# Latitude 10 docs

Push one OpenAPI document and Latitude 10 keeps every version of it in a registry, then makes it a hosted reference with an API client, a docs site, TypeScript and Python SDKs, and an MCP server for AI agents. These pages say how each one works, what it refuses and where its limits are.

Start with the [quickstart](quickstart), or read [Concepts](get-started/concepts) first.

## Registry

Every push is kept as a version, scored from 0 to 100 by the [readiness rules](registry/readiness-rules) and compared with the version before it for [breaking changes](registry/breaking-changes). Your CI pushes with a project key, through the GitHub Action or one `curl` line. [More about the registry](registry/index).

## Reference

An owner or admin publishes a version as an interactive reference at `/r/<workspace>/<project>`, made from your document with no third-party script on the page. You can embed it on your own site, or keep it on ours. [More about the reference](api-reference/index).

## API client

Every hosted reference has Try it: requests go from the reader's browser straight to your API. On Pro and up, a proxy reaches APIs without CORS on the hosts you verify, and your team can save requests in shared collections. [More about the API client](api-client/index).

## Docs

Write your guides in Markdown in your repository and push them from CI. They're built once, at push, and served beside your reference, with `llms.txt`, Markdown for every page and a docs MCP server for agents. [More about docs hosting](docs-hosting/index).

## SDKs

On Pro and up, your CI asks for a TypeScript or Python package made from a registry version and your `latitude10.sdk.json`. Its version follows the breaking-change diff, and the generated code is yours, under the MIT licence. [More about SDKs](sdks/index).

## MCP

Every operation in your document becomes an MCP tool at `/mcp/<workspace>/<project>`. Each tool call is one request to your API, and agents use a key you hand them or, on Pro and up, sign in through your own identity provider. [More about hosted MCP](hosted-mcp/index).

## For agents

These docs are built for models too. [llms.txt](https://docs.latitude10.tech/llms.txt) lists every page, every page is also served as Markdown, `skill.md` is an agent skill that points at the rest, and the docs' MCP server at `/mcp` searches them with no key.

For help adopting the platform, see our [professional services](https://latitude10.tech/services).

## Where this comes from

- `app/platform/_lib/modules.ts`
- `app/docs/_lib/build.ts`
- `app/registry/_lib/ci.ts`

---

# Quickstart

From sign-in to a published reference, with your own OpenAPI document. You need a document, YAML or JSON, and a terminal.

### 1. Sign in

Go to the [sign-in page](https://latitude10.tech/workspace/sign-in) and continue with GitHub, or ask for an emailed link. The link works once, for 15 minutes. Your first sign-in creates your workspace, named after you.

### 2. Create a project

On your workspace's page, name a project. A project holds one OpenAPI document and every version of it. Owners, admins and editors can create projects.

### 3. Create a CI key

On the project's page, create a key under **CI keys**. It's shown once: copy it into your environment, never into a file you commit.

```sh
export LATITUDE10_KEY=...   # paste it from the project page
BASE=https://latitude10.tech/api/registry/v1
```

### 4. Push your document

Send the document as the request body:

```sh
curl -sS -X POST "$BASE/versions?label=first" -H "Authorization: Bearer $LATITUDE10_KEY" --data-binary @openapi.yaml
```

The answer is the new version, with `201`: its number (`seq`), its readiness `score` out of 100, and `url`, its page in your workspace. Push the same bytes again and you get the same version back with `200`; no second version is made.

### 5. Read the score

The latest version, and the report that explains its score:

```sh
curl -sS "$BASE/versions/latest" -H "Authorization: Bearer $LATITUDE10_KEY"
```

```sh
curl -sS "$BASE/versions/1/report" -H "Authorization: Bearer $LATITUDE10_KEY"
```

Each rule in the report lists its findings and how to fix them. The [readiness rules](registry/readiness-rules) explain the score.

### 6. Publish the reference

On the project's page, choose **Publish** under Reference. Until then it's private: only members see it. Owners and admins can publish.

### 7. See the outputs

Once it's published, the project's page links each output:

- the reference, with Try it, at `https://latitude10.tech/r/<workspace>/<project>`;
- the docs site, once you push a docs folder and publish it, at `https://latitude10.tech/docs/<workspace>/<project>`;
- the MCP server, at `https://latitude10.tech/mcp/<workspace>/<project>` once you set it up on the project's MCP page.

## When something goes wrong

Every error is JSON with an `error` that says what to do. A `401` means the key is missing or revoked, a `422` that the body isn't an OpenAPI 3.0 or 3.1 document in one file, and a `429` that a quota is reached until `resetsAt`. [Errors](registry-api/errors) lists them all.

## Where this comes from

- `openapi/registry-v1.yaml`
- `app/api/workspace/auth/route.ts`
- `app/workspace/_lib/users.ts`
- `app/workspace/_lib/workspaces.ts`
- `app/workspace/_lib/projects.ts`
- `app/workspace/_lib/onboarding.ts`
- `app/workspace/_lib/keys.ts`
- `app/reference/_lib/access.ts`
- `app/api/registry/v1/versions/route.ts`
- `app/api/registry/v1/versions/latest/route.ts`

---

# Concepts

## Account

You sign in with GitHub or with a link we email you. Your first sign-in creates a workspace for you, named after you.

