale, S3, SQS or ClickHouse credentials.
An object in the evidence prefix is immutable. Its key is a pure function of scope, stream, plane and sequence, or of scope and CID. Presigned PUT URLs are create-only and bound to one key, size and checksum.
A successful S3 PUT is the only upload success signal. Boundary holds no per-object state.
A meta segment's notification fires only after every data segment it references and every pack, large value and table those segments reference exist in the bucket, because the publisher uploads in that order.
Notifications and queue delivery are at least once. Batch IDs, fact row IDs and Lance row IDs are deterministic from root ID, relation and partition, so an execution is projected exactly once per generation.
The control plane accepts only fields allowed by the registered projection schema.
Resident queries are scoped and budgeted again by the control plane.
A query binds one generation, one catalog version and one Lance version for its whole execution.
Public facts may be visible before their private rows are in Lance; the coordinator reports those rows as private_state pending, never as NULL or a non-match.
Unavailable evidence is reported in queryOutcome, never silently dropped.
Erasure removes the stream's objects from S3 first, then its executions' facts from ClickHouse, then their rows from Lance.
Logs contain IDs and states, not presigned URLs, SQL value literals or evidence bodies.

Authentication

Scheme	Type	Transport	Description
`BoundaryUserJwt`	http	bearer · JWT	Short-lived Boundary-issued user token. It identifies the user and binds the request to one tenant, project and allowed environment set.
`PublisherToken`	http	bearer · JWT	Token presented by the publisher to the customer gateway. It binds the upload to one tenant, project and environment. Issuance and final claims will be defined during implementation.
`WorkloadJwt`	http	bearer · JWT	Short-lived token identifying the data-plane deployment, cell and tenant scope. Permission names are provisional.
`WorkloadMutualTLS`	mutualTLS	—	Mutual TLS identity for data-plane workload calls to Boundary.

Exact security schemes

BoundaryUserJwt:
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: |-
    Short-lived Boundary-issued user token. It identifies the user and binds the
    request to one tenant, project and allowed environment set.
PublisherToken:
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: |-
    Token presented by the publisher to the customer gateway. It binds the
    upload to one tenant, project and environment. Issuance and final claims
    will be defined during implementation.
WorkloadJwt:
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: |-
    Short-lived token identifying the data-plane deployment, cell and tenant
    scope. Permission names are provisional.
WorkloadMutualTLS:
  type: mutualTLS
  description: Mutual TLS identity for data-plane workload calls to Boundary.

Operations

Each operation includes its server, security requirements, parameters, request body, responses, headers, and exact OpenAPI definition.

Data plane uploads

Publisher configuration and per-flush upload authorization implemented by the customer gateway.

GET /v1/publisher/config Read the publisher configuration

Called by the publisher when it starts and every five minutes after that. The gateway validates the publisher token and returns the limits the publisher must apply: whether capture is enabled, the segment and CAS format versions the projector accepts, the flush interval, the object count per authorize call, the large-value threshold, the largest object, the pack entry limit, the shipped-value retention window and the presigned URL lifetime. The response is the same for every publisher in one environment and may be cached until the next refresh.

A 401 or 403 means the publisher token is invalid or does not cover the environment. The publisher stops shipping, keeps its files and retries this call later. A 429 or 503 means back off with jitter and keep the last configuration.

Operation getPublisherConfigCaller profiler publisherOwner data planePermission provisional:evidence:uploadSurface public-data-planeCalled when The publisher starts, or five minutes have passed since it last read the configuration.Order 5

Server

URL	Description	Variables
`https://{dataPlaneHost}`		`{dataPlaneHost}` default `data-plane.example.com`

Security

PublisherToken

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.

Responses

Status	Description	Content	Headers
`200`	Current publisher configuration for the authenticated environment.	`application/json` · PublisherConfig	`Cache-Control` · string · —
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`429`	Concurrency or rate budget exceeded.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Data plane uploads
summary: Read the publisher configuration
description: |-
  Called by the publisher when it starts and every five minutes after that.
  The gateway validates the publisher token and returns the limits the
  publisher must apply: whether capture is enabled, the segment and CAS
  format versions the projector accepts, the flush interval, the object
  count per authorize call, the large-value threshold, the largest object,
  the pack entry limit, the shipped-value retention window and the
  presigned URL lifetime. The response is the same for every publisher in
  one environment and may be cached until the next refresh.

  A 401 or 403 means the publisher token is invalid or does not cover the
  environment. The publisher stops shipping, keeps its files and retries
  this call later. A 429 or 503 means back off with jitter and keep the
  last configuration.
operationId: getPublisherConfig
servers:
- url: https://{dataPlaneHost}
  variables:
    dataPlaneHost:
      default: data-plane.example.com
security:
- PublisherToken: []
x-baml-caller: profiler publisher
x-baml-owner: data plane
x-baml-permission: provisional:evidence:upload
x-baml-surface: public-data-plane
x-baml-called-when: The publisher starts, or five minutes have passed since it last
  read the configuration.
x-baml-order: 5
parameters:
- "$ref": "#/components/parameters/RequestId"
responses:
  '200':
    description: Current publisher configuration for the authenticated environment.
    headers:
      Cache-Control:
        description: Caching directive for the publisher. The starting value is max-age=300.
        schema:
          type: string
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/PublisherConfig"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '429':
    "$ref": "#/components/responses/TooManyRequests"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

POST /v1/uploads/authorize Authorize the objects of one flush

Called by the publisher once per flush, with the list of objects the flush wants to write: meta segments, data segments, value packs, large values and function tables, each with its size and the SHA-256 of its zstd-compressed bytes. The gateway validates the publisher token, computes every object key from the authenticated scope, the stream, the plane and the sequence, or from the scope and the CID, and checks S3 for each key. It answers per object, in request order. An absent object gets state upload_required with a create-only presigned PUT URL bound to that key, size and checksum. A present object with the same checksum gets state stored and no URL. A present object with a different checksum gets state conflict. The publisher then PUTs the function tables, large values and value packs first, then the data segments in sequence order, then the meta segments. A successful PUT is the end of the upload for that object.

Retry rules. Authorization is idempotent: a repeated request for the same objects returns fresh URLs for the same keys, or stored for objects that arrived in the meantime. A PUT that fails its create-only precondition means the object already exists; the publisher re-authorizes it and expects stored. A conflict on a segment or pack is a local bug; the publisher reports it and never overwrites. A conflict on a value or table is treated as stored, because the CID already proves the content.

Limits. A request carries at most max_objects_per_authorize objects from the publisher configuration; a larger flush makes several calls. An object larger than max_object_bytes, or a request with more objects than the limit, returns 413. A 409 is returned only when the authenticated scope cannot be mapped to an evidence prefix, for example a token whose environment is not provisioned for uploads; per-object mismatches are reported as state conflict inside a 200 response. A 401 or 403 means the publisher stops shipping and keeps its files. A 429 or 503 means back off with jitter.

Operation authorizeFlushUploadCaller profiler publisherOwner data planePermission provisional:evidence:uploadSurface public-data-planeCalled when The publisher has collected and compressed the complete files of one flush and needs create-only S3 targets for them.Order 10

Server

URL	Description	Variables
`https://{dataPlaneHost}`		`{dataPlaneHost}` default `data-plane.example.com`

Security

PublisherToken

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.

Request body · required

Content type	Schema	Examples
`application/json`	AuthorizeUploadRequest	—

Responses

Status	Description	Content	Headers
`200`	One entry per requested object, in request order, with its key, its state and, when an upload is required, its presigned URL.	`application/json` · AuthorizeUploadResponse	—
`400`	Invalid request.	`application/json` · ErrorResponse	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`409`	Idempotency, digest or state conflict.	`application/json` · ErrorResponse	—
`413`	Declared or streamed body exceeds its limit.	`application/json` · ErrorResponse	—
`429`	Concurrency or rate budget exceeded.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Data plane uploads
summary: Authorize the objects of one flush
description: |-
  Called by the publisher once per flush, with the list of objects the
  flush wants to write: meta segments, data segments, value packs, large
  values and function tables, each with its size and the SHA-256 of its
  zstd-compressed bytes. The gateway validates the publisher token,
  computes every object key from the authenticated scope, the stream, the
  plane and the sequence, or from the scope and the CID, and checks S3 for
  each key. It answers per object, in request order. An absent object gets
  state upload_required with a create-only presigned PUT URL bound to that
  key, size and checksum. A present object with the same checksum gets
  state stored and no URL. A present object with a different checksum gets
  state conflict. The publisher then PUTs the function tables, large values
  and value packs first, then the data segments in sequence order, then
  the meta segments. A successful PUT is the end of the upload for that
  object.

  Retry rules. Authorization is idempotent: a repeated request for the same
  objects returns fresh URLs for the same keys, or stored for objects that
  arrived in the meantime. A PUT that fails its create-only precondition
  means the object already exists; the publisher re-authorizes it and
  expects stored. A conflict on a segment or pack is a local bug; the
  publisher reports it and never overwrites. A conflict on a value or
  table is treated as stored, because the CID already proves the content.

  Limits. A request carries at most max_objects_per_authorize objects from
  the publisher configuration; a larger flush makes several calls. An
  object larger than max_object_bytes, or a request with more objects than
  the limit, returns 413. A 409 is returned only when the authenticated
  scope cannot be mapped to an evidence prefix, for example a token whose
  environment is not provisioned for uploads; per-object mismatches are
  reported as state conflict inside a 200 response. A 401 or 403 means the
  publisher stops shipping and keeps its files. A 429 or 503 means back off
  with jitter.
operationId: authorizeFlushUpload
servers:
- url: https://{dataPlaneHost}
  variables:
    dataPlaneHost:
      default: data-plane.example.com
security:
- PublisherToken: []
x-baml-caller: profiler publisher
x-baml-owner: data plane
x-baml-permission: provisional:evidence:upload
x-baml-surface: public-data-plane
x-baml-called-when: The publisher has collected and compressed the complete files
  of one flush and needs create-only S3 targets for them.
x-baml-order: 10
parameters:
- "$ref": "#/components/parameters/RequestId"
requestBody:
  required: true
  content:
    application/json:
      schema:
        "$ref": "#/components/schemas/AuthorizeUploadRequest"
responses:
  '200':
    description: One entry per requested object, in request order, with its key, its
      state and, when an upload is required, its presigned URL.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/AuthorizeUploadResponse"
  '400':
    "$ref": "#/components/responses/BadRequest"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '409':
    "$ref": "#/components/responses/Conflict"
  '413':
    "$ref": "#/components/responses/PayloadTooLarge"
  '429':
    "$ref": "#/components/responses/TooManyRequests"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

Data plane query

Public SQL execution and background query jobs implemented by the query coordinator.

POST /v1/query Execute SQL

Called directly by Studio in the user's browser, the CLI or an agent. The query coordinator binds one snapshot: the active projection generation and catalog version from Boundary, and the latest Lance dataset version from the bucket. DataFusion plans the SQL against the logical catalog. Public operations run in Boundary as resident subqueries. Private operations run in the coordinator over Lance.

Each result row is written directly as one JSON object. The final NDJSON line is a query-outcome envelope. A stream ending without an outcome is incomplete. mode must be interactive here; use POST /v1/query-jobs for background work.

Operation executeQueryCaller Studio browser, CLI or agentOwner data planePermission provisional:query:readSurface public-data-planeCalled when Studio in the user's browser, the CLI or an agent submits an interactive query.Order 20

Server

URL	Description	Variables
`https://{dataPlaneHost}`		`{dataPlaneHost}` default `data-plane.example.com`

Security

BoundaryUserJwt

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.

Request body · required

Content type	Schema	Examples
`application/json`	ExecuteQueryRequest	—

Responses

Status	Description	Content	Headers
`200`	NDJSON stream. Zero or more direct row objects are followed by exactly one query-outcome envelope.	`application/x-ndjson` · string	—
`400`	Invalid request.	`application/json` · ErrorResponse	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`413`	Declared or streamed body exceeds its limit.	`application/json` · ErrorResponse	—
`429`	Concurrency or rate budget exceeded.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Stream items

application/x-ndjson row: QueryRow
application/x-ndjson final: QueryOutcomeEnvelope

Exact OpenAPI operation

tags:
- Data plane query
summary: Execute SQL
description: |-
  Called directly by Studio in the user's browser, the CLI or an agent. The
  query coordinator binds one snapshot: the active projection generation and
  catalog version from Boundary, and the latest Lance dataset
  version from the bucket. DataFusion plans the SQL against the logical
  catalog. Public operations run in Boundary as resident subqueries. Private
  operations run in the coordinator over Lance.

