Home → Architecture → APIs

APIs

Ironmark's UI is a client of its own REST API — every action the browser can take is available as an HTTP call. That makes automation, CI-style publish, and third-party integration first-class rather than bolted on.

Surface

• Versioned — /api/v1/. Breaking changes bump the version; additive changes land in place.
• OpenAPI — the running server publishes its own OpenAPI document. Generated clients stay honest.
• JSON in / JSON out — except where the content is a file (XML source, IADS package, PDF, graphic).

Auth

Two paths into the API:

• Session cookie — same auth the browser UI uses. Suitable for interactive tools that log the user in.
• API tokens — per-user, self-issued from the user's profile page. Scope is HTTP-method-based (api_readonly permits any GET; api_full permits any method). The token then acts as its owning user — the user's role and project membership limit what any call resolves to. Revocable. Recommended for scripts, CI, and integration jobs so a script's blast radius matches a real user.

Tokens don't broaden access. A token issued by an author who can reach projects A and B can hit A and B; nothing else.

Notification surface

Notifications fire on document state changes, review transitions, publish completion, and audit events. Delivery paths:

• Email — per-user preferences (see workflow/review).
• Pull — for consumers that would rather poll, the audit log endpoint is the source of truth. Consistent with the zero-outbound-by-default posture, Ironmark doesn't push events to third-party endpoints on its own.

Common integration shapes

Scheduled publish from CI

A CI job holds a scoped API token. On a schedule, it calls the publish endpoint, waits on the job to complete, downloads the artifact, and deposits it in the delivery share. Ironmark's audit log records the CI user's action as it would any human's.

Asset-registry sync

Programs that maintain their asset registry (serials, tail numbers, MDS) in an external system push into Ironmark's PCT via API. Applicability preview picks the new asset up on the next filter.

Ingest from an external LSA system

The GEIA-STD-0007 ingest flow (workflow/applicability) can be driven from the API. External LSA cuts a baseline → posts to Ironmark → the master project preview shows dispositions → CI or a human commits.

Related

← Back to Architecture