## Workspace

A workspace holds your projects, its members and its plan. Its slug is made from its name: lowercase letters, digits and dashes, with `-2`, `-3` and so on added when the slug is taken. The slug is in every URL the workspace serves, such as `/r/<workspace>/<project>`. Renaming a workspace changes its name, not its slug.

## Members and seats

Each member has a role: owner, admin, editor or viewer. [Roles](../enterprise/roles) says what each can do. Members and open invitations both take a seat, and the number of seats depends on the plan: see [Plans and limits](plans-and-limits#workspace).

## Invitations

Owners and admins invite people by link, with the role they'll get. A link works once, within 7 days, and only while a seat is free. Revoking an invitation frees its seat.

## Project

A project is one API: one OpenAPI document and every version of it. Its slug is made the same way as a workspace's. The reference, the API client, the docs, the SDKs and the MCP server all belong to a project. How many projects a workspace may have depends on its plan.

## Versions

Every push that changes the document makes a new version, numbered `seq` from 1 in the order they were pushed. Pushing the same bytes as the latest version returns it instead of making a new one. Each version keeps its score, its report and its diff against the version before it. How many versions are kept depends on the plan: see [Plans and limits](plans-and-limits#registry).

## The sample

A new project can start from our sample document, an Orders API, so you can see every output before your own document is at hand. A version made from it is marked `source: "sample"`. Its server is a placeholder, so Try it and the MCP server can't call it, and no SDK is published from it. Push your own document any time to replace it.

## Where this comes from

- `app/workspace/_lib/users.ts`
- `app/workspace/_lib/workspaces.ts`
- `app/workspace/_lib/slugs.ts`
- `app/workspace/_lib/projects.ts`
- `app/workspace/_lib/permissions.ts`
- `app/workspace/_lib/sample.ts`
- `app/registry/_lib/versions.ts`

---

# Keys and tokens

Every key and token the platform issues starts with a prefix that says what it is. A secret scanner can match them, and so can you.

| Prefix | What it is | Who makes it | Where it goes | How it's stored | How to revoke it |
| --- | --- | --- | --- | --- | --- |
| `l10p_` | A project key, for CI | An owner or admin, on the project's page under **CI keys** | Your CI's secrets, sent as `Authorization: Bearer` to the registry API | SHA-256 hash only | **Revoke** on the project's page |
| `l10m_` | An MCP key, for agents | An owner or admin, on the project's MCP page | The agent's MCP client, sent as `Authorization: Bearer` to the hosted MCP server | SHA-256 hash only | **Revoke** on the project's MCP page |
| `l10a_` | An MCP access token | The MCP server's sign-in, when a person signs in through your identity provider | Sent by the MCP client to that one server | SHA-256 hash only | The client revokes it, or an owner or admin signs the person out on the MCP page |
| `l10r_` | An MCP refresh token | The same sign-in, beside the access token | Sent by the MCP client to that server's token endpoint | SHA-256 hash only | As for `l10a_`. It's replaced on every use |
| `l10c_` | An MCP OAuth client id | The MCP server, when a client registers itself | The client's own settings | As is: it isn't a secret | An owner or admin revokes the client on the MCP page |
| `l10v_` | A host-verification token | Latitude 10, for the project's MCP server and for its API client proxy | A file or a DNS TXT record on your API's host | As is: it isn't a secret | Nothing to revoke: it proves only that you control the host |

`l10_`, with no letter after it, is the seller dashboard's key for kits and payments, not a platform key.

## How secrets are kept

CI keys and MCP keys are stored only as SHA-256 hashes, and shown once.

Your API credential for hosted MCP is sealed with AES-GCM 256 under a Worker secret, with a fresh IV each time, and one module decrypts it.

So a lost key can't be shown again: revoke it and create another. Access and refresh tokens are kept the same way, as hashes.

## Where this comes from

- `app/_lib/auth/keys.ts`
- `app/_lib/auth/tokens.ts`
- `app/workspace/_lib/keys.ts`
- `app/hosted-mcp/_lib/keys.ts`
- `app/hosted-mcp/_lib/tokens.ts`
- `app/hosted-mcp/_lib/oauth.ts`
- `app/hosted-mcp/_lib/server.ts`
- `app/hosted-mcp/_lib/credential.ts`
- `app/reference/_lib/playground/hosts.ts`

---

# Plans and limits

Each limit applies per the unit its row names, such as a project, a workspace, a server or a site. A request past a limit is refused, with an error that says so.