  Each result row is written directly as one JSON object. The final NDJSON
  line is a query-outcome envelope. A stream ending without an outcome is
  incomplete. mode must be interactive here; use POST /v1/query-jobs
  for background work.
operationId: executeQuery
servers:
- url: https://{dataPlaneHost}
  variables:
    dataPlaneHost:
      default: data-plane.example.com
security:
- BoundaryUserJwt: []
x-baml-caller: Studio browser, CLI or agent
x-baml-owner: data plane
x-baml-permission: provisional:query:read
x-baml-surface: public-data-plane
x-baml-called-when: Studio in the user's browser, the CLI or an agent submits an interactive
  query.
x-baml-order: 20
parameters:
- "$ref": "#/components/parameters/RequestId"
requestBody:
  required: true
  content:
    application/json:
      schema:
        "$ref": "#/components/schemas/ExecuteQueryRequest"
responses:
  '200':
    description: |-
      NDJSON stream. Zero or more direct row objects are followed by exactly
      one query-outcome envelope.
    content:
      application/x-ndjson:
        schema:
          type: string
          description: NDJSON stream of direct QueryRow objects followed by one QueryOutcomeEnvelope.
        x-baml-stream-items:
          row:
            "$ref": "#/components/schemas/QueryRow"
          final:
            "$ref": "#/components/schemas/QueryOutcomeEnvelope"
  '400':
    "$ref": "#/components/responses/BadRequest"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '413':
    "$ref": "#/components/responses/PayloadTooLarge"
  '429':
    "$ref": "#/components/responses/TooManyRequests"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

POST /v1/query-jobs Start a background query job

Same request as POST /v1/query with mode: background. The coordinator binds the snapshot, validates and plans the SQL, and returns a job ID immediately. The job runs the same plan, reports progress, can be cancelled, and writes its result to the temporary prefix in the bucket. When an interactive query is too costly, POST /v1/query returns a typed error whose remedy points the caller here.

Operation createQueryJobCaller Studio browser, CLI or agentOwner data planePermission provisional:query:readSurface public-data-planeCalled when A caller submits a query with mode background, or an interactive query was too costly.Order 30

Server

URL	Description	Variables
`https://{dataPlaneHost}`		`{dataPlaneHost}` default `data-plane.example.com`

Security

BoundaryUserJwt

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.
`Idempotency-Key`	header	string	yes	minLength `1`maxLength `256`	Stable identifier for the logical mutation.

Request body · required

Content type	Schema	Examples
`application/json`	ExecuteQueryRequest	—

Responses

Status	Description	Content	Headers
`202`	Job accepted in state queued.	`application/json` · QueryJob	—
`400`	Invalid request.	`application/json` · ErrorResponse	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`429`	Concurrency or rate budget exceeded.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Data plane query
summary: Start a background query job
description: |-
  Same request as POST /v1/query with mode: background. The coordinator
  binds the snapshot, validates and plans the SQL, and returns a job ID
  immediately. The job runs the same plan, reports progress, can be
  cancelled, and writes its result to the temporary prefix in the bucket.
  When an interactive query is too costly, POST /v1/query returns a typed
  error whose remedy points the caller here.
operationId: createQueryJob
servers:
- url: https://{dataPlaneHost}
  variables:
    dataPlaneHost:
      default: data-plane.example.com
security:
- BoundaryUserJwt: []
x-baml-caller: Studio browser, CLI or agent
x-baml-owner: data plane
x-baml-permission: provisional:query:read
x-baml-surface: public-data-plane
x-baml-called-when: A caller submits a query with mode background, or an interactive
  query was too costly.
x-baml-order: 30
parameters:
- "$ref": "#/components/parameters/RequestId"
- "$ref": "#/components/parameters/IdempotencyKey"
requestBody:
  required: true
  content:
    application/json:
      schema:
        "$ref": "#/components/schemas/ExecuteQueryRequest"
responses:
  '202':
    description: Job accepted in state queued.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/QueryJob"
  '400':
    "$ref": "#/components/responses/BadRequest"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '429':
    "$ref": "#/components/responses/TooManyRequests"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

GET /v1/query-jobs/{job_id} Read a background query job

Returns the job state, progress, rows produced so far, the bound snapshot, and after success a result_url. Jobs and their results expire at expires_at.

Operation getQueryJobCaller Studio browser, CLI or agentOwner data planePermission provisional:query:readSurface public-data-planeCalled when A caller polls a background job.Order 40

Server

URL	Description	Variables
`https://{dataPlaneHost}`		`{dataPlaneHost}` default `data-plane.example.com`

Security

BoundaryUserJwt

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.
`job_id`	path	string	yes	minLength `1`

Responses

Status	Description	Content	Headers
`200`	Current job state.	`application/json` · QueryJob	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`404`	Resource absent within the authorized scope.	`application/json` · ErrorResponse	—
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Data plane query
summary: Read a background query job
description: |-
  Returns the job state, progress, rows produced so far, the bound snapshot,
  and after success a result_url. Jobs and their results expire at
  expires_at.
operationId: getQueryJob
servers:
- url: https://{dataPlaneHost}
  variables:
    dataPlaneHost:
      default: data-plane.example.com
security:
- BoundaryUserJwt: []
x-baml-caller: Studio browser, CLI or agent
x-baml-owner: data plane
x-baml-permission: provisional:query:read
x-baml-surface: public-data-plane
x-baml-called-when: A caller polls a background job.
x-baml-order: 40
parameters:
- "$ref": "#/components/parameters/RequestId"
- "$ref": "#/components/parameters/JobId"
responses:
  '200':
    description: Current job state.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/QueryJob"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '404':
    "$ref": "#/components/responses/NotFound"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

DELETE /v1/query-jobs/{job_id} Cancel a background query job

Cancels a queued or running job. A job that already reached a final state is returned unchanged. Cancellation is idempotent.

Operation cancelQueryJobCaller Studio browser, CLI or agentOwner data planePermission provisional:query:readSurface public-data-planeCalled when A caller stops a background job.Order 50

Server

URL	Description	Variables
`https://{dataPlaneHost}`		`{dataPlaneHost}` default `data-plane.example.com`

Security

BoundaryUserJwt

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.
`job_id`	path	string	yes	minLength `1`

Responses

Status	Description	Content	Headers
`200`	Job state after the cancel request.	`application/json` · QueryJob	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`404`	Resource absent within the authorized scope.	`application/json` · ErrorResponse	—
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Data plane query
summary: Cancel a background query job
description: |-
  Cancels a queued or running job. A job that already reached a final state
  is returned unchanged. Cancellation is idempotent.
operationId: cancelQueryJob
servers:
- url: https://{dataPlaneHost}
  variables:
    dataPlaneHost:
      default: data-plane.example.com
security:
- BoundaryUserJwt: []
x-baml-caller: Studio browser, CLI or agent
x-baml-owner: data plane
x-baml-permission: provisional:query:read
x-baml-surface: public-data-plane
x-baml-called-when: A caller stops a background job.
x-baml-order: 50
parameters:
- "$ref": "#/components/parameters/RequestId"
- "$ref": "#/components/parameters/JobId"
responses:
  '200':
    description: Job state after the cancel request.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/QueryJob"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '404':
    "$ref": "#/components/responses/NotFound"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

GET /v1/query-jobs/{job_id}/result Download a background query result

Returns the stored result of a succeeded job. The result has the same shape as an interactive response: NDJSON rows followed by one query-outcome envelope. The coordinator either streams the stored file or redirects to a short-lived presigned GET URL for it. A job that has not succeeded returns 409.

Operation getQueryJobResultCaller Studio browser, CLI or agentOwner data planePermission provisional:query:readSurface public-data-planeCalled when A background job has succeeded and the caller fetches its result.Order 60

Server

URL	Description	Variables
`https://{dataPlaneHost}`		`{dataPlaneHost}` default `data-plane.example.com`

Security

BoundaryUserJwt

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.
`job_id`	path	string	yes	minLength `1`

Responses

Status	Description	Content	Headers
`200`	Stored NDJSON result. Rows are followed by exactly one query-outcome envelope.	`application/x-ndjson` · string	—
`303`	Redirect to a short-lived presigned URL for the stored result.	—	`Location` · string · uri · —
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`404`	Resource absent within the authorized scope.	`application/json` · ErrorResponse	—
`409`	Idempotency, digest or state conflict.	`application/json` · ErrorResponse	—
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Stream items

application/x-ndjson row: QueryRow
application/x-ndjson final: QueryOutcomeEnvelope

Exact OpenAPI operation

tags:
- Data plane query
summary: Download a background query result
description: |-
  Returns the stored result of a succeeded job. The result has the same
  shape as an interactive response: NDJSON rows followed by one
  query-outcome envelope. The coordinator either streams the stored file or
  redirects to a short-lived presigned GET URL for it. A job that has not
  succeeded returns 409.
operationId: getQueryJobResult
servers:
- url: https://{dataPlaneHost}
  variables:
    dataPlaneHost:
      default: data-plane.example.com
security:
- BoundaryUserJwt: []
x-baml-caller: Studio browser, CLI or agent
x-baml-owner: data plane
x-baml-permission: provisional:query:read
x-baml-surface: public-data-plane
x-baml-called-when: A background job has succeeded and the caller fetches its result.
x-baml-order: 60
parameters:
- "$ref": "#/components/parameters/RequestId"
- "$ref": "#/components/parameters/JobId"
responses:
  '200':
    description: Stored NDJSON result. Rows are followed by exactly one query-outcome
      envelope.
    content:
      application/x-ndjson:
        schema:
          type: string
          description: NDJSON stream of direct QueryRow objects followed by one QueryOutcomeEnvelope.
        x-baml-stream-items:
          row:
            "$ref": "#/components/schemas/QueryRow"
          final:
            "$ref": "#/components/schemas/QueryOutcomeEnvelope"
  '303':
    description: Redirect to a short-lived presigned URL for the stored result.
    headers:
      Location:
        schema:
          type: string
          format: uri
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '404':
    "$ref": "#/components/responses/NotFound"
  '409':
    "$ref": "#/components/responses/Conflict"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

Data plane erasure

Evidence erasure implemented by the customer gateway.

POST /v1/erasures Request evidence erasure

Called by an operator with erasure permission. The gateway resolves the selector to streams and to the root IDs of the executions those streams hold, then runs the erasure in order. It deletes the stream's meta segments, data segments and value packs from S3 first, then the executions' facts from ClickHouse through POST /projection-erasures, then their rows from Lance. Erasure is per stream, because a data segment holds groups of many executions of the same process; a selected execution removes the whole stream that contains it. Large values and function tables in the CAS prefix are shared across streams and are removed only when no remaining stream in the scope references them; the reference count over remaining streams is an open implementation decision. Replay cannot restore an erased stream because its source is gone. Repeating a request with the same idempotency key returns the same erasure.

Operation createErasureCaller CLI or Studio with erasure permissionOwner data planePermission provisional:evidence:eraseSurface public-data-planeCalled when An operator asks to remove evidence for selected streams, executions or a time range.Order 70

Server

URL	Description	Variables
`https://{dataPlaneHost}`		`{dataPlaneHost}` default `data-plane.example.com`

Security

BoundaryUserJwt

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.
`Idempotency-Key`	header	string	yes	minLength `1`maxLength `256`	Stable identifier for the logical mutation.

Request body · required

Content type	Schema	Examples
`application/json`	ErasureRequest	—

Responses

Status	Description	Content	Headers
`202`	Erasure accepted and queued.	`application/json` · Erasure	—
`400`	Invalid request.	`application/json` · ErrorResponse	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`409`	Idempotency, digest or state conflict.	`application/json` · ErrorResponse	—
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Data plane erasure
summary: Request evidence erasure
description: |-
  Called by an operator with erasure permission. The gateway resolves the
  selector to streams and to the root IDs of the executions those streams
  hold, then runs the erasure in order. It deletes the stream's meta
  segments, data segments and value packs from S3 first, then the
  executions' facts from ClickHouse through POST /projection-erasures,
  then their rows from Lance. Erasure is per stream, because a data
  segment holds groups of many executions of the same process; a selected
  execution removes the whole stream that contains it. Large values and
  function tables in the CAS prefix are shared across streams and are
  removed only when no remaining stream in the scope references them;
  the reference count over remaining streams is an open implementation
  decision. Replay cannot restore an erased stream because
  its source is gone. Repeating a request with the same idempotency key
  returns the same erasure.
operationId: createErasure
servers:
- url: https://{dataPlaneHost}
  variables:
    dataPlaneHost:
      default: data-plane.example.com
security:
- BoundaryUserJwt: []
x-baml-caller: CLI or Studio with erasure permission
x-baml-owner: data plane
x-baml-permission: provisional:evidence:erase
x-baml-surface: public-data-plane
x-baml-called-when: An operator asks to remove evidence for selected streams, executions
  or a time range.
x-baml-order: 70
parameters:
- "$ref": "#/components/parameters/RequestId"
- "$ref": "#/components/parameters/IdempotencyKey"
requestBody:
  required: true
  content:
    application/json:
      schema:
        "$ref": "#/components/schemas/ErasureRequest"
responses:
  '202':
    description: Erasure accepted and queued.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/Erasure"
  '400':
    "$ref": "#/components/responses/BadRequest"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '409':
    "$ref": "#/components/responses/Conflict"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

GET /v1/erasures/{erasure_id} Read an erasure

Returns the erasure state and the number of streams matched and deleted so far.

