Supported API resources
The versioned API exposes supported resource families for authorised integrations. Availability is determined by the current product version, token scope, user role and tenant entitlement. Do not depend on private browser endpoints or administrator routes discovered through inspection.
Resource families
Section titled “Resource families”Customer integrations commonly work with:
- workspace context available to the token owner;
- AI systems and intake records;
- assessment records and framework scores;
- risks, evidence, tests and findings;
- model cards, remediation and reporting artifacts;
- user-owned tokens and account-security operations where explicitly supported;
- entitled Discovery and agentic governance resources;
- exports permitted by the user’s role.
Use the product documentation for the lifecycle and meaning of each record. The API does not make a field optional merely because an HTTP request can be accepted; governance completeness still depends on the workflow and human decisions.
Integration design
Section titled “Integration design”- Create a dedicated integration user with the minimum role.
- Bind a short-lived token to one workspace and prefer read-only.
- Read the current context and entitlement before attempting a feature.
- Use stable record identifiers, not display names, for reconciliation.
- Validate input and handle partial or incomplete governance states.
- Preserve returned identifiers and timestamps for traceability.
- Re-read the record after a write rather than assuming local state is authoritative.
Unsupported dependency warning
Section titled “Unsupported dependency warning”UI routes, internal administration functions and undocumented response fields may change without public API compatibility guarantees. If a required operation is not documented as supported, contact Gamut before building a production dependency.