## Prices

| Plan | Price | Billed annually |
| --- | --- | --- |
| Free | $0 | $0 |
| Pro | $150 a month | $125 a month, billed annually |
| Business | $600 a month | $500 a month, billed annually |
| Enterprise | By contract | By contract |

## Workspace

| Limit | Free | Pro | Business | Enterprise |
| --- | ---: | ---: | ---: | ---: |
| Seats | 1 | 5 | 10 | By contract |

## Registry

| Limit | Free | Pro | Business | Enterprise |
| --- | ---: | ---: | ---: | ---: |
| APIs (projects) | 1 | 15 | 25 | By contract |
| Versions kept | 10 | 200 | 1,000 | By contract |
| Pushes per project a day | 20 | 200 | 500 | By contract |
| Fix runs per workspace a month | Not included | 100 | 500 | By contract |
| Largest spec | 2 MB | 2 MB | 2 MB | By contract |

## Reference

| Limit | Free | Pro | Business | Enterprise |
| --- | ---: | ---: | ---: | ---: |
| Uncached renders per project a day | 2,000 | 50,000 | 200,000 | By contract |

## API client

| Limit | Free | Pro | Business | Enterprise |
| --- | ---: | ---: | ---: | ---: |
| Proxy hosts per project | Not included | 3 | 10 | By contract |
| Proxy calls per project a day | Not included | 1,000 | 5,000 | By contract |
| Shared collections per project | Not included | 20 | 100 | By contract |
| Requests per collection | Not included | 100 | 500 | By contract |
| Proxy calls per IP a minute | Not included | 20 | 20 | By contract |
| Collection saves per project a day | Not included | 500 | 2,000 | By contract |
| Collection storage per project | Not included | 10 MB | 25 MB | By contract |

## Docs

| Limit | Free | Pro | Business | Enterprise |
| --- | ---: | ---: | ---: | ---: |
| Pages per build | 25 | 500 | 2,000 | By contract |
| Docs versions per project | Not included | 5 | 20 | By contract |
| Branch previews per project | Not included | 5 | 20 | By contract |
| Custom domains per workspace | Not included | 3 | 10 | By contract |
| Page reads per site a day | 5,000 | 100,000 | 400,000 | By contract |
| Docs MCP calls per site a day | 1,000 | 20,000 | 100,000 | By contract |
| Bundle size, unpacked | 5 MB | 25 MB | 100 MB | By contract |
| Docs pushes per project a day | 10 | 100 | 300 | By contract |

## SDKs

| Limit | Free | Pro | Business | Enterprise |
| --- | ---: | ---: | ---: | ---: |
| Endpoints in an SDK | Not included | 100 | 250 | By contract |
| SDK builds per project a day | Not included | 50 | 200 | By contract |

## MCP

| Limit | Free | Pro | Business | Enterprise |
| --- | ---: | ---: | ---: | ---: |
| Tool calls per workspace a month | 1,000 | 50,000 | 250,000 | By contract |
| Tool calls per key a minute | 30 | 120 | 300 | By contract |
| Keys per server | 2 | 20 | 100 | By contract |
| People signing in per server | Not included | 1,000 | 10,000 | By contract |
| OAuth clients per server | Not included | 200 | 1,000 | By contract |
| Sign-ins per server a day | Not included | 1,000 | 10,000 | By contract |
| Claim rules per server | Not included | 20 | 20 | By contract |

## Enterprise

| Limit | Free | Pro | Business | Enterprise |
| --- | ---: | ---: | ---: | ---: |
| SSO connections per workspace | Not included | Not included | 1 | By contract |
| SSO email domains per workspace | Not included | Not included | 5 | By contract |
| SSO sign-ins per workspace a day | Not included | Not included | 2,000 | By contract |
| Audit log retention in days | Not included | Not included | 90 | By contract |
| Audit events per workspace a day | Not included | Not included | 5,000 | By contract |
| Rows per audit export | Not included | Not included | 50,000 | By contract |

## Where this comes from

- `app/pricing/_lib/plans.ts`
- `app/workspace/_lib/quotas.ts`
- `app/platform/_lib/modules.ts`

---

# Registry

The registry is where your OpenAPI document lives. Each push from your CI, or an upload on the project's page, becomes a version.

## A version

A version is one copy of your document, numbered `seq` in push order, with an optional label and the Git commit it came from. The registry keeps the document exactly as you sent it, so you can download the original of any version it keeps.

## Its score

Each version is scored from 0 to 100 by the [readiness rules](readiness-rules): how well an AI agent will understand and call your API. The version's report lists every finding and how to fix it.

## Its diff

Each version is compared with the one before it. The diff marks each change [breaking, warning or information](breaking-changes), and the version records how many breaking changes and warnings it has.

## In this section

- [Push a version](push): the request, its parameters and its errors.
- [The GitHub Action](github-action): score, gate and push from a workflow.
- [Readiness rules](readiness-rules): what the score is made of.
- [Breaking changes](breaking-changes): every kind of change the diff finds.
- [Fixes](fixes): rules-only changes that raise the score, as JSON Patch.
- [Versions](versions): how many are kept, and how to read them.

## Where this comes from

- `app/registry/_lib/versions.ts`
- `app/registry/_lib/diff.ts`
- `app/api/readiness/_lib/report.ts`
- `openapi/registry-v1.yaml`

---

# Push a version

### 1. Send the document

`POST /versions` takes the document itself as the request body, YAML or JSON, with a project key:

```sh
curl -sS -X POST "$BASE/versions?label=v1.4.0&git_sha=$GITHUB_SHA&git_ref=$GITHUB_REF" -H "Authorization: Bearer $LATITUDE10_KEY" --data-binary @openapi.yaml
```

### 2. Read the answer

A new version answers `201` with its `seq`, `score`, `breaking` and `warnings` counts and `url`, its page in your workspace. If the bytes are the same as the latest version's, you get that version back with `200`, and nothing new is made.