Operation getErasureCaller CLI or Studio with erasure permissionOwner data planePermission provisional:evidence:eraseSurface public-data-planeCalled when An operator polls an erasure.Order 80

Server

URL	Description	Variables
`https://{dataPlaneHost}`		`{dataPlaneHost}` default `data-plane.example.com`

Security

BoundaryUserJwt

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.
`erasure_id`	path	string	yes	minLength `1`

Responses

Status	Description	Content	Headers
`200`	Current erasure state.	`application/json` · Erasure	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`404`	Resource absent within the authorized scope.	`application/json` · ErrorResponse	—
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Data plane erasure
summary: Read an erasure
description: Returns the erasure state and the number of streams matched and deleted
  so far.
operationId: getErasure
servers:
- url: https://{dataPlaneHost}
  variables:
    dataPlaneHost:
      default: data-plane.example.com
security:
- BoundaryUserJwt: []
x-baml-caller: CLI or Studio with erasure permission
x-baml-owner: data plane
x-baml-permission: provisional:evidence:erase
x-baml-surface: public-data-plane
x-baml-called-when: An operator polls an erasure.
x-baml-order: 80
parameters:
- "$ref": "#/components/parameters/RequestId"
- "$ref": "#/components/parameters/ErasureId"
responses:
  '200':
    description: Current erasure state.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/Erasure"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '404':
    "$ref": "#/components/responses/NotFound"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

Boundary workload projection

Projection ingest and schema registry operations implemented by Boundary and called by the projector.

PUT /projection-batches/{batch_id} Upload a projection batch

Called by the projector with one deterministic Arrow batch of public facts for one execution, relation and partition. batch_id is derived from the execution's root_id, relation and partition, so a redelivered meta segment projects the same execution into the same batch IDs and the same rows. Boundary checks the scope, the registered relation schema and the content digest, writes the batch to ClickHouse and answers only after the rows are visible.

Idempotent within one generation. A retry with the same batch_id, generation and content_digest returns 200 without writing again. The same batch_id and generation with a different digest returns 409. A rebuild into a new generation reuses the same batch IDs. The Arrow schema must match the registered relation exactly. Value bodies, unregistered string columns and unknown fields are rejected.

Operation putProjectionBatchCaller data-plane projectorOwner control planePermission provisional:projection:writeSurface boundary-workloadCalled when The projector has read one execution's RootEnded record and its data range and built one public fact batch.Order 10

Server

URL	Description	Variables
`https://api.boundaryml.com/studio-data/v1`		—

Security

WorkloadJwt + WorkloadMutualTLS

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.
`batch_id`	path	string	yes	minLength `1`maxLength `256`pattern `^[A-Za-z0-9._:-]+$`	Deterministic batch ID derived from the execution's root ID, relation and partition.
`Content-Encoding`	header	string	yes	const `zstd`
`X-Baml-Root-Id`	header	RootId	yes	—	Root ID of the execution the batch was built from.
`X-Baml-Project-Id`	header	string	yes	—
`X-Baml-Environment-Id`	header	string	yes	—
`X-Baml-Relation`	header	string	yes	minLength `1`	Registered relation name, for example `calls_v1`.
`X-Baml-Partition`	header	integer	yes	minimum `0`	Partition index of this batch within the execution and relation, starting at 0.
`X-Baml-Projection-Generation`	header	string	yes	minLength `1`	Projection generation the batch belongs to. Must be the active generation for the scope.
`X-Baml-Content-Digest`	header	Digest	yes	—	SHA-256 digest of the uncompressed Arrow IPC body.

Request body · required

Content type	Schema	Examples
`application/vnd.apache.arrow.stream`	string · binary	—

Responses

Status	Description	Content	Headers
`200`	Identical retry of a batch that is already visible.	`application/json` · ProjectionBatchResponse	—
`201`	New projection batch written and visible.	`application/json` · ProjectionBatchResponse	—
`400`	Invalid request.	`application/json` · ErrorResponse	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`409`	Idempotency, digest or state conflict.	`application/json` · ErrorResponse	—
`413`	Declared or streamed body exceeds its limit.	`application/json` · ErrorResponse	—
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Boundary workload projection
summary: Upload a projection batch
description: |-
  Called by the projector with one deterministic Arrow batch of public facts
  for one execution, relation and partition. batch_id is derived from the
  execution's root_id, relation and partition, so a redelivered meta
  segment projects the same execution into the same batch IDs and the
  same rows. Boundary checks the scope, the
  registered relation schema and the content digest, writes the batch to
  ClickHouse and answers only after the rows are visible.

  Idempotent within one generation. A retry with the same batch_id,
  generation and content_digest returns 200 without writing again. The
  same batch_id and generation with a different digest returns 409. A
  rebuild into a new generation reuses the same batch IDs. The Arrow schema must match the
  registered relation exactly. Value bodies, unregistered string columns and
  unknown fields are rejected.
operationId: putProjectionBatch
servers:
- url: https://api.boundaryml.com/studio-data/v1
security:
- WorkloadJwt: []
  WorkloadMutualTLS: []
x-baml-caller: data-plane projector
x-baml-owner: control plane
x-baml-permission: provisional:projection:write
x-baml-surface: boundary-workload
x-baml-called-when: The projector has read one execution's RootEnded record and its
  data range and built one public fact batch.
x-baml-order: 10
parameters:
- "$ref": "#/components/parameters/RequestId"
- "$ref": "#/components/parameters/BatchId"
- "$ref": "#/components/parameters/ContentEncodingZstd"
- "$ref": "#/components/parameters/ProjectionRootId"
- "$ref": "#/components/parameters/ProjectionProjectId"
- "$ref": "#/components/parameters/ProjectionEnvironmentId"
- "$ref": "#/components/parameters/ProjectionRelation"
- "$ref": "#/components/parameters/ProjectionPartition"
- "$ref": "#/components/parameters/ProjectionGeneration"
- "$ref": "#/components/parameters/ProjectionContentDigest"
requestBody:
  required: true
  content:
    application/vnd.apache.arrow.stream:
      schema:
        type: string
        format: binary
responses:
  '200':
    description: Identical retry of a batch that is already visible.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/ProjectionBatchResponse"
  '201':
    description: New projection batch written and visible.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/ProjectionBatchResponse"
  '400':
    "$ref": "#/components/responses/BadRequest"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '409':
    "$ref": "#/components/responses/Conflict"
  '413':
    "$ref": "#/components/responses/PayloadTooLarge"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

POST /projection-erasures Delete projected facts for executions

Called by the gateway during an erasure, after the streams' objects are deleted from S3. Boundary deletes every fact row whose root_id is listed, in the given generation and the authenticated scope, and answers after the delete is visible. Idempotent: executions with no remaining facts count as deleted.

Operation createProjectionErasureCaller data-plane gatewayOwner control planePermission provisional:projection:eraseSurface boundary-workloadCalled when An erasure has removed the selected streams' objects from S3.Order 20

Server

URL	Description	Variables
`https://api.boundaryml.com/studio-data/v1`		—

Security

WorkloadJwt + WorkloadMutualTLS

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.
`Idempotency-Key`	header	string	yes	minLength `1`maxLength `256`	Stable identifier for the logical mutation.

Request body · required

Content type	Schema	Examples
`application/json`	ProjectionErasureRequest	—

Responses

Status	Description	Content	Headers
`200`	Facts deleted and the delete is visible.	`application/json` · ProjectionErasureResponse	—
`400`	Invalid request.	`application/json` · ErrorResponse	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Boundary workload projection
summary: Delete projected facts for executions
description: |-
  Called by the gateway during an erasure, after the streams' objects are
  deleted from S3. Boundary deletes every fact row whose root_id is
  listed, in the given generation and the authenticated scope, and answers
  after the delete is visible. Idempotent: executions with no remaining
  facts count as deleted.
operationId: createProjectionErasure
servers:
- url: https://api.boundaryml.com/studio-data/v1
security:
- WorkloadJwt: []
  WorkloadMutualTLS: []
x-baml-caller: data-plane gateway
x-baml-owner: control plane
x-baml-permission: provisional:projection:erase
x-baml-surface: boundary-workload
x-baml-called-when: An erasure has removed the selected streams' objects from S3.
x-baml-order: 20
parameters:
- "$ref": "#/components/parameters/RequestId"
- "$ref": "#/components/parameters/IdempotencyKey"
requestBody:
  required: true
  content:
    application/json:
      schema:
        "$ref": "#/components/schemas/ProjectionErasureRequest"
responses:
  '200':
    description: Facts deleted and the delete is visible.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/ProjectionErasureResponse"
  '400':
    "$ref": "#/components/responses/BadRequest"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

GET /projection-schemas/{catalog_version} Read registered projection schemas

Returns the registered relation schemas for one catalog version. The projector produces batches that match these schemas exactly. The response is static per catalog version and may be cached.

Operation getProjectionSchemasCaller data-plane projector or query coordinatorOwner control planePermission provisional:projection:readSurface boundary-workloadCalled when A projector or coordinator starts, or the catalog version changes.Order 30

Server

URL	Description	Variables
`https://api.boundaryml.com/studio-data/v1`		—

Security

WorkloadJwt + WorkloadMutualTLS

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.
`catalog_version`	path	string	yes	minLength `1`

Responses

Status	Description	Content	Headers
`200`	Registered relation schemas for the catalog version.	`application/json` · ProjectionSchemaSet	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`404`	Resource absent within the authorized scope.	`application/json` · ErrorResponse	—
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Boundary workload projection
summary: Read registered projection schemas
description: |-
  Returns the registered relation schemas for one catalog version. The
  projector produces batches that match these schemas exactly. The
  response is static per catalog version and may be cached.
operationId: getProjectionSchemas
servers:
- url: https://api.boundaryml.com/studio-data/v1
security:
- WorkloadJwt: []
  WorkloadMutualTLS: []
x-baml-caller: data-plane projector or query coordinator
x-baml-owner: control plane
x-baml-permission: provisional:projection:read
x-baml-surface: boundary-workload
x-baml-called-when: A projector or coordinator starts, or the catalog version changes.
x-baml-order: 30
parameters:
- "$ref": "#/components/parameters/RequestId"
- "$ref": "#/components/parameters/CatalogVersionPath"
responses:
  '200':
    description: Registered relation schemas for the catalog version.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/ProjectionSchemaSet"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '404':
    "$ref": "#/components/responses/NotFound"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

Boundary workload query

Snapshot and ClickHouse-resident query operations implemented by Boundary and called by the query coordinator.

POST /query-snapshots Create a query snapshot

Called by the query coordinator when a query starts. The snapshot binds the authenticated tenant, project and environment scope to one catalog version and the active projection generation. The call is cheap and the coordinator caches the result until expires_at. The Lance dataset version is bound by the coordinator from the bucket, not by Boundary.

Operation createQuerySnapshotCaller data-plane query coordinatorOwner control planePermission provisional:resident-query:executeSurface boundary-workloadCalled when A query starts and the coordinator has no cached snapshot for its scope.Order 40

Server

URL	Description	Variables
`https://api.boundaryml.com/studio-data/v1`		—

Security

WorkloadJwt + WorkloadMutualTLS

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.

Request body · required

Content type	Schema	Examples
`application/json`	CreateQuerySnapshotRequest	—

Responses

Status	Description	Content	Headers
`200`	Snapshot bound to the active generation.	`application/json` · QuerySnapshot	—
`400`	Invalid request.	`application/json` · ErrorResponse	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Boundary workload query
summary: Create a query snapshot
description: |-
  Called by the query coordinator when a query starts. The snapshot binds the
  authenticated tenant, project and environment scope to one catalog version
  and the active projection generation. The call is cheap and the
  coordinator caches the result until expires_at. The Lance dataset
  version is bound by the coordinator from the bucket, not by Boundary.
operationId: createQuerySnapshot
servers:
- url: https://api.boundaryml.com/studio-data/v1
security:
- WorkloadJwt: []
  WorkloadMutualTLS: []
x-baml-caller: data-plane query coordinator
x-baml-owner: control plane
x-baml-permission: provisional:resident-query:execute
x-baml-surface: boundary-workload
x-baml-called-when: A query starts and the coordinator has no cached snapshot for
  its scope.
x-baml-order: 40
parameters:
- "$ref": "#/components/parameters/RequestId"
requestBody:
  required: true
  content:
    application/json:
      schema:
        "$ref": "#/components/schemas/CreateQuerySnapshotRequest"
responses:
  '200':
    description: Snapshot bound to the active generation.
    content:
      application/json:
        schema:
          "$ref": "#/components/schemas/QuerySnapshot"
  '400':
    "$ref": "#/components/responses/BadRequest"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

POST /resident-queries Execute a ClickHouse-resident subquery

Called by the query coordinator for the public part of a plan. This is not raw ClickHouse SQL. Boundary parses the subquery again, permits only resident relations and operators, injects the authenticated scope, applies the budget and compiles ClickHouse SQL. The response is an Arrow IPC stream of public facts. It never contains value bodies. The generation that served the query is returned in a response header and in the Arrow schema metadata.

Operation executeResidentQueryCaller data-plane query coordinatorOwner control planePermission provisional:resident-query:executeSurface boundary-workloadCalled when The plan contains a ClickHouse-resident part.Order 50

Server

URL	Description	Variables
`https://api.boundaryml.com/studio-data/v1`		—

Security

WorkloadJwt + WorkloadMutualTLS

Parameters

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.

