Appendix E — How this document is produced

Generated on 2026-09-27 from:

• web/public/api-docs/swagger.yaml
• ai/api-docs/openapi.yaml Its x-response-fields, x-reads, x-writes, x-service-role and x-verified-caller are read out of the handlers by scripts/annotate_signatures.py; its x-intent by scripts/annotate_intent.py.

196 operations across 30 resource families.

• Web backend — Next.js route handlers under web/app/api/. Cookie or bearer Supabase authentication.
• AI gateway — FastAPI routers under ai/src/kavai/, served on :8080. 21 of its 28 operations verify a bearer Supabase token; the other seven are health, capability and system-listing reads, plus the AG-UI stream, which forwards a token without verifying it. Generated from the app by scripts/export_openapi.py — regenerate rather than edit.

The AI gateway on :8080 is not covered: it has no OpenAPI specification yet, and a chapter asserting operations nobody generated would be the one kind of page this document exists to avoid. When it has one it becomes a second part here.

Every operation carries a stable operationId — what kavai api takes and what the agent tool surface refers to. The operation index lists them all.

Internal document. It describes every operation the web backend exposes, including those whose authentication is unresolved.

Only the opening pages — Reading this document, What the platform does, What we found and the Glossary — are written by hand. Every other page, and every number on the hand-written ones, is generated. To change what this document says, change a specification or a handler and re-run pixi run docs-api-render.