## Parameters

All three are optional query parameters.

| Parameter | What it's for |
| --- | --- |
| `label` | The version's name. Without one, the document's `info.version` is used. |
| `git_sha` | The commit the document came from. |
| `git_ref` | The branch or tag, such as `refs/heads/main`. |

## What the registry accepts

- One OpenAPI 3.0 or 3.1 document, in YAML or JSON.
- One file: a `$ref` inside the document works, a `$ref` to another file or a URL is refused. The GitHub Action bundles local files into one before it pushes.
- Up to 2 MB, on every plan.

The registry keeps the newest versions up to your plan's number, and removes the oldest after each push: see [Plans and limits](../get-started/plans-and-limits#registry).

## Errors

| Status | When | The `error` |
| --- | --- | --- |
| `401` | No project key, or a revoked one. | `Send a project key: Authorization: Bearer l10p_…` |
| `403` | The workspace has more projects than its plan includes. | `This project is read-only: the workspace has more projects than its plan includes.` |
| `409` | Another push landed at the same moment. | `Another version was pushed at the same moment. Push again.` |
| `413` | The body is larger than the registry keeps. | The size sent and the most that's kept. |
| `422` | It isn't OpenAPI 3.0 or 3.1, it doesn't parse, or it has an external `$ref`. | What's wrong. For a `$ref`: `External $ref isn't supported here: …` and how to bundle it. |
| `429` | The project's pushes for today are used. | `Quota reached for this period. It resets at …`, with `resetsAt`. |

A push counts against the day's quota before its body is read, so a refused push still counts. Daily quotas reset at midnight UTC.

## Where this comes from

- `app/api/registry/v1/versions/route.ts`
- `app/api/registry/v1/_lib/route.ts`
- `app/registry/_lib/versions.ts`
- `app/registry/_lib/bundle.ts`
- `app/registry/_lib/usage.ts`
- `app/workspace/_lib/quotas.ts`

---

# The GitHub Action

Our [Action for GitHub workflows](https://github.com/jorgeortega/latitude10-action) scores your document in the workflow, can fail the job on a low score or a breaking change, and can push the version to the registry. It's public, under MIT.

### 1. Add the key

Add your project key to the repository's secrets as `LATITUDE10_KEY`. The Action scores and gates without it; pushing and fixes need it.

### 2. Add the step

```yaml
- uses: jorgeortega/latitude10-action@v1
  with:
    spec: openapi.yaml
    min-score: 70          # fail below this; default: report only
    max-tools: 40          # fail above this many operations; default 40
    fail-on-breaking: true # default false
    push: ${{ github.ref == 'refs/heads/main' }}
    suggest-fixes: true    # paid plans; opens or updates one PR
  env:
    LATITUDE10_KEY: ${{ secrets.LATITUDE10_KEY }}   # optional
```

## Inputs

| Input | What it does | Default |
| --- | --- | --- |
| `spec` | The path to your OpenAPI document, YAML or JSON. Local `$ref`s are bundled. Required. | None |
| `min-score` | Fail when the readiness score is below this, from 0 to 100. | Empty: report only |
| `max-tools` | Fail when the document has more operations than this, since each one becomes an agent tool. | `40` |
| `fail-on-breaking` | Fail when the document has breaking changes against its base. | `false` |
| `push` | With `LATITUDE10_KEY`, push this version to the registry. | `false` |
| `suggest-fixes` | With `LATITUDE10_KEY` on a paid plan, open or update one pull request with rules-only fixes. | `false` |
| `label` | The version's label in the registry. | Empty: `info.version` |
| `github-token` | The token for the fixes pull request. It needs contents and pull-requests write. | The workflow's token |
| `api-url` | The Latitude 10 API. | `https://latitude10.tech` |

## Outputs

| Output | What it holds |
| --- | --- |
| `score` | The readiness score, from 0 to 100. |
| `operations` | The number of operations. |
| `breaking` | The breaking changes against the base. |
| `version-url` | With `push`, the version's page in the registry. |

The Action has no input for docs yet. Push a docs folder with `curl` from a step of its own.

## Without the Action

One `curl` step pushes the document on every merge to `main`:

```yaml
- name: Push the spec to Latitude 10
  if: github.ref == 'refs/heads/main'
  run: >
    curl --fail-with-body -X POST
    "https://latitude10.tech/api/registry/v1/versions?git_sha=$GITHUB_SHA&git_ref=$GITHUB_REF"
    -H "Authorization: Bearer $LATITUDE10_KEY"
    --data-binary @openapi.yaml
  env:
    LATITUDE10_KEY: ${{ secrets.LATITUDE10_KEY }}
```

[Push a version](push) lists what it answers.

## Where this comes from

- `app/registry/_lib/ci.ts`
- `app/api/registry/v1/versions/route.ts`
- `app/registry/_lib/versions.ts`
- `app/registry/_lib/bundle.ts`
- `app/registry/_lib/usage.ts`

---

# Readiness rules

Every version you push is scored from 0 to 100 by these rules, version 1.0.3. The version's report lists each rule's findings.

## The score

Each rule applies to some of your operations or parameters, and its share is the part of those that pass. A rule with nothing to apply to passes. The score is the sum of each rule's weight times its share, divided by the total weight (88), times 100, rounded to a whole number.