Request body · required

Content type	Schema	Examples
`application/json`	ResidentQueryRequest	—

Responses

Status	Description	Content	Headers
`200`	Arrow stream containing the resident result.	`application/vnd.apache.arrow.stream` · string · binary	`X-Baml-Snapshot-Id` · string · — `X-Baml-Projection-Generation` · string · —
`400`	Invalid request.	`application/json` · ErrorResponse	—
`401`	Missing or invalid identity.	`application/json` · ErrorResponse	—
`403`	Valid identity without required scope.	`application/json` · ErrorResponse	—
`413`	Declared or streamed body exceeds its limit.	`application/json` · ErrorResponse	—
`429`	Concurrency or rate budget exceeded.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`
`503`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact OpenAPI operation

tags:
- Boundary workload query
summary: Execute a ClickHouse-resident subquery
description: |-
  Called by the query coordinator for the public part of a plan. This is not
  raw ClickHouse SQL. Boundary parses the subquery again, permits only
  resident relations and operators, injects the authenticated scope, applies
  the budget and compiles ClickHouse SQL. The response is an Arrow IPC
  stream of public facts. It never contains value bodies. The generation
  that served the query is returned in a response header and in the Arrow
  schema metadata.
operationId: executeResidentQuery
servers:
- url: https://api.boundaryml.com/studio-data/v1
security:
- WorkloadJwt: []
  WorkloadMutualTLS: []
x-baml-caller: data-plane query coordinator
x-baml-owner: control plane
x-baml-permission: provisional:resident-query:execute
x-baml-surface: boundary-workload
x-baml-called-when: The plan contains a ClickHouse-resident part.
x-baml-order: 50
parameters:
- "$ref": "#/components/parameters/RequestId"
requestBody:
  required: true
  content:
    application/json:
      schema:
        "$ref": "#/components/schemas/ResidentQueryRequest"
responses:
  '200':
    description: Arrow stream containing the resident result.
    headers:
      X-Baml-Snapshot-Id:
        description: Present when the request named a snapshot.
        schema:
          type: string
      X-Baml-Projection-Generation:
        description: Generation that served the query.
        schema:
          type: string
    content:
      application/vnd.apache.arrow.stream:
        schema:
          type: string
          format: binary
  '400':
    "$ref": "#/components/responses/BadRequest"
  '401':
    "$ref": "#/components/responses/Unauthorized"
  '403':
    "$ref": "#/components/responses/Forbidden"
  '413':
    "$ref": "#/components/responses/PayloadTooLarge"
  '429':
    "$ref": "#/components/responses/TooManyRequests"
  '503':
    "$ref": "#/components/responses/DependencyUnavailable"

Message contracts

s3ObjectCreatedMeta segment or value pack arrived in the evidence bucket

S3 sends this notification to the projection queue when an object with the suffix .bamlmeta.zst or .bamlpack.zst is created under the evidence prefix. For a value pack the projector ingests its entries into the values dataset in Lance, keyed by CID, so duplicates collapse. For a meta segment the projector decodes it and, for each RootEnded record, reads that execution's data segments by key, its function table by CID and its values from the values dataset or the CAS prefix, projects public facts to Boundary and private rows to Lance, then deletes the message. A value that is not yet ingested leaves the message for a retry. Delivery is at least once; a duplicate produces the same batch IDs and the same rows. A failed run leaves the message to be redelivered after the visibility timeout and, after the retry limit, moves it to the dead-letter queue. The replay tool emits a message of the same shape for meta segments and packs that are in the bucket but whose executions or values are not in ClickHouse or Lance.

transport AWS SQS Standard with a dead-letter queueproducer Amazon S3 event notifications or the replay toolconsumer data-plane projectordelivery at-least-onceinteraction one-wayowner data-plane projectorcalled_when S3 stores a new meta segment or value pack, or the replay tool enqueues a missing one.surface queue-messageorder 10

payload S3ObjectCreatedNotification

Field	Type	Required	Constraints	Description
`Records`	array<S3EventRecord>	yes	minItems `1`

Exact message contract

summary: Meta segment or value pack arrived in the evidence bucket
description: |-
  S3 sends this notification to the projection queue when an object with the
  suffix .bamlmeta.zst or .bamlpack.zst is created under the evidence
  prefix. For a value pack the projector ingests its entries into the values
  dataset in Lance, keyed by CID, so duplicates collapse. For a meta segment
  the projector decodes it and, for each RootEnded record, reads that
  execution's data segments by key, its function table by CID and its
  values from the values dataset or the CAS prefix, projects public facts to
  Boundary and private rows to Lance, then deletes the message. A value that
  is not yet ingested leaves the message for a retry. Delivery is at least
  once; a duplicate produces the same batch IDs and the same rows. A failed
  run leaves the message to be redelivered after the visibility timeout and,
  after the retry limit, moves it to the dead-letter queue. The replay tool
  emits a message of the same shape for meta segments and packs that are in
  the bucket but whose executions or values are not in ClickHouse or Lance.
owner: data-plane projector
called_when: S3 stores a new meta segment or value pack, or the replay tool enqueues
  a missing one.
surface: queue-message
order: 10
interaction: one-way
transport: AWS SQS Standard with a dead-letter queue
delivery: at-least-once
producer: Amazon S3 event notifications or the replay tool
consumer: data-plane projector
schema:
  "$ref": "#/components/schemas/S3ObjectCreatedNotification"

Reusable components

Parameters

RequestIdparameter

Name	In	Type	Required	Constraints	Description
`X-Baml-Request-Id`	header	string	yes	minLength `1`	Caller-generated request ID. UUIDv7 is recommended.

Exact component

name: X-Baml-Request-Id
in: header
required: true
description: Caller-generated request ID. UUIDv7 is recommended.
schema:
  type: string
  minLength: 1

IdempotencyKeyparameter

Name	In	Type	Required	Constraints	Description
`Idempotency-Key`	header	string	yes	minLength `1`maxLength `256`	Stable identifier for the logical mutation.

Exact component

name: Idempotency-Key
in: header
required: true
description: Stable identifier for the logical mutation.
schema:
  type: string
  minLength: 1
  maxLength: 256

BatchIdparameter

Name	In	Type	Required	Constraints	Description
`batch_id`	path	string	yes	minLength `1`maxLength `256`pattern `^[A-Za-z0-9._:-]+$`	Deterministic batch ID derived from the execution's root ID, relation and partition.

Exact component

name: batch_id
in: path
required: true
description: Deterministic batch ID derived from the execution's root ID, relation
  and partition.
schema:
  type: string
  minLength: 1
  maxLength: 256
  pattern: "^[A-Za-z0-9._:-]+$"

JobIdparameter

Name	In	Type	Required	Constraints	Description
`job_id`	path	string	yes	minLength `1`

Exact component

name: job_id
in: path
required: true
schema:
  type: string
  minLength: 1

ErasureIdparameter

Name	In	Type	Required	Constraints	Description
`erasure_id`	path	string	yes	minLength `1`

Exact component

name: erasure_id
in: path
required: true
schema:
  type: string
  minLength: 1

CatalogVersionPathparameter

Name	In	Type	Required	Constraints	Description
`catalog_version`	path	string	yes	minLength `1`

Exact component

name: catalog_version
in: path
required: true
schema:
  type: string
  minLength: 1

ContentEncodingZstdparameter

Name	In	Type	Required	Constraints	Description
`Content-Encoding`	header	string	yes	const `zstd`

Exact component

name: Content-Encoding
in: header
required: true
schema:
  type: string
  const: zstd

ProjectionRootIdparameter

Name	In	Type	Required	Constraints	Description
`X-Baml-Root-Id`	header	RootId	yes	—	Root ID of the execution the batch was built from.

Exact component

name: X-Baml-Root-Id
in: header
required: true
description: Root ID of the execution the batch was built from.
schema:
  "$ref": "#/components/schemas/RootId"

ProjectionProjectIdparameter

Name	In	Type	Required	Constraints	Description
`X-Baml-Project-Id`	header	string	yes	—

Exact component

name: X-Baml-Project-Id
in: header
required: true
schema:
  type: string

ProjectionEnvironmentIdparameter

Name	In	Type	Required	Constraints	Description
`X-Baml-Environment-Id`	header	string	yes	—

Exact component

name: X-Baml-Environment-Id
in: header
required: true
schema:
  type: string

ProjectionRelationparameter

Name	In	Type	Required	Constraints	Description
`X-Baml-Relation`	header	string	yes	minLength `1`	Registered relation name, for example `calls_v1`.

Exact component

name: X-Baml-Relation
in: header
required: true
description: Registered relation name, for example `calls_v1`.
schema:
  type: string
  minLength: 1

ProjectionPartitionparameter

Name	In	Type	Required	Constraints	Description
`X-Baml-Partition`	header	integer	yes	minimum `0`	Partition index of this batch within the execution and relation, starting at 0.

Exact component

name: X-Baml-Partition
in: header
required: true
description: Partition index of this batch within the execution and relation, starting
  at 0.
schema:
  type: integer
  minimum: 0

ProjectionGenerationparameter

Name	In	Type	Required	Constraints	Description
`X-Baml-Projection-Generation`	header	string	yes	minLength `1`	Projection generation the batch belongs to. Must be the active generation for the scope.

Exact component

name: X-Baml-Projection-Generation
in: header
required: true
description: Projection generation the batch belongs to. Must be the active generation
  for the scope.
schema:
  type: string
  minLength: 1

ProjectionContentDigestparameter

Name	In	Type	Required	Constraints	Description
`X-Baml-Content-Digest`	header	Digest	yes	—	SHA-256 digest of the uncompressed Arrow IPC body.

Exact component

name: X-Baml-Content-Digest
in: header
required: true
description: SHA-256 digest of the uncompressed Arrow IPC body.
schema:
  "$ref": "#/components/schemas/Digest"

Responses

BadRequestresponse

Status	Description	Content	Headers
`component`	Invalid request.	`application/json` · ErrorResponse	—

Exact component

description: Invalid request.
content:
  application/json:
    schema:
      "$ref": "#/components/schemas/ErrorResponse"

Unauthorizedresponse

Status	Description	Content	Headers
`component`	Missing or invalid identity.	`application/json` · ErrorResponse	—

Exact component

description: Missing or invalid identity.
content:
  application/json:
    schema:
      "$ref": "#/components/schemas/ErrorResponse"

Forbiddenresponse

Status	Description	Content	Headers
`component`	Valid identity without required scope.	`application/json` · ErrorResponse	—

Exact component

description: Valid identity without required scope.
content:
  application/json:
    schema:
      "$ref": "#/components/schemas/ErrorResponse"

NotFoundresponse

Status	Description	Content	Headers
`component`	Resource absent within the authorized scope.	`application/json` · ErrorResponse	—

Exact component

description: Resource absent within the authorized scope.
content:
  application/json:
    schema:
      "$ref": "#/components/schemas/ErrorResponse"

Conflictresponse

Status	Description	Content	Headers
`component`	Idempotency, digest or state conflict.	`application/json` · ErrorResponse	—

Exact component

description: Idempotency, digest or state conflict.
content:
  application/json:
    schema:
      "$ref": "#/components/schemas/ErrorResponse"

PayloadTooLargeresponse

Status	Description	Content	Headers
`component`	Declared or streamed body exceeds its limit.	`application/json` · ErrorResponse	—

Exact component

description: Declared or streamed body exceeds its limit.
content:
  application/json:
    schema:
      "$ref": "#/components/schemas/ErrorResponse"

TooManyRequestsresponse

Status	Description	Content	Headers
`component`	Concurrency or rate budget exceeded.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact component

description: Concurrency or rate budget exceeded.
headers:
  Retry-After:
    schema:
      type: integer
      minimum: 0
content:
  application/json:
    schema:
      "$ref": "#/components/schemas/ErrorResponse"

DependencyUnavailableresponse

Status	Description	Content	Headers
`component`	Retryable dependency failure.	`application/json` · ErrorResponse	`Retry-After` · integer · minimum `0`

Exact component

description: Retryable dependency failure.
headers:
  Retry-After:
    schema:
      type: integer
      minimum: 0
content:
  application/json:
    schema:
      "$ref": "#/components/schemas/ErrorResponse"

Schemas

Each schema includes field requirements, validation constraints, and its exact JSON Schema definition.

Digest0 properties

SHA-256 digest with a sha256: prefix and 64 lowercase hex digits.

Type string

Constraints

examples sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdefpattern ^sha256:[0-9a-f]{64}$

Exact JSON Schema

type: string
description: SHA-256 digest with a `sha256:` prefix and 64 lowercase hex digits.
pattern: "^sha256:[0-9a-f]{64}$"
examples:
- sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

ProcessEuid0 properties

Stream identifier. The 32 lowercase hex digits of the profiler process's euid. Every segment and pack key of the stream contains it.

Type string

Constraints

examples 3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69pattern ^[0-9a-f]{32}$

Exact JSON Schema

type: string
description: Stream identifier. The 32 lowercase hex digits of the profiler process's
  euid. Every segment and pack key of the stream contains it.
pattern: "^[0-9a-f]{32}$"
examples:
- 3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69

FlushId0 properties

ULID assigned by the publisher to one flush. It names the flush's value pack objects and correlates the authorize call with its PUTs.

