The routes that exist.

Public. Reports an engineering preview. It describes the service state without claiming a commercial connection.

Signed-in owner, bearer token. Create a workspace, save an immutable mandate, revoke it, and read that organization’s audit events, pending approvals, invites, and receipts.

Signed-in owner. The studio’s policy lab. A purchase or contract is refused. An over-cap proposal becomes an approval. The check stays inside the product.

Signed-in owner. Accept or reject one exact proposal. Accept means sandbox discussion.

The owner creates a one-time link. The other party accepts, declines, or withdraws with the invited email and four acknowledgements. The raw token is not stored.

After consent, the browser can ask for a capped session, read status, and end it. The session capability is the authority. The page does not send the owner’s money cap.

Called by the voice provider with its own authentication. They check a proposal, read an owner decision, and can accept a signed post-call callback. The callback is not registered, so it has not produced a live receipt.

The owner can download the app transcript JSON or delete that app copy. Provider deletion is separate.