## The rules

| Rule | What it checks | Weight | How to fix it |
| --- | --- | ---: | --- |
| `operation-ids` | Every operation has a clear operationId | 10 | Give each operation an operationId that says what it does (listOrders, refundOrder). It becomes the tool name. |
| `descriptions` | Descriptions say what the operation does, when to use it, and what it returns | 10 | Write a description of at least 40 characters per operation, different from the others: models pick tools by it. |
| `summaries` | Every operation has a summary | 8 | Add a short summary (under 80 characters): clients show it as the tool's title. |
| `parameter-descriptions` | Parameters are described | 8 | Describe each parameter: its meaning, format and allowed values. |
| `response-schemas` | Success responses have a JSON schema | 8 | Describe what a 2xx response contains with a JSON schema, so agents know what they'll get back. |
| `security` | How to authenticate is described | 8 | Describe your auth in components.securitySchemes and apply it with security. |
| `examples` | Operations have an example | 6 | Add an example for each operation (a parameter, request or response example): models copy examples. |
| `error-responses` | Errors are described | 6 | Document the errors an operation returns (400, 404, 409…) so agents can recover instead of retrying blindly. |
| `pagination` | List endpoints are paginated | 6 | Give list operations a limit and a cursor (or page) parameter: an agent can't read ten thousand rows. |
| `json-bodies` | Request bodies are JSON | 5 | Accept application/json for request bodies agents send (form and multipart bodies can't be tool calls). |
| `idempotency` | Writes have an idempotency story | 5 | Accept an Idempotency-Key header on POST/PATCH (Agentify honours it for agents), so a retry doesn't do the work twice. |
| `enums` | Parameters with a fixed set of values list them | 4 | Give status/sort/type-like parameters an enum (or list the values in the description). |
| `tool-count` | A manageable number of tools, with distinct names | 4 | Keep enabled tools to about 40 per server (models choose worse from long lists), and give operations distinct operationIds. |

## Run them yourself

The same rules are public as [openapi-agent-check](https://www.npmjs.com/package/openapi-agent-check) (MIT), so you can score a document on your machine or in CI before you push it.

## Where this comes from

- `app/api/readiness/_lib/agentify/rules.ts`
- `app/api/readiness/_lib/report.ts`
- `app/registry/_lib/store.ts`
- `app/_lib/entity.ts`

---

# Breaking changes

Each version you push is compared with the version before it. Every change found has a kind and a level: breaking, warning or information. The version's diff lists them, breaking changes first.

## Breaking

| Kind | What changed |
| --- | --- |
| `operation-removed` | An operation (a method and a path) is gone, and no new operation has its operationId. |
| `operation-moved` | An operation’s method or path changed. It’s matched to the old one by its operationId. |
| `parameter-removed` | A parameter an operation took is gone. |
| `parameter-became-required` | An optional parameter is now required. |
| `required-parameter-added` | An operation has a new parameter, and it’s required. |
| `request-body-became-required` | An operation’s request body is now required. |
| `response-property-removed` | A property is gone from a JSON success response. |
| `response-property-type-changed` | A JSON success response, or a property in it, has a different type. |
| `response-enum-value-added` | An enum in a JSON success response has a new value, which clients may not handle. |
| `request-enum-value-removed` | An enum in a parameter or a JSON request body lost a value clients may still send. |
| `success-response-removed` | A 2xx response an operation had is gone. |
| `security-requirement-added` | An operation’s security asks for a scheme that a client meeting the old requirement doesn’t have. A new alternative breaks nobody. |
| `security-scheme-changed` | A security scheme an operation uses changed its type, location, name, scheme, bearer format or flows. |
| `server-url-removed` | A URL in `servers` is gone. |

## Warnings

| Kind | What changed |
| --- | --- |
| `operation-id-changed` | An operation’s operationId changed, so agents see a new tool name. |
| `description-removed` | An operation or a parameter lost its description. |
| `operation-deprecated` | An operation is now marked deprecated. |

## Information

| Kind | What changed |
| --- | --- |
| `operation-added` | A new operation. |
| `optional-parameter-added` | An operation has a new optional parameter. |
| `response-property-added` | A JSON success response has a new property. |

## In CI

The GitHub Action's `fail-on-breaking` input, off by default, fails the job when the diff has a breaking change.

## Where this comes from

- `app/registry/_lib/diff.ts`
- `tests/fixtures/registry/diff/`
- `app/registry/_lib/ci.ts`

---

# Fixes

On the paid plans, the registry API answers a document with the changes that raise its readiness score, as a JSON Patch against the document exactly as you sent it.

Fixes to your spec are rules-only JSON Patch: no workspace feature sends your spec to an AI model. The paid readiness report on our public site does, outside the workspace.

### 1. Ask for the fixes

Send the document as the body, as you would to push it. Nothing is stored and no version is made.

```sh
curl -sS -X POST "$BASE/fixes" -H "Authorization: Bearer $LATITUDE10_KEY" --data-binary @openapi.yaml
```

### 2. Read the patch

| Field | What it holds |
| --- | --- |
| `rulesVersion` | The version of the readiness rules used. |
| `scoreBefore` | The document's score as sent. |
| `scoreAfter` | Its score with the patch applied. |
| `operations` | How many operations the patch improves. |
| `patch` | The JSON Patch operations, in order. |

The fixes fill in what the rules look for, such as operationIds, summaries, descriptions, parameter descriptions, examples and an `Idempotency-Key` header on writes. Read them before you apply them.