Type string

Constraints

examples 01J8ZK3V5N4Q2W8X7Y6T5R4E3Dpattern ^[0-7][0-9A-HJKMNP-TV-Z]{25}$

Exact JSON Schema

type: string
description: ULID assigned by the publisher to one flush. It names the flush's value
  pack objects and correlates the authorize call with its PUTs.
pattern: "^[0-7][0-9A-HJKMNP-TV-Z]{25}$"
examples:
- 01J8ZK3V5N4Q2W8X7Y6T5R4E3D

ValueCid0 properties

Content identifier of a CAS body. The bamlv_1_ prefix followed by 64 lowercase hex digits. The CID identifies the decompressed body, not the zstd object.

Type string

Constraints

examples bamlv_1_ab5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5dpattern ^bamlv_1_[0-9a-f]{64}$

Exact JSON Schema

type: string
description: Content identifier of a CAS body. The `bamlv_1_` prefix followed by 64
  lowercase hex digits. The CID identifies the decompressed body, not the zstd object.
pattern: "^bamlv_1_[0-9a-f]{64}$"
examples:
- bamlv_1_ab5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d

RootId0 properties

Root ID of one execution, as recorded in its RootStarted and RootEnded records. It is the execution ID in the public catalog and the key for every deterministic projection ID.

Type string

Constraints

examples exec_01J8ZK2A9B8C7D6E5F4G3H2J1KminLength 1maxLength 256

Exact JSON Schema

type: string
description: Root ID of one execution, as recorded in its `RootStarted` and `RootEnded`
  records. It is the execution ID in the public catalog and the key for every deterministic
  projection ID.
minLength: 1
maxLength: 256
examples:
- exec_01J8ZK2A9B8C7D6E5F4G3H2J1K

ObjectChecksum0 properties

SHA-256 of the zstd-compressed object as 64 lowercase hex digits. S3 verifies it on the PUT and the gateway compares it against a stored object.

Type string

Constraints

examples 4f2a9c1e7b3d5a6f8e0c1b2a3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60pattern ^[0-9a-f]{64}$

Exact JSON Schema

type: string
description: SHA-256 of the zstd-compressed object as 64 lowercase hex digits. S3
  verifies it on the PUT and the gateway compares it against a stored object.
pattern: "^[0-9a-f]{64}$"
examples:
- 4f2a9c1e7b3d5a6f8e0c1b2a3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60

TenantScope3 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints
`tenant_id`	string	yes	—
`project_id`	string	yes	—
`environment_id`	string	yes	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- tenant_id
- project_id
- environment_id
properties:
  tenant_id:
    type: string
  project_id:
    type: string
  environment_id:
    type: string

TimeRange2 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`start`	string · date-time	yes	—
`end`	string · date-time	yes	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- start
- end
properties:
  start:
    type: string
    format: date-time
  end:
    type: string
    format: date-time

PublisherConfig10 properties

Limits and switches the publisher applies. The gateway serves one configuration per environment. Values can change without a runtime release; the publisher re-reads them every five minutes. The values shown in the example are the starting values.

Type object

Constraints

examples

{"capture_enabled":true,"supported_segment_versions":[2],"supported_cas_versions":[1],"flush_interval_seconds":5,"max_objects_per_authorize":100,"large_value_threshold_bytes":32768,"max_object_bytes":268435456,"pack_max_entry_bytes":8388608,"shipped_value_retention_seconds":3600,"upload_url_ttl_seconds":900}

additionalProperties false

Property	Type	Required	Constraints	Description
`capture_enabled`	boolean	yes	—	When false the publisher ships nothing and keeps its files within the profiler's disk budget until a later configuration turns capture on.
`supported_segment_versions`	array<integer>	yes	minItems `1`uniqueItems `true`	Segment header versions the projector accepts. A segment with another version is not shipped and is reported. The frozen value is 2.
`supported_cas_versions`	array<integer>	yes	minItems `1`uniqueItems `true`	CAS frame format versions the projector accepts, for values and function tables. The frozen value is 1.
`flush_interval_seconds`	integer	yes	minimum `1`	Seconds between publisher flushes. A flush also starts when pending bytes exceed `pack_max_entry_bytes` and on shutdown. The starting value is 5, and 1 on Lambda.
`max_objects_per_authorize`	integer	yes	minimum `1`	Largest number of objects in one `POST /v1/uploads/authorize` request. A flush with more objects makes several calls.
`large_value_threshold_bytes`	integer	yes	minimum `1`	Values at or above this size ship as their own CAS object under `cas/values/`. Smaller values travel in the flush's value pack.
`max_object_bytes`	integer	yes	minimum `1`	Largest compressed object the gateway authorizes. A larger object is refused with 413 and reported by the publisher.
`pack_max_entry_bytes`	integer	yes	minimum `1`	Largest total size of original value bytes in one value pack. A flush with more starts another pack.
`shipped_value_retention_seconds`	integer	yes	minimum `0`	How long the publisher keeps a shipped value or table file, with its `.shipped` marker, before removing both. Disk pressure may shorten it.
`upload_url_ttl_seconds`	integer	yes	minimum `1`	Lifetime of a presigned PUT URL from the moment it is issued. The publisher re-authorizes an object whose URL expired.

Exact JSON Schema

type: object
additionalProperties: false
description: |-
  Limits and switches the publisher applies. The gateway serves one
  configuration per environment. Values can change without a runtime
  release; the publisher re-reads them every five minutes. The values
  shown in the example are the starting values.
required:
- capture_enabled
- supported_segment_versions
- supported_cas_versions
- flush_interval_seconds
- max_objects_per_authorize
- large_value_threshold_bytes
- max_object_bytes
- pack_max_entry_bytes
- shipped_value_retention_seconds
- upload_url_ttl_seconds
properties:
  capture_enabled:
    type: boolean
    description: When false the publisher ships nothing and keeps its files within
      the profiler's disk budget until a later configuration turns capture on.
  supported_segment_versions:
    type: array
    minItems: 1
    uniqueItems: true
    items:
      type: integer
      minimum: 1
    description: Segment header versions the projector accepts. A segment with another
      version is not shipped and is reported. The frozen value is 2.
  supported_cas_versions:
    type: array
    minItems: 1
    uniqueItems: true
    items:
      type: integer
      minimum: 1
    description: CAS frame format versions the projector accepts, for values and function
      tables. The frozen value is 1.
  flush_interval_seconds:
    type: integer
    minimum: 1
    description: Seconds between publisher flushes. A flush also starts when pending
      bytes exceed `pack_max_entry_bytes` and on shutdown. The starting value is 5,
      and 1 on Lambda.
  max_objects_per_authorize:
    type: integer
    minimum: 1
    description: Largest number of objects in one `POST /v1/uploads/authorize` request.
      A flush with more objects makes several calls.
  large_value_threshold_bytes:
    type: integer
    minimum: 1
    description: Values at or above this size ship as their own CAS object under `cas/values/`.
      Smaller values travel in the flush's value pack.
  max_object_bytes:
    type: integer
    minimum: 1
    description: Largest compressed object the gateway authorizes. A larger object
      is refused with 413 and reported by the publisher.
  pack_max_entry_bytes:
    type: integer
    minimum: 1
    description: Largest total size of original value bytes in one value pack. A flush
      with more starts another pack.
  shipped_value_retention_seconds:
    type: integer
    minimum: 0
    description: How long the publisher keeps a shipped value or table file, with
      its `.shipped` marker, before removing both. Disk pressure may shorten it.
  upload_url_ttl_seconds:
    type: integer
    minimum: 1
    description: Lifetime of a presigned PUT URL from the moment it is issued. The
      publisher re-authorizes an object whose URL expired.
examples:
- capture_enabled: true
  supported_segment_versions:
  - 2
  supported_cas_versions:
  - 1
  flush_interval_seconds: 5
  max_objects_per_authorize: 100
  large_value_threshold_bytes: 32768
  max_object_bytes: 268435456
  pack_max_entry_bytes: 8388608
  shipped_value_retention_seconds: 3600
  upload_url_ttl_seconds: 900

SegmentUploadObject4 properties

One meta or data segment of the flush's stream. The key is derived from the scope, the stream, the plane and the sequence.

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`kind`	string	yes	enum `meta_segment`, `data_segment`
`sequence`	integer	yes	minimum `1`	Sequence number of the segment within its plane. Sequences are dense per stream per plane and start at 1.
`size_bytes`	integer	yes	minimum `1`	Exact size of the zstd-compressed object.
`checksum_sha256`	ObjectChecksum	yes	—

Exact JSON Schema

type: object
additionalProperties: false
description: One meta or data segment of the flush's stream. The key is derived from
  the scope, the stream, the plane and the sequence.
required:
- kind
- sequence
- size_bytes
- checksum_sha256
properties:
  kind:
    type: string
    enum:
    - meta_segment
    - data_segment
  sequence:
    type: integer
    minimum: 1
    description: Sequence number of the segment within its plane. Sequences are dense
      per stream per plane and start at 1.
  size_bytes:
    type: integer
    minimum: 1
    description: Exact size of the zstd-compressed object.
  checksum_sha256:
    "$ref": "#/components/schemas/ObjectChecksum"

ValuePackUploadObject4 properties

One value pack built from the flush's small values. The key is derived from the scope, the stream and the flush ID.

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`kind`	string	yes	const `value_pack`
`size_bytes`	integer	yes	minimum `1`	Exact size of the zstd-compressed object.
`checksum_sha256`	ObjectChecksum	yes	—
`entry_count`	integer	yes	minimum `1`maximum `100000`	Number of value entries in the pack manifest.

Exact JSON Schema

type: object
additionalProperties: false
description: One value pack built from the flush's small values. The key is derived
  from the scope, the stream and the flush ID.
required:
- kind
- size_bytes
- checksum_sha256
- entry_count
properties:
  kind:
    type: string
    const: value_pack
  size_bytes:
    type: integer
    minimum: 1
    description: Exact size of the zstd-compressed object.
  checksum_sha256:
    "$ref": "#/components/schemas/ObjectChecksum"
  entry_count:
    type: integer
    minimum: 1
    maximum: 100000
    description: Number of value entries in the pack manifest.

ValueUploadObject5 properties

One large value. The key is derived from the scope and the CID under cas/values/.

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`kind`	string	yes	const `value`
`cid`	ValueCid	yes	—
`codec`	integer	yes	const `1`	CAS codec. Codec 1 is a value body.
`size_bytes`	integer	yes	minimum `1`	Exact size of the zstd-compressed object.
`checksum_sha256`	ObjectChecksum	yes	—

Exact JSON Schema

type: object
additionalProperties: false
description: One large value. The key is derived from the scope and the CID under
  `cas/values/`.
required:
- kind
- cid
- codec
- size_bytes
- checksum_sha256
properties:
  kind:
    type: string
    const: value
  cid:
    "$ref": "#/components/schemas/ValueCid"
  codec:
    type: integer
    const: 1
    description: CAS codec. Codec 1 is a value body.
  size_bytes:
    type: integer
    minimum: 1
    description: Exact size of the zstd-compressed object.
  checksum_sha256:
    "$ref": "#/components/schemas/ObjectChecksum"

TableUploadObject5 properties

One function table. The key is derived from the scope and the CID under cas/tables/.

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`kind`	string	yes	const `table`
`cid`	ValueCid	yes	—
`codec`	integer	yes	const `2`	CAS codec. Codec 2 is a function table.
`size_bytes`	integer	yes	minimum `1`	Exact size of the zstd-compressed object.
`checksum_sha256`	ObjectChecksum	yes	—

Exact JSON Schema

type: object
additionalProperties: false
description: One function table. The key is derived from the scope and the CID under
  `cas/tables/`.
required:
- kind
- cid
- codec
- size_bytes
- checksum_sha256
properties:
  kind:
    type: string
    const: table
  cid:
    "$ref": "#/components/schemas/ValueCid"
  codec:
    type: integer
    const: 2
    description: CAS codec. Codec 2 is a function table.
  size_bytes:
    type: integer
    minimum: 1
    description: Exact size of the zstd-compressed object.
  checksum_sha256:
    "$ref": "#/components/schemas/ObjectChecksum"

UploadObject0 properties

One object of a flush. Exactly one of the four shapes applies, selected by kind.

Type SegmentUploadObject | ValuePackUploadObject | ValueUploadObject | TableUploadObject

Constraints

oneOf SegmentUploadObject · ValuePackUploadObject · ValueUploadObject · TableUploadObject

Exact JSON Schema

description: One object of a flush. Exactly one of the four shapes applies, selected
  by `kind`.
oneOf:
- "$ref": "#/components/schemas/SegmentUploadObject"
- "$ref": "#/components/schemas/ValuePackUploadObject"
- "$ref": "#/components/schemas/ValueUploadObject"
- "$ref": "#/components/schemas/TableUploadObject"

AuthorizeUploadRequest3 properties

Every object of one flush. Each entry is one of the four object shapes, selected by kind. The number of entries is at most max_objects_per_authorize from the publisher configuration.

