Reference

The reference quadrant documents typed surfaces — the wire shape of an HTTP endpoint, the props of a frontend component, the contract of a platform helper package. Pages here are flat and specification-shaped: little prose, lots of tables and code blocks. Read them when you need a precise answer to "what does this surface accept and return".

What is here

• API surface map — the tag-by-tag index of every /v1 operation, with one-line summaries and links to the per-tag reference docs. Start here when you need to find the right page for an endpoint.
• Dev stack — the per-dependency reference for the local make dev cluster: image pins, dev-mode flags, prod-deltas, and forward links to the kustomize sources.
• CLI — the plexctl command surface: the top-level reference plus one page per family (login, whoami, bootstrap-token, domain, project, identity, group, label, audit, identity-tokens, domain-idp, rebac, cloud, credential, blueprint, resource, support-bundle, completion).
• Identity HTTP API — the wire shape of the identity-bounded-context endpoints under /v1: auth, identities, IdP bindings, groups, invitations, domains, projects, authz checks and relation tuples, and nodes.
• Audit HTTP API — hash-chained entries, chain verification, and right-to-erasure for the per-Domain audit log.
• Labels HTTP API — Definitions CRUD, selector preview, and per-object Assignments.
• Mesh HTTP API — the per-Node SSE stream, state pull, heartbeat ingest, and reachability projection.
• Meta HTTP API — liveness, version, OpenAPI document, and embedded ReDoc UI. Unauthenticated by design.
• Provisioning HTTP API — BootstrapToken issuance/list/get/revoke and the /v1/register redemption seam.
• OpenBao Credential Broker — per-port API reference for the Custodian / Materialiser / Repository / Sweeper, the four error sentinels, and the four outbox-event schemas. The broker has no /v1 HTTP surface of its own; this page covers the in-process port shapes.
• Platform packages — contracts of the shared cross-cutting helpers under internal/platform/: authz, blobstore, db, http, messaging, secretstore, and the testutil primitives.

When to read this section

• You are integrating with a /v1 endpoint and need the exact request and response shape.
• You are calling into one of the platform packages and want to confirm the function signature and error contract.

For the architectural context behind a surface, jump from the reference page back into the relevant bounded context — the cross-references at the bottom of each reference page point to the right place.