## From the GitHub Action

With `suggest-fixes: true` and `LATITUDE10_KEY` on a paid plan, the [Action](github-action) opens or updates one pull request that applies the fixes to your file.

## Limits and errors

Each request counts as one fix run against your workspace's monthly runs, before the body is read: see [Plans and limits](../get-started/plans-and-limits#registry). Monthly quotas reset on the first of the month, UTC.

| Status | When |
| --- | --- |
| `403` | The plan has no fixes: `Suggested fixes are part of the paid plans.` |
| `413` | The body is larger than the registry reads. |
| `422` | The body isn't an OpenAPI 3.0 or 3.1 document in one file. |
| `429` | The month's fix runs are used, until `resetsAt`. |

## Where this comes from

- `app/api/registry/v1/fixes/route.ts`
- `app/registry/_lib/fixes.ts`
- `app/registry/_lib/json-patch.ts`
- `app/registry/_lib/usage.ts`
- `app/registry/_lib/ci.ts`

---

# Versions

## How many are kept

Each project keeps its newest versions up to your plan's number: see [Plans and limits](../get-started/plans-and-limits#registry). After each push, the oldest beyond that number are deleted, with their source, report and diff.

After a downgrade, the old plan's number still holds for 30 days, so nothing is deleted the day you change plans. After that, the next push trims the list to the new plan's number.

## Reading them

Every call takes your project key.

### 1. List the versions

Newest first:

```sh
curl -sS "$BASE/versions" -H "Authorization: Bearer $LATITUDE10_KEY"
```

### 2. Read one version's report

The score's findings, rule by rule:

```sh
curl -sS "$BASE/versions/3/report" -H "Authorization: Bearer $LATITUDE10_KEY"
```

### 3. Download the original

The document exactly as it was pushed, as YAML or JSON:

```sh
curl -sS "$BASE/versions/3/source" -H "Authorization: Bearer $LATITUDE10_KEY" -o openapi.yaml
```

### 4. Compare any two versions

```sh
curl -sS "$BASE/diff?from=1&to=3" -H "Authorization: Bearer $LATITUDE10_KEY"
```

Each change has a `kind`, a `level` (breaking, warning or info), a JSON `pointer` into the document and a `message`. The kinds are listed in [Breaking changes](breaking-changes).

A version number that isn't a number answers `400`, and one that doesn't exist, or was deleted, answers `404`.

## Where this comes from

- `app/workspace/_lib/quotas.ts`
- `app/registry/_lib/versions.ts`
- `app/api/registry/v1/versions/route.ts`
- `app/api/registry/v1/versions/[seq]/source/route.ts`
- `app/api/registry/v1/versions/[seq]/report/route.ts`
- `app/api/registry/v1/diff/route.ts`
- `app/api/registry/v1/_lib/route.ts`

---

# Hosted API reference

A project's reference is made from its latest registry version: every operation, its parameters, request bodies and responses, with Try it to send real requests. It's private until an owner or admin publishes it, and every push after that updates it.

Hosted references and docs load no third-party script or font, and each response sends its own content security policy. Our own pages report errors to Sentry, with identifiers removed first.

## Who sees it

- Members see the reference in the workspace, published or not.
- Once published, anyone with the link reads it at `https://latitude10.tech/r/<workspace>/<project>`.
- An unpublished project answers the same `404` as one that doesn't exist, so a private project's name never shows.

## In this section

- [Publishing](publishing): publish, unpublish, downloads, search engines and older versions.
- [Embedding](embed): the reference inside your own site.
- [Markdown in descriptions](markdown): what your document's descriptions may use.
- [Caching and security](caching-and-security): the cache, the render cap and the headers.

## Where this comes from

- `app/reference/_lib/access.ts`
- `app/reference/_lib/page.ts`
- `app/r/_lib/respond.ts`
- `app/r/[ws]/[project]/route.ts`

---

# Publishing the reference

Owners and admins publish from the Reference panel on the project's page. The project needs at least one version first.

## The switches

| Switch | What it does |
| --- | --- |
| **Publish** | Anyone with the link can read the reference, and you can embed it. |
| **Unpublish** | The public link and every embed stop working at once. |
| **Let readers download the OpenAPI file** | Readers get a link to the file exactly as you pushed it. |
| **Hide from search engines** | Every page of the reference asks search engines not to index it. **Show to search engines** undoes it. |

A reference made from the sample document stays hidden from search engines until you push your own.

## Its addresses

| Path | What it serves |
| --- | --- |
| `/r/<workspace>/<project>` | The latest version. |
| `/r/<workspace>/<project>/v/<seq>` | A version the registry still keeps. Only the latest is indexed by search engines. |
| `/r/<workspace>/<project>/openapi.yaml` | The latest version's file, if you pushed YAML and downloads are on. |
| `/r/<workspace>/<project>/openapi.json` | The same, if you pushed JSON. |
| `/r/<workspace>/<project>/embed` | The frameable page: see [Embedding](embed). |

The file is served only in the format you pushed: the other path answers `404`.