Type object

Constraints

examples

{"process_euid":"3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69","flush_id":"01J8ZK3V5N4Q2W8X7Y6T5R4E3D","objects":[{"kind":"meta_segment","sequence":41,"size_bytes":1234,"checksum_sha256":"4f2a9c1e7b3d5a6f8e0c1b2a3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60"},{"kind":"data_segment","sequence":120,"size_bytes":880123,"checksum_sha256":"8c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d"},{"kind":"value_pack","size_bytes":410000,"checksum_sha256":"2b7e9d0c1f3a4e5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b","entry_count":812},{"kind":"value","cid":"bamlv_1_ab5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d","codec":1,"size_bytes":71000,"checksum_sha256":"6e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f"},{"kind":"table","cid":"bamlv_1_cd0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e","codec":2,"size_bytes":30000,"checksum_sha256":"9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b"}]}

additionalProperties false

Property	Type	Required	Constraints	Description
`process_euid`	ProcessEuid	yes	—
`flush_id`	FlushId	yes	—
`objects`	array<UploadObject>	yes	minItems `1`	Objects the flush wants to write, in any order. The response lists them in the same order.

Exact JSON Schema

type: object
additionalProperties: false
description: |-
  Every object of one flush. Each entry is one of the four object shapes,
  selected by `kind`. The number of entries is at most
  `max_objects_per_authorize` from the publisher configuration.
required:
- process_euid
- flush_id
- objects
properties:
  process_euid:
    "$ref": "#/components/schemas/ProcessEuid"
  flush_id:
    "$ref": "#/components/schemas/FlushId"
  objects:
    type: array
    minItems: 1
    items:
      "$ref": "#/components/schemas/UploadObject"
    description: Objects the flush wants to write, in any order. The response lists
      them in the same order.
examples:
- process_euid: 3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69
  flush_id: 01J8ZK3V5N4Q2W8X7Y6T5R4E3D
  objects:
  - kind: meta_segment
    sequence: 41
    size_bytes: 1234
    checksum_sha256: 4f2a9c1e7b3d5a6f8e0c1b2a3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60
  - kind: data_segment
    sequence: 120
    size_bytes: 880123
    checksum_sha256: 8c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d
  - kind: value_pack
    size_bytes: 410000
    checksum_sha256: 2b7e9d0c1f3a4e5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b
    entry_count: 812
  - kind: value
    cid: bamlv_1_ab5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d
    codec: 1
    size_bytes: 71000
    checksum_sha256: 6e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f
  - kind: table
    cid: bamlv_1_cd0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e
    codec: 2
    size_bytes: 30000
    checksum_sha256: 9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b

AuthorizedObject8 properties

The gateway's answer for one requested object. sequence is present for segments and cid for values and tables; a value pack has neither and is matched by position. With state: upload_required the publisher PUTs the object to upload_url with every header in required_headers before expires_at. With state: stored an object with the same key and checksum already exists and the upload of this object is complete. With state: conflict an object with the same key and a different checksum exists; the publisher never overwrites it. upload_url, required_headers and expires_at are absent unless the state is upload_required.

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`kind`	string	yes	enum `meta_segment`, `data_segment`, `value_pack`, `value`, `table`
`sequence`	integer	no	minimum `1`	Present for meta and data segments.
`cid`	ValueCid	no	—	Present for values and tables.
`key`	string	yes	pattern `^evidence/v1/.+\.zst$`	Object key computed by the gateway. Segments and packs live under the stream prefix; values and tables under the scope's CAS prefix.
`state`	string	yes	enum `upload_required`, `stored`, `conflict`
`upload_url`	string · uri	no	—	Create-only presigned S3 PUT URL bound to the key, size and checksum.
`required_headers`	object	no	additionalProperties string	Headers the publisher must send unchanged on the PUT. Always includes `If-None-Match`, `x-amz-checksum-sha256` and `Content-Length`.
`expires_at`	string · date-time	no	—	When the presigned URL stops working. Re-authorize the object after this time.

Exact JSON Schema

type: object
additionalProperties: false
description: |-
  The gateway's answer for one requested object. `sequence` is present for
  segments and `cid` for values and tables; a value pack has neither and is
  matched by position. With `state: upload_required` the publisher PUTs
  the object to `upload_url` with every header in `required_headers`
  before `expires_at`. With `state: stored` an object with the same key
  and checksum already exists and the upload of this object is complete.
  With `state: conflict` an object with the same key and a different
  checksum exists; the publisher never overwrites it. `upload_url`,
  `required_headers` and `expires_at` are absent unless the state is
  `upload_required`.
required:
- kind
- key
- state
properties:
  kind:
    type: string
    enum:
    - meta_segment
    - data_segment
    - value_pack
    - value
    - table
  sequence:
    type: integer
    minimum: 1
    description: Present for meta and data segments.
  cid:
    "$ref": "#/components/schemas/ValueCid"
    description: Present for values and tables.
  key:
    type: string
    pattern: "^evidence/v1/.+\\.zst$"
    description: Object key computed by the gateway. Segments and packs live under
      the stream prefix; values and tables under the scope's CAS prefix.
  state:
    type: string
    enum:
    - upload_required
    - stored
    - conflict
  upload_url:
    type: string
    format: uri
    description: Create-only presigned S3 PUT URL bound to the key, size and checksum.
  required_headers:
    type: object
    description: Headers the publisher must send unchanged on the PUT. Always includes
      `If-None-Match`, `x-amz-checksum-sha256` and `Content-Length`.
    additionalProperties:
      type: string
  expires_at:
    type: string
    format: date-time
    description: When the presigned URL stops working. Re-authorize the object after
      this time.

AuthorizeUploadResponse2 properties

One entry per requested object, in request order.

Type object

Constraints

examples

{"flush_id":"01J8ZK3V5N4Q2W8X7Y6T5R4E3D","objects":[{"kind":"meta_segment","sequence":41,"key":"evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/meta/00000000000000000041.bamlmeta.zst","state":"upload_required","upload_url":"https://acme-baml-evidence.s3.us-east-1.amazonaws.com/evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/meta/00000000000000000041.bamlmeta.zst?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900","required_headers":{"If-None-Match":"*","x-amz-checksum-sha256":"TyqcHns9Wm+ODBsqPU5fYHGCk6S1xtfo+QobLD1OX2A=","Content-Length":"1234"},"expires_at":"2026-09-10T10:30:07Z"},{"kind":"data_segment","sequence":120,"key":"evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/data/00000000000000000120.bamldata.zst","state":"upload_required","upload_url":"https://acme-baml-evidence.s3.us-east-1.amazonaws.com/evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/data/00000000000000000120.bamldata.zst?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900","required_headers":{"If-None-Match":"*","x-amz-checksum-sha256":"jB0uP0pbbH2OnwobLD1OX2p7jJ0OHyo7TF1uf4qbDB0=","Content-Length":"880123"},"expires_at":"2026-09-10T10:30:07Z"},{"kind":"value_pack","key":"evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/values/01J8ZK3V5N4Q2W8X7Y6T5R4E3D.bamlpack.zst","state":"upload_required","upload_url":"https://acme-baml-evidence.s3.us-east-1.amazonaws.com/evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/values/01J8ZK3V5N4Q2W8X7Y6T5R4E3D.bamlpack.zst?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900","required_headers":{"If-None-Match":"*","x-amz-checksum-sha256":"K36dDB86TltsfY6fChssPU5fanuMnQ4fKjtMXW5/ips=","Content-Length":"410000"},"expires_at":"2026-09-10T10:30:07Z"},{"kind":"value","cid":"bamlv_1_ab5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d","key":"evidence/v1/tn_acme/prj_billing/env_prod/cas/values/ab/ab5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d.bamlvalue.zst","state":"stored"},{"kind":"table","cid":"bamlv_1_cd0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e","key":"evidence/v1/tn_acme/prj_billing/env_prod/cas/tables/cd/cd0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e.bamltable.zst","state":"stored"}]}

additionalProperties false

Property	Type	Required	Constraints	Description
`flush_id`	FlushId	yes	—
`objects`	array<AuthorizedObject>	yes	minItems `1`

Exact JSON Schema

type: object
additionalProperties: false
description: One entry per requested object, in request order.
required:
- flush_id
- objects
properties:
  flush_id:
    "$ref": "#/components/schemas/FlushId"
  objects:
    type: array
    minItems: 1
    items:
      "$ref": "#/components/schemas/AuthorizedObject"
examples:
- flush_id: 01J8ZK3V5N4Q2W8X7Y6T5R4E3D
  objects:
  - kind: meta_segment
    sequence: 41
    key: evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/meta/00000000000000000041.bamlmeta.zst
    state: upload_required
    upload_url: https://acme-baml-evidence.s3.us-east-1.amazonaws.com/evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/meta/00000000000000000041.bamlmeta.zst?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900
    required_headers:
      If-None-Match: "*"
      x-amz-checksum-sha256: TyqcHns9Wm+ODBsqPU5fYHGCk6S1xtfo+QobLD1OX2A=
      Content-Length: '1234'
    expires_at: '2026-09-10T10:30:07Z'
  - kind: data_segment
    sequence: 120
    key: evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/data/00000000000000000120.bamldata.zst
    state: upload_required
    upload_url: https://acme-baml-evidence.s3.us-east-1.amazonaws.com/evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/data/00000000000000000120.bamldata.zst?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900
    required_headers:
      If-None-Match: "*"
      x-amz-checksum-sha256: jB0uP0pbbH2OnwobLD1OX2p7jJ0OHyo7TF1uf4qbDB0=
      Content-Length: '880123'
    expires_at: '2026-09-10T10:30:07Z'
  - kind: value_pack
    key: evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/values/01J8ZK3V5N4Q2W8X7Y6T5R4E3D.bamlpack.zst
    state: upload_required
    upload_url: https://acme-baml-evidence.s3.us-east-1.amazonaws.com/evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/values/01J8ZK3V5N4Q2W8X7Y6T5R4E3D.bamlpack.zst?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900
    required_headers:
      If-None-Match: "*"
      x-amz-checksum-sha256: K36dDB86TltsfY6fChssPU5fanuMnQ4fKjtMXW5/ips=
      Content-Length: '410000'
    expires_at: '2026-09-10T10:30:07Z'
  - kind: value
    cid: bamlv_1_ab5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d
    key: evidence/v1/tn_acme/prj_billing/env_prod/cas/values/ab/ab5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d.bamlvalue.zst
    state: stored
  - kind: table
    cid: bamlv_1_cd0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e
    key: evidence/v1/tn_acme/prj_billing/env_prod/cas/tables/cd/cd0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e.bamltable.zst
    state: stored

QueryParameter2 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`type`	string	yes	—
`value`	any	yes	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- type
- value
properties:
  type:
    type: string
  value: true

QueryBudget4 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`max_wall_ms`	integer	yes	minimum `1`
`max_result_rows`	integer	yes	minimum `1`
`max_result_bytes`	integer	yes	minimum `1`
`max_private_bytes_read`	integer	yes	minimum `0`	Upper bound on Lance bytes read for private operations.

Exact JSON Schema

type: object
additionalProperties: false
required:
- max_wall_ms
- max_result_rows
- max_result_bytes
- max_private_bytes_read
properties:
  max_wall_ms:
    type: integer
    minimum: 1
  max_result_rows:
    type: integer
    minimum: 1
  max_result_bytes:
    type: integer
    minimum: 1
  max_private_bytes_read:
    type: integer
    minimum: 0
    description: Upper bound on Lance bytes read for private operations.

ExecuteQueryRequest6 properties

Type object

Constraints

examples

{"sql":"SELECT call_id, fqn, status, duration_ns FROM calls_v1 WHERE execution_id = $1 ORDER BY started_at LIMIT 100","parameters":[{"type":"string","value":"exec_01J8ZK2A9B8C7D6E5F4G3H2J1K"}],"catalog_version":"2026-09-01","budget":{"max_wall_ms":5000,"max_result_rows":1000,"max_result_bytes":8388608,"max_private_bytes_read":268435456},"mode":"interactive"}

additionalProperties false

Property	Type	Required	Constraints	Description
`sql`	string	yes	minLength `1`	Read-only SQL against the logical catalog.
`parameters`	array<QueryParameter>	yes	—
`catalog_version`	string	yes	minLength `1`
`budget`	QueryBudget	yes	—
`mode`	string	no	default `interactive`enum `interactive`, `background`	`POST /v1/query` accepts only `interactive`. `POST /v1/query-jobs` runs the query as `background`.
`environment_id`	string	no	—	Required when the user token allows more than one environment.

Exact JSON Schema

type: object
additionalProperties: false
required:
- sql
- parameters
- catalog_version
- budget
properties:
  sql:
    type: string
    minLength: 1
    description: Read-only SQL against the logical catalog.
  parameters:
    type: array
    items:
      "$ref": "#/components/schemas/QueryParameter"
  catalog_version:
    type: string
    minLength: 1
  budget:
    "$ref": "#/components/schemas/QueryBudget"
  mode:
    type: string
    enum:
    - interactive
    - background
    default: interactive
    description: "`POST /v1/query` accepts only `interactive`. `POST /v1/query-jobs`
      runs the query as `background`."
  environment_id:
    type: string
    description: Required when the user token allows more than one environment.
examples:
- sql: SELECT call_id, fqn, status, duration_ns FROM calls_v1 WHERE execution_id =
    $1 ORDER BY started_at LIMIT 100
  parameters:
  - type: string
    value: exec_01J8ZK2A9B8C7D6E5F4G3H2J1K
  catalog_version: '2026-09-01'
  budget:
    max_wall_ms: 5000
    max_result_rows: 1000
    max_result_bytes: 8388608
    max_private_bytes_read: 268435456
  mode: interactive

QueryRow0 properties

One query result row, encoded directly as a JSON object.

