Informations
- OpenAPI version:
3.0.3
Overview
Plune API 1.0.0
Section titled “Plune API 1.0.0”Backend API for the Plune eval/TMS platform. Two credential surfaces: a web session cookie (magic-link sign-in) manages CLI tokens; a bearer API token ingests runs from the CLI.
Projects. Every record belongs to a project, and every request acts in exactly one: the one named by the X-Plune-Project header (an id from GET /v1/projects), else your default project. A project you are not a member of answers 404, the same as one that does not exist. A reader is refused every write with 403 read-only member, except two (#1440): creating a comment on a case, a suite or a run, and proposing in the review queue (POST /v1/review-items, created pending; a body that asks for any other state is refused 403). Approving, rejecting and everything else stay with a paid seat. A bearer token is bound to the project it was minted in and ignores the header. /v1/projects stands outside a project — it is how a client learns which ones it may name.
Companies. A company sits above projects (ADR 0038): it has people with a company role and projects whose names every member sees — and it opens none of them. A project is read and written through its own membership only; a member of the company becomes one by joining (POST /v1/companies/{id}/projects/{projectId}/join) or by being added by its owner or a manager, with the project role their company role maps to — owner and manager join as manager: a project has its own one owner (ADR 0050). /v1/companies stands outside a project too; a company you are not in answers 404, the same as one that does not exist.
Roles. A project and a company each have exactly one owner, then manager, member and reader (ADR 0050). Nobody is made the owner by an invitation or a change of role (400, code: use_handover); the owner is never demoted or removed (409 owner_protected) and does not leave (409 owner_must_hand_over); a manager is demoted and removed by the owner alone (403 manager_cannot_touch_manager).
Authentication
Section titled “ Authentication ”bearerAuth
Section titled “bearerAuth ”A CLI API token (plune_…) minted via POST /v1/tokens.
Security scheme type: http
cookieAuth
Section titled “cookieAuth ”The signed, httpOnly session cookie set by GET /v1/auth/verify.
Security scheme type: apiKey
Cookie parameter name: plune_session