{
  "description": "The GraphQL schemas DeviceChain serves, one file per functional area and auth plane. These are generated from the schemas the services parse at startup, so they cannot drift from the running API. Introspection is disabled by default on a DeviceChain instance, which makes these files the way to read the API without deploying one.",
  "endpointPattern": "https://<your-host>{endpoint} — the ingress routes /api/<area> to that area's service and strips the prefix, so the request arrives at the service's own mount.",
  "baseUrl": "https://docs.devicechain.io",
  "planes": {
    "tenant": {
      "token": "tenant access token",
      "description": "The ordinary application plane. Obtain a tenant access token by calling login then selectTenant on user-management, and authorize each call with the capability it names (for example device:write)."
    },
    "identity": {
      "token": "identity token",
      "description": "Instance-scoped administration. Takes the identity token login returns BEFORE a tenant is selected, and is authorized for the superuser or an operator. A tenant access token is rejected here."
    },
    "service": {
      "token": "service token",
      "description": "Called by another DeviceChain service, not by an application. Documented for completeness; there is no supported way for a tenant client to call it."
    }
  },
  "areas": [
    {
      "area": "ai-inference",
      "plane": "identity",
      "token": "identity token",
      "endpoint": "/api/ai-inference/admin/graphql",
      "schema": "https://docs.devicechain.io/schema/ai-inference-admin.graphql"
    },
    {
      "area": "ai-inference",
      "plane": "service",
      "token": "service token",
      "endpoint": "/api/ai-inference/graphql",
      "schema": "https://docs.devicechain.io/schema/ai-inference.graphql",
      "note": "Called by event-processing under its own service token when compiling a natural-language rule description. Not reachable with a tenant access token."
    },
    {
      "area": "command-delivery",
      "plane": "tenant",
      "token": "tenant access token",
      "endpoint": "/api/command-delivery/graphql",
      "schema": "https://docs.devicechain.io/schema/command-delivery.graphql"
    },
    {
      "area": "dashboard-management",
      "plane": "tenant",
      "token": "tenant access token",
      "endpoint": "/api/dashboard-management/graphql",
      "schema": "https://docs.devicechain.io/schema/dashboard-management.graphql"
    },
    {
      "area": "device-management",
      "plane": "tenant",
      "token": "tenant access token",
      "endpoint": "/api/device-management/graphql",
      "schema": "https://docs.devicechain.io/schema/device-management.graphql"
    },
    {
      "area": "device-state",
      "plane": "tenant",
      "token": "tenant access token",
      "endpoint": "/api/device-state/graphql",
      "schema": "https://docs.devicechain.io/schema/device-state.graphql"
    },
    {
      "area": "event-management",
      "plane": "tenant",
      "token": "tenant access token",
      "endpoint": "/api/event-management/graphql",
      "schema": "https://docs.devicechain.io/schema/event-management.graphql"
    },
    {
      "area": "event-processing",
      "plane": "tenant",
      "token": "tenant access token",
      "endpoint": "/api/event-processing/graphql",
      "schema": "https://docs.devicechain.io/schema/event-processing.graphql"
    },
    {
      "area": "event-sources",
      "api": false,
      "note": "Inbound device transport. It has no GraphQL API of its own — the schema in the repository declares a placeholder field only, because the runtime requires a non-empty type. Telemetry reaches this service over MQTT and NATS, not here."
    },
    {
      "area": "notification-management",
      "plane": "tenant",
      "token": "tenant access token",
      "endpoint": "/api/notification-management/graphql",
      "schema": "https://docs.devicechain.io/schema/notification-management.graphql"
    },
    {
      "area": "outbound-connectors",
      "plane": "tenant",
      "token": "tenant access token",
      "endpoint": "/api/outbound-connectors/graphql",
      "schema": "https://docs.devicechain.io/schema/outbound-connectors.graphql"
    },
    {
      "area": "user-management",
      "plane": "identity",
      "token": "identity token",
      "endpoint": "/api/user-management/admin/graphql",
      "schema": "https://docs.devicechain.io/schema/user-management-admin.graphql"
    },
    {
      "area": "user-management",
      "plane": "tenant",
      "token": "tenant access token",
      "endpoint": "/api/user-management/graphql",
      "schema": "https://docs.devicechain.io/schema/user-management.graphql",
      "note": "login and refresh take no token — this is where a tenant access token comes from. Every other field on this schema requires one."
    },
    {
      "area": "user-management",
      "plane": "identity",
      "token": "identity token",
      "endpoint": "/api/user-management/settings/graphql",
      "schema": "https://docs.devicechain.io/schema/user-management-settings.graphql"
    }
  ]
}