Type object

Constraints

additionalProperties true

Exact JSON Schema

type: object
description: One query result row, encoded directly as a JSON object.
additionalProperties: true

QueryOutcome7 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`queryCompleted`	boolean	yes	—	True when execution reached its natural end, even if the result is incomplete. False after a failure, cancellation or exhausted budget.
`resultState`	string	yes	enum `complete`, `incomplete`, `failed`, `budget_exhausted`, `cancelled`
`snapshot`	QueryExecutionSnapshot	yes	—
`rowsStreamed`	integer	yes	minimum `0`
`valueEvaluations`	ValueEvaluations	yes	—
`privateState`	PrivateStateCounts	yes	—
`error`	QueryOutcomeError	no	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- queryCompleted
- resultState
- snapshot
- rowsStreamed
- valueEvaluations
- privateState
properties:
  queryCompleted:
    type: boolean
    description: True when execution reached its natural end, even if the result is
      incomplete. False after a failure, cancellation or exhausted budget.
  resultState:
    type: string
    enum:
    - complete
    - incomplete
    - failed
    - budget_exhausted
    - cancelled
  snapshot:
    "$ref": "#/components/schemas/QueryExecutionSnapshot"
  rowsStreamed:
    type: integer
    minimum: 0
  valueEvaluations:
    "$ref": "#/components/schemas/ValueEvaluations"
  privateState:
    "$ref": "#/components/schemas/PrivateStateCounts"
  error:
    "$ref": "#/components/schemas/QueryOutcomeError"

QueryExecutionSnapshot4 properties

The one generation, catalog version and Lance version bound for the whole query.

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`snapshotId`	string	no	—
`catalogVersion`	string	yes	—
`generation`	string	yes	—	Active ClickHouse projection generation for the scope.
`lanceVersion`	integer	yes	minimum `0`	Lance dataset version the private part read from.

Exact JSON Schema

type: object
additionalProperties: false
description: The one generation, catalog version and Lance version bound for the whole
  query.
required:
- catalogVersion
- generation
- lanceVersion
properties:
  snapshotId:
    type: string
  catalogVersion:
    type: string
  generation:
    type: string
    description: Active ClickHouse projection generation for the scope.
  lanceVersion:
    type: integer
    minimum: 0
    description: Lance dataset version the private part read from.

ValueEvaluations4 properties

Counts of private values the query needed. Unavailable values are reported here, never silently dropped.

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`attempted`	integer	yes	minimum `0`
`available`	integer	yes	minimum `0`
`unavailable`	integer	yes	minimum `0`
`byReason`	object	yes	additionalProperties integer	Unavailable count per reason. Keys are the catalog availability states `not_captured`, `not_applicable` and `lost:<reason>` (for example `lost:value_too_large`, `lost:queue_full`), plus `pending` for rows whose private rows are not yet in the bound Lance version.

Exact JSON Schema

type: object
additionalProperties: false
description: Counts of private values the query needed. Unavailable values are reported
  here, never silently dropped.
required:
- attempted
- available
- unavailable
- byReason
properties:
  attempted:
    type: integer
    minimum: 0
  available:
    type: integer
    minimum: 0
  unavailable:
    type: integer
    minimum: 0
  byReason:
    type: object
    description: Unavailable count per reason. Keys are the catalog availability states
      `not_captured`, `not_applicable` and `lost:<reason>` (for example `lost:value_too_large`,
      `lost:queue_full`), plus `pending` for rows whose private rows are not yet in
      the bound Lance version.
    additionalProperties:
      type: integer
      minimum: 0

PrivateStateCounts2 properties

Row counts by private_state. indexed counts rows in the result whose private columns were served from the bound Lance version. pending counts rows whose private rows are not yet in it; their public facts are visible but their private part is not.

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`indexed`	integer	yes	minimum `0`
`pending`	integer	yes	minimum `0`

Exact JSON Schema

type: object
additionalProperties: false
description: Row counts by `private_state`. `indexed` counts rows in the result whose
  private columns were served from the bound Lance version. `pending` counts rows
  whose private rows are not yet in it; their public facts are visible but their private
  part is not.
required:
- indexed
- pending
properties:
  indexed:
    type: integer
    minimum: 0
  pending:
    type: integer
    minimum: 0

QueryOutcomeError4 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints
`code`	string	yes	—
`message`	string	yes	—
`retryable`	boolean	yes	—
`remedy`	string	no	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- code
- message
- retryable
properties:
  code:
    type: string
  message:
    type: string
  retryable:
    type: boolean
  remedy:
    type: string

QueryOutcomeEnvelope1 property

Type object

Constraints

examples

{"queryOutcome":{"queryCompleted":true,"resultState":"complete","snapshot":{"snapshotId":"snap_01J8ZK4B2C3D4E5F6G7H8J9K0M","catalogVersion":"2026-09-01","generation":"gen_7","lanceVersion":1842},"rowsStreamed":100,"valueEvaluations":{"attempted":100,"available":97,"unavailable":3,"byReason":{"lost:value_too_large":1,"pending":2}},"privateState":{"indexed":98,"pending":2}}}

additionalProperties false

Property	Type	Required	Constraints	Description
`queryOutcome`	QueryOutcome	yes	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- queryOutcome
properties:
  queryOutcome:
    "$ref": "#/components/schemas/QueryOutcome"
examples:
- queryOutcome:
    queryCompleted: true
    resultState: complete
    snapshot:
      snapshotId: snap_01J8ZK4B2C3D4E5F6G7H8J9K0M
      catalogVersion: '2026-09-01'
      generation: gen_7
      lanceVersion: 1842
    rowsStreamed: 100
    valueEvaluations:
      attempted: 100
      available: 97
      unavailable: 3
      byReason:
        lost:value_too_large: 1
        pending: 2
    privateState:
      indexed: 98
      pending: 2

QueryJobProgress2 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`phase`	string	yes	enum `planning`, `resident`, `private`, `merging`, `writing`
`fraction`	number	yes	minimum `0`maximum `1`	Estimated share of the work done.

Exact JSON Schema

type: object
additionalProperties: false
required:
- phase
- fraction
properties:
  phase:
    type: string
    enum:
    - planning
    - resident
    - private
    - merging
    - writing
  fraction:
    type: number
    minimum: 0
    maximum: 1
    description: Estimated share of the work done.

QueryJob10 properties

Type object

Constraints

examples

{"job_id":"job_01J8ZK5C3D4E5F6G7H8J9K0M1N","state":"running","progress":{"phase":"private","fraction":0.4},"rows_so_far":12000,"snapshot":{"catalogVersion":"2026-09-01","generation":"gen_7","lanceVersion":1842},"created_at":"2026-09-09T10:20:00Z","updated_at":"2026-09-09T10:20:04Z","expires_at":"2026-09-10T10:20:00Z"}

additionalProperties false

Property	Type	Required	Constraints	Description
`job_id`	string	yes	—
`state`	string	yes	enum `queued`, `running`, `succeeded`, `failed`, `cancelled`
`progress`	QueryJobProgress	yes	—
`rows_so_far`	integer	yes	minimum `0`
`snapshot`	QueryExecutionSnapshot	yes	—
`result_url`	string · uri	no	—	Present when state is `succeeded`. Same as `GET /v1/query-jobs/{job_id}/result`.
`error`	QueryOutcomeError	no	—	Present when state is `failed`.
`created_at`	string · date-time	yes	—
`updated_at`	string · date-time	yes	—
`expires_at`	string · date-time	yes	—	When the job record and its stored result are removed.

Exact JSON Schema

type: object
additionalProperties: false
required:
- job_id
- state
- progress
- rows_so_far
- snapshot
- created_at
- updated_at
- expires_at
properties:
  job_id:
    type: string
  state:
    type: string
    enum:
    - queued
    - running
    - succeeded
    - failed
    - cancelled
  progress:
    "$ref": "#/components/schemas/QueryJobProgress"
  rows_so_far:
    type: integer
    minimum: 0
  snapshot:
    "$ref": "#/components/schemas/QueryExecutionSnapshot"
  result_url:
    type: string
    format: uri
    description: Present when state is `succeeded`. Same as `GET /v1/query-jobs/{job_id}/result`.
  error:
    "$ref": "#/components/schemas/QueryOutcomeError"
    description: Present when state is `failed`.
  created_at:
    type: string
    format: date-time
  updated_at:
    type: string
    format: date-time
  expires_at:
    type: string
    format: date-time
    description: When the job record and its stored result are removed.
examples:
- job_id: job_01J8ZK5C3D4E5F6G7H8J9K0M1N
  state: running
  progress:
    phase: private
    fraction: 0.4
  rows_so_far: 12000
  snapshot:
    catalogVersion: '2026-09-01'
    generation: gen_7
    lanceVersion: 1842
  created_at: '2026-09-09T10:20:00Z'
  updated_at: '2026-09-09T10:20:04Z'
  expires_at: '2026-09-10T10:20:00Z'

ErasureRequest3 properties

Exactly one selector must be set.

Type object

Constraints

examples {"process_euids":["3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69"]}minProperties 1maxProperties 1additionalProperties false

Property	Type	Required	Constraints	Description
`process_euids`	array<ProcessEuid>	no	minItems `1`uniqueItems `true`	Selects whole streams by process euid.
`execution_ids`	array<RootId>	no	minItems `1`uniqueItems `true`	Selects the streams that contain these executions. The whole stream is erased.
`time_range`	TimeRange	no	—	Selects every stream with an execution whose start or end falls in this range, resolved through the public facts.

Exact JSON Schema

type: object
additionalProperties: false
description: Exactly one selector must be set.
minProperties: 1
maxProperties: 1
properties:
  process_euids:
    type: array
    minItems: 1
    uniqueItems: true
    items:
      "$ref": "#/components/schemas/ProcessEuid"
    description: Selects whole streams by process euid.
  execution_ids:
    type: array
    minItems: 1
    uniqueItems: true
    items:
      "$ref": "#/components/schemas/RootId"
    description: Selects the streams that contain these executions. The whole stream
      is erased.
  time_range:
    "$ref": "#/components/schemas/TimeRange"
    description: Selects every stream with an execution whose start or end falls in
      this range, resolved through the public facts.
examples:
- process_euids:
  - 3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69

Erasure8 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`erasure_id`	string	yes	—
`state`	string	yes	enum `queued`, `running`, `succeeded`, `failed`
`selector`	ErasureRequest	yes	—
`streams_matched`	integer	yes	minimum `0`	Streams the selector resolved to.
`streams_deleted`	integer	yes	minimum `0`	Streams whose objects, facts and Lance rows are removed so far.
`error`	QueryOutcomeError	no	—	Present when state is `failed`.
`created_at`	string · date-time	yes	—
`updated_at`	string · date-time	yes	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- erasure_id
- state
- selector
- streams_matched
- streams_deleted
- created_at
- updated_at
properties:
  erasure_id:
    type: string
  state:
    type: string
    enum:
    - queued
    - running
    - succeeded
    - failed
  selector:
    "$ref": "#/components/schemas/ErasureRequest"
  streams_matched:
    type: integer
    minimum: 0
    description: Streams the selector resolved to.
  streams_deleted:
    type: integer
    minimum: 0
    description: Streams whose objects, facts and Lance rows are removed so far.
  error:
    "$ref": "#/components/schemas/QueryOutcomeError"
    description: Present when state is `failed`.
  created_at:
    type: string
    format: date-time
  updated_at:
    type: string
    format: date-time

ProjectionBatchResponse6 properties

Type object

Constraints

examples

{"batch_id":"exec_01J8ZK2A9B8C7D6E5F4G3H2J1K.calls_v1.0","root_id":"exec_01J8ZK2A9B8C7D6E5F4G3H2J1K","state":"visible","generation":"gen_7","row_count":3098,"content_digest":"sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"}

additionalProperties false

Property	Type	Required	Constraints
`batch_id`	string	yes	—
`root_id`	RootId	yes	—
`state`	string	yes	const `visible`
`generation`	string	yes	—
`row_count`	integer	yes	minimum `0`
`content_digest`	Digest	yes	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- batch_id
- root_id
- state
- generation
- row_count
- content_digest
properties:
  batch_id:
    type: string
  root_id:
    "$ref": "#/components/schemas/RootId"
  state:
    type: string
    const: visible
  generation:
    type: string
  row_count:
    type: integer
    minimum: 0
  content_digest:
    "$ref": "#/components/schemas/Digest"
examples:
- batch_id: exec_01J8ZK2A9B8C7D6E5F4G3H2J1K.calls_v1.0
  root_id: exec_01J8ZK2A9B8C7D6E5F4G3H2J1K
  state: visible
  generation: gen_7
  row_count: 3098
  content_digest: sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

ProjectionErasureRequest2 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`root_ids`	array<RootId>	yes	minItems `1`maxItems `1000`uniqueItems `true`	Executions whose facts are deleted. The gateway sends the root IDs of every execution in the erased streams.
`generation`	string	yes	minLength `1`

Exact JSON Schema

type: object
additionalProperties: false
required:
- root_ids
- generation
properties:
  root_ids:
    type: array
    minItems: 1
    maxItems: 1000
    uniqueItems: true
    items:
      "$ref": "#/components/schemas/RootId"
    description: Executions whose facts are deleted. The gateway sends the root IDs
      of every execution in the erased streams.
  generation:
    type: string
    minLength: 1

ProjectionErasureResponse3 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints
`state`	string	yes	const `deleted`
`generation`	string	yes	—
`root_ids`	array<RootId>	yes	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- state
- generation
- root_ids
properties:
  state:
    type: string
    const: deleted
  generation:
    type: string
  root_ids:
    type: array
    items:
      "$ref": "#/components/schemas/RootId"

RelationColumn3 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`name`	string	yes	—
`type`	string	yes	—	Arrow data type name.
`nullable`	boolean	yes	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- name
- type
- nullable
properties:
  name:
    type: string
  type:
    type: string
    description: Arrow data type name.
  nullable:
    type: boolean

RelationSchema4 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`relation`	string	yes	—	Relation name, for example `calls_v1`.
`schema_version`	string	yes	—
`columns`	array<RelationColumn>	yes	minItems `1`
`partition_columns`	array<string>	yes	—	Columns that define the deterministic row order within a batch.

Exact JSON Schema

type: object
additionalProperties: false
required:
- relation
- schema_version
- columns
- partition_columns
properties:
  relation:
    type: string
    description: Relation name, for example `calls_v1`.
  schema_version:
    type: string
  columns:
    type: array
    minItems: 1
    items:
      "$ref": "#/components/schemas/RelationColumn"
  partition_columns:
    type: array
    description: Columns that define the deterministic row order within a batch.
    items:
      type: string

ProjectionSchemaSet2 properties

Type object

Constraints

examples

{"catalog_version":"2026-09-01","relations":[{"relation":"calls_v1","schema_version":"1","columns":[{"name":"call_id","type":"utf8","nullable":false},{"name":"execution_id","type":"utf8","nullable":false},{"name":"fqn","type":"utf8","nullable":false},{"name":"args_state","type":"utf8","nullable":false}],"partition_columns":["call_id"]}]}

additionalProperties false

Property	Type	Required	Constraints	Description
`catalog_version`	string	yes	—
`relations`	array<RelationSchema>	yes	minItems `1`

Exact JSON Schema

type: object
additionalProperties: false
required:
- catalog_version
- relations
properties:
  catalog_version:
    type: string
  relations:
    type: array
    minItems: 1
    items:
      "$ref": "#/components/schemas/RelationSchema"
examples:
- catalog_version: '2026-09-01'
  relations:
  - relation: calls_v1
    schema_version: '1'
    columns:
    - name: call_id
      type: utf8
      nullable: false
    - name: execution_id
      type: utf8
      nullable: false
    - name: fqn
      type: utf8
      nullable: false
    - name: args_state
      type: utf8
      nullable: false
    partition_columns:
    - call_id

CreateQuerySnapshotRequest2 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints	Description
`scope`	TenantScope	yes	—
`catalog_version`	string	yes	minLength `1`

Exact JSON Schema

type: object
additionalProperties: false
required:
- scope
- catalog_version
properties:
  scope:
    "$ref": "#/components/schemas/TenantScope"
  catalog_version:
    type: string
    minLength: 1

QuerySnapshot5 properties

Type object

Constraints

examples

{"snapshot_id":"snap_01J8ZK4B2C3D4E5F6G7H8J9K0M","scope":{"tenant_id":"tn_acme","project_id":"prj_billing","environment_id":"env_prod"},"catalog_version":"2026-09-01","generation":"gen_7","expires_at":"2026-09-09T10:21:00Z"}

additionalProperties false

Property	Type	Required	Constraints	Description
`snapshot_id`	string	yes	—
`scope`	TenantScope	yes	—
`catalog_version`	string	yes	—
`generation`	string	yes	—	Active projection generation for the scope.
`expires_at`	string · date-time	yes	—

Exact JSON Schema

type: object
additionalProperties: false
required:
- snapshot_id
- scope
- catalog_version
- generation
- expires_at
properties:
  snapshot_id:
    type: string
  scope:
    "$ref": "#/components/schemas/TenantScope"
  catalog_version:
    type: string
  generation:
    type: string
    description: Active projection generation for the scope.
  expires_at:
    type: string
    format: date-time
examples:
- snapshot_id: snap_01J8ZK4B2C3D4E5F6G7H8J9K0M
  scope:
    tenant_id: tn_acme
    project_id: prj_billing
    environment_id: env_prod
  catalog_version: '2026-09-01'
  generation: gen_7
  expires_at: '2026-09-09T10:21:00Z'

ResidentQueryBudget5 properties

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints
`max_wall_ms`	integer	yes	minimum `1`
`max_rows_read`	integer	yes	minimum `1`
`max_bytes_read`	integer	yes	minimum `1`
`max_result_rows`	integer	yes	minimum `1`
`max_result_bytes`	integer	yes	minimum `1`

Exact JSON Schema

type: object
additionalProperties: false
required:
- max_wall_ms
- max_rows_read
- max_bytes_read
- max_result_rows
- max_result_bytes
properties:
  max_wall_ms:
    type: integer
    minimum: 1
  max_rows_read:
    type: integer
    minimum: 1
  max_bytes_read:
    type: integer
    minimum: 1
  max_result_rows:
    type: integer
    minimum: 1
  max_result_bytes:
    type: integer
    minimum: 1

ResidentQueryRequest6 properties

Exactly one of snapshot_id or generation must be set. catalog_version is required with generation.

Type object

Constraints

additionalProperties false

Property	Type	Required	Constraints
`snapshot_id`	string	no	—
`generation`	string	no	—
`catalog_version`	string	no	—
`sql`	string	yes	minLength `1`
`parameters`	array<QueryParameter>	yes	—
`budget`	ResidentQueryBudget	yes	—

Exact JSON Schema

type: object
additionalProperties: false
description: Exactly one of `snapshot_id` or `generation` must be set. `catalog_version`
  is required with `generation`.
required:
- sql
- parameters
- budget
properties:
  snapshot_id:
    type: string
  generation:
    type: string
  catalog_version:
    type: string
  sql:
    type: string
    minLength: 1
  parameters:
    type: array
    items:
      "$ref": "#/components/schemas/QueryParameter"
  budget:
    "$ref": "#/components/schemas/ResidentQueryBudget"

S3EventBucket2 properties

Type object

Constraints

additionalProperties true

Property	Type	Required	Constraints	Description
`name`	string	yes	—
`arn`	string	no	—

Exact JSON Schema

type: object
additionalProperties: true
required:
- name
properties:
  name:
    type: string
  arn:
    type: string

S3EventObject5 properties

Type object

Constraints

additionalProperties true

Property	Type	Required	Constraints	Description
`key`	string	yes	—	URL-encoded object key of the meta segment or value pack. The suffix tells the projector which one it is.
`size`	integer	yes	minimum `0`
`eTag`	string	yes	—
`versionId`	string	no	—	Present when bucket versioning is on.
`sequencer`	string	no	—

Exact JSON Schema

type: object
additionalProperties: true
required:
- key
- size
- eTag
properties:
  key:
    type: string
    description: URL-encoded object key of the meta segment or value pack. The suffix
      tells the projector which one it is.
  size:
    type: integer
    minimum: 0
  eTag:
    type: string
  versionId:
    type: string
    description: Present when bucket versioning is on.
  sequencer:
    type: string

S3EventRecord6 properties

Type object

Constraints

additionalProperties true

Property	Type	Required	Constraints	Description
`eventVersion`	string	no	—
`eventSource`	string	yes	const `aws:s3`
`awsRegion`	string	no	—
`eventTime`	string · date-time	yes	—
`eventName`	string	yes	—	Object-created event name, for example `ObjectCreated:Put`.
`s3`	object	yes	additionalProperties `true`

Exact JSON Schema

type: object
additionalProperties: true
required:
- eventSource
- eventName
- eventTime
- s3
properties:
  eventVersion:
    type: string
  eventSource:
    type: string
    const: aws:s3
  awsRegion:
    type: string
  eventTime:
    type: string
    format: date-time
  eventName:
    type: string
    description: Object-created event name, for example `ObjectCreated:Put`.
  s3:
    type: object
    additionalProperties: true
    required:
    - bucket
    - object
    properties:
      bucket:
        "$ref": "#/components/schemas/S3EventBucket"
      object:
        "$ref": "#/components/schemas/S3EventObject"

S3ObjectCreatedNotification1 property

Standard Amazon S3 event notification as delivered to SQS. Two notification rules feed the queue: prefix evidence/v1/ with suffix .bamlmeta.zst for meta segments, and the same prefix with suffix .bamlpack.zst for value packs. Data segments and CAS objects do not notify. The projector uses only bucket.name, object.key, object.size, object.eTag and object.versionId. The scope, the stream, the plane and the sequence or flush ID come from the key. The message carries no evidence body, function name or value.

Type object

Constraints

examples

{"Records":[{"eventVersion":"2.1","eventSource":"aws:s3","awsRegion":"us-east-1","eventTime":"2026-09-10T10:15:08.412Z","eventName":"ObjectCreated:Put","s3":{"bucket":{"name":"acme-baml-evidence","arn":"arn:aws:s3:::acme-baml-evidence"},"object":{"key":"evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/meta/00000000000000000041.bamlmeta.zst","size":1234,"eTag":"9b2cf535f27731c974343645a3985328","versionId":"3sL4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nr8X8gdRQBpUMLUo","sequencer":"0055AED6DCD90281E5"}}}]}

{"Records":[{"eventVersion":"2.1","eventSource":"aws:s3","awsRegion":"us-east-1","eventTime":"2026-09-10T10:15:07.988Z","eventName":"ObjectCreated:Put","s3":{"bucket":{"name":"acme-baml-evidence","arn":"arn:aws:s3:::acme-baml-evidence"},"object":{"key":"evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/values/01J8ZK3V5N4Q2W8X7Y6T5R4E3D.bamlpack.zst","size":410000,"eTag":"5d41402abc4b2a76b9719d911017c592","versionId":"7kM2pqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nr8X8gdRQBpUQ9Zt","sequencer":"0055AED6DCD90281D9"}}}]}

additionalProperties true

Property	Type	Required	Constraints	Description
`Records`	array<S3EventRecord>	yes	minItems `1`

Exact JSON Schema

type: object
additionalProperties: true
description: |-
  Standard Amazon S3 event notification as delivered to SQS. Two
  notification rules feed the queue: prefix `evidence/v1/` with suffix
  `.bamlmeta.zst` for meta segments, and the same prefix with suffix
  `.bamlpack.zst` for value packs. Data segments and CAS objects do not
  notify. The projector uses only `bucket.name`, `object.key`,
  `object.size`, `object.eTag` and `object.versionId`. The scope, the
  stream, the plane and the sequence or flush ID come from the key. The
  message carries no evidence body, function name or value.
required:
- Records
properties:
  Records:
    type: array
    minItems: 1
    items:
      "$ref": "#/components/schemas/S3EventRecord"
examples:
- Records:
  - eventVersion: '2.1'
    eventSource: aws:s3
    awsRegion: us-east-1
    eventTime: '2026-09-10T10:15:08.412Z'
    eventName: ObjectCreated:Put
    s3:
      bucket:
        name: acme-baml-evidence
        arn: arn:aws:s3:::acme-baml-evidence
      object:
        key: evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/meta/00000000000000000041.bamlmeta.zst
        size: 1234
        eTag: 9b2cf535f27731c974343645a3985328
        versionId: 3sL4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nr8X8gdRQBpUMLUo
        sequencer: 0055AED6DCD90281E5
- Records:
  - eventVersion: '2.1'
    eventSource: aws:s3
    awsRegion: us-east-1
    eventTime: '2026-09-10T10:15:07.988Z'
    eventName: ObjectCreated:Put
    s3:
      bucket:
        name: acme-baml-evidence
        arn: arn:aws:s3:::acme-baml-evidence
      object:
        key: evidence/v1/tn_acme/prj_billing/env_prod/streams/3f9c2b7e1a4d4c8e9b0f1e2d3c4b5a69/values/01J8ZK3V5N4Q2W8X7Y6T5R4E3D.bamlpack.zst
        size: 410000
        eTag: 5d41402abc4b2a76b9719d911017c592
        versionId: 7kM2pqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nr8X8gdRQBpUQ9Zt
        sequencer: 0055AED6DCD90281D9

ErrorDetail0 properties

Type object

Constraints

additionalProperties true

Exact JSON Schema

type: object
additionalProperties: true

Error5 properties

Type object

Constraints —

Property	Type	Required	Constraints
`code`	string	yes	—
`message`	string	yes	—
`request_id`	string	yes	—
`retryable`	boolean	yes	—
`details`	ErrorDetail	yes	—

Exact JSON Schema

type: object
required:
- code
- message
- request_id
- retryable
- details
properties:
  code:
    type: string
  message:
    type: string
  request_id:
    type: string
  retryable:
    type: boolean
  details:
    "$ref": "#/components/schemas/ErrorDetail"

ErrorResponse1 property

Type object

Constraints —

Property	Type	Required	Constraints	Description
`error`	Error	yes	—

Exact JSON Schema

type: object
required:
- error
properties:
  error:
    "$ref": "#/components/schemas/Error"

No operations or schemas match this filter.