## On the Free plan

A reference on Free carries a small "Made with Latitude 10" link in its footer. The paid plans don't.

## Where this comes from

- `app/workspace/actions.ts`
- `app/reference/_lib/access.ts`
- `app/reference/_lib/page.ts`
- `app/r/_lib/respond.ts`
- `app/r/[ws]/[project]/route.ts`
- `app/r/[ws]/[project]/v/[seq]/route.ts`
- `app/r/[ws]/[project]/openapi.yaml/route.ts`
- `app/r/[ws]/[project]/openapi.json/route.ts`

---

# Embedding the reference

### 1. Publish the reference

Embedding needs a published reference: see [Publishing](publishing).

### 2. Copy the snippet

The Reference panel on the project's page shows the snippet for your project. It looks like this:

```html
<iframe src="https://latitude10.tech/r/<workspace>/<project>/embed" title="Pets API reference" width="100%" height="800" loading="lazy"></iframe>
```

### 3. Choose a theme

Add `?theme=light` or `?theme=dark` to the `src` to fix the theme. Without it, the embed follows the reader's system setting.

## What the embed allows

- Only `/embed` may be framed: it sends `frame-ancestors *`. Every other page of the reference sends `frame-ancestors 'none'`.
- The embed has no site bar, and otherwise shows what the public reference shows, Try it included.
- If you unpublish, the embed shows that the reference isn't published, instead of an error page.

## Where this comes from

- `app/workspace/[ws]/[project]/page.tsx`
- `app/r/_lib/respond.ts`
- `app/r/[ws]/[project]/embed/route.ts`
- `app/reference/_lib/access.ts`

---

# Markdown in descriptions

Descriptions in your OpenAPI document, for the API, a tag, an operation, a parameter, a request body, a schema or a security scheme, are rendered as a safe subset of Markdown. Anything outside it is shown as the text you wrote, never run.

## What's rendered

| You write | You get |
| --- | --- |
| A blank line between paragraphs | Separate paragraphs. Lines next to each other join into one. |
| `*text*` or `_text_` | Emphasis. |
| `**text**` | Strong text. |
| Text in backticks | Inline code. |
| A fence of three backticks or tildes, with an optional language | A code block, with the language as its class. |
| Lines starting with `-`, `*`, `+` or `1.` | A flat list, bulleted or numbered. |
| `[label](https://…)` or `[label](mailto:…)` | A link, marked `rel="nofollow ugc noopener"`. |
| `![alt](https://…)` | A link to the image: images aren't loaded. |

## What's shown as text

| You write | What the reader sees |
| --- | --- |
| Raw HTML, such as `<b>` or `<script>` | The tags as text. |
| A link to anything but http, https or mailto | The label, with no link. |
| Headings, tables, blockquotes and horizontal rules | The characters as you typed them. |
| An indented list item | Plain text: lists don't nest. |

Guides on a hosted docs site get more: headings, tables, blockquotes, callouts and images from the docs folder.

## Where this comes from

- `app/reference/_lib/markdown.ts`
- `app/reference/_lib/html.ts`
- `app/reference/_lib/page.ts`

---

# Caching and security

## Caching

A rendered page is kept in the edge cache for a day, keyed by the version and by what changes the page: the theme, the embed, the free plan's credit, search-engine indexing, downloads, Try it and published collections. A new push is a new version and a new key, so there's nothing to purge.

Whether the reference is published is read from the database before the cache, on every request. Unpublishing takes effect at once, and no page is kept by a browser or a CDN: each response says `cache-control: no-store`.

Members' pages in the workspace show every shared collection as it's saved, so they aren't cached.

## The daily render cap

A page that isn't in the cache is rendered, and each project has a daily number of renders: see [Plans and limits](../get-started/plans-and-limits#reference). Cached pages keep serving past the cap. A page that would need a render past it answers `503` with a `retry-after` header, the seconds until the cap resets at midnight UTC.

## The content security policy

Each response gets its own policy, with a fresh nonce for its one script:

| Directive | Value | What it means |
| --- | --- | --- |
| `default-src` | `'none'` | Nothing loads unless a directive below allows it. |
| `style-src` | `'self'` | Only our own stylesheet. |
| `script-src` | `'nonce-…'` | Only the page's own script, with this response's nonce. |
| `img-src` | `'self'` | Only our own images. |
| `connect-src` | `'self'` and your servers | With Try it on: the `https` servers your document lists, if they pass the same checks as hosted MCP's hosts. |
| `base-uri` | `'none'` | No `base` element can redirect links. |
| `form-action` | `'none'` | No form can post anywhere. |
| `frame-ancestors` | `'none'`, or `*` on the embed | Only the embed can be framed. |

A server URL that points at an IP address, a private name or latitude10.tech is left out of `connect-src`, so Try it can't call it.

## Other headers

| Header | Value |
| --- | --- |
| `x-content-type-options` | `nosniff` |
| `referrer-policy` | `strict-origin-when-cross-origin` |
| `cache-control` | `no-store` |
| `x-robots-tag` | `noindex`, on a hidden reference and on older versions |

## Where this comes from

- `app/r/_lib/respond.ts`
- `app/reference/_lib/access.ts`
- `app/reference/_lib/usage.ts`
- `app/reference/_lib/page.ts`
- `app/reference/_lib/playground/csp.ts`
- `app/r/[ws]/[project]/route.ts`

---

# API client

Every hosted reference has Try it: a form for each operation that sends a real request to your API and shows the answer, checked against the response schema your document gives. Readers bring their own credentials.

## Two ways to send

- **Direct**, on every plan: the request goes from the reader's browser straight to your API, so your API must answer [CORS](cors) for our origin.
- **Through the proxy**, on Pro and up: for an API without CORS, our server makes the request to a host you've [verified](verified-hosts) and hands the answer back.

[Direct and proxy](direct-and-proxy) says what each one sends and refuses.

## Who has it

Members always have Try it in the workspace. Readers of the published reference have it unless an owner or admin turns it off on the project's Try it page, which is also where the proxy is switched on.

## In this section

- [Direct and proxy](direct-and-proxy): the two modes, their limits and errors.
- [CORS for Try it](cors): the headers your API sends for direct mode.
- [Verified hosts](verified-hosts): proving you control a host the proxy may call.
- [Shared collections](collections): saved requests, and Examples for readers.
- [Import and export](import-export): our format both ways, and Postman out.
- [Secrets](secrets): what a saved request may never hold.

## Where this comes from

- `app/reference/_lib/playground/client.ts`
- `app/reference/_lib/playground/proxy.ts`
- `app/r/_lib/respond.ts`
- `app/workspace/[ws]/[project]/playground/page.tsx`

---

# Direct and proxy

## Direct

The reader's browser calls your API itself, with what the form holds and nothing else:

- no cookies: the request is sent with `credentials: 'omit'`;
- no referrer: `referrerPolicy: 'no-referrer'`;
- no redirects: a redirect shows as "The API answered with a redirect, which the playground doesn’t follow.";
- only to the servers your document lists that pass the page's `connect-src` checks: see [Caching and security](../api-reference/caching-and-security).

Your API has to answer CORS for this to work: see [CORS for Try it](cors). The credentials a reader types stay in their browser.

## Through the proxy

The API client’s proxy (Pro) calls only hosts you verified, follows no redirects and stores nothing.

An owner or admin turns it on for the project, and adds and [verifies](verified-hosts) each host. Try it then offers it beside direct mode. The browser sends the request as a JSON envelope to `/r/<workspace>/<project>/proxy`, and our server makes one request, built from that envelope only:

- `https` only, on the default port, with no user name in the URL, to a public host verified for this project;
- `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD` and `OPTIONS`;
- a body of up to 256 KB;
- no cookies, no `Origin` or `Referer`, and none of the `Host`, `Forwarded`, `X-Forwarded-*`, `CF-*`, `Sec-*` or `Proxy-*` headers;
- its own `User-Agent`, which names the Latitude 10 playground;
- sent once, never retried, and never redirected;
- cut off after 15 seconds, and its answer read up to 1 MB.

The answer comes back as JSON: the status, the headers without `Set-Cookie`, the body as text or base64, whether it was cut, and the time it took. Nothing the API sends becomes a page on our origin.

The proxy serves the hosted reference at `/r/` and its embed. The reference inside a docs site sends directly.

The proxy's calls count per project a day and per reader's IP a minute: see [Plans and limits](../get-started/plans-and-limits#api-client).

## The proxy's errors

| Status | The `error` |
| --- | --- |
| `400` | What's wrong with the envelope, such as `Send an https URL.` or `That method isn’t allowed.` |
| `403` | `This host isn’t verified for this API’s proxy.` |
| `413` | `The body is over 256 KB.` |
| `429` | `Too many requests through the proxy. Wait a minute.` or `This API’s proxy has reached today’s limit. Send directly from your browser, or try tomorrow.` |
| `502` | `The API couldn’t be reached.` |
| `504` | `The API didn’t answer within 15 seconds.` |

## Where this comes from

- `app/reference/_lib/playground/client.ts`
- `app/reference/_lib/playground/proxy.ts`
- `app/reference/_lib/playground/csp.ts`
- `app/r/_lib/proxy.ts`
- `app/r/[ws]/[project]/proxy/route.ts`

---

# CORS for Try it

In direct mode the reader's browser calls your API from the reference's page, so the browser asks your API first whether that page's origin may. Without the right answer, the browser blocks the request and Try it can't show the answer. If you can't change your API's headers, use the [proxy](direct-and-proxy) on Pro and up.

## The headers

For a preflight `OPTIONS` request and for the request itself:

```http
Access-Control-Allow-Origin: https://latitude10.tech
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Expose-Headers: *
```

| Header | Why |
| --- | --- |
| `Access-Control-Allow-Origin` | The origin of the page Try it runs on. For the hosted reference and its embed, that's `https://latitude10.tech`. A docs site on your own domain runs Try it from that domain, so allow it too. |
| `Access-Control-Allow-Methods` | The methods your operations use. |
| `Access-Control-Allow-Headers` | The headers Try it sends: `Authorization` for a bearer or basic credential, `Content-Type` for a body, and the name of any API key header your document describes. |
| `Access-Control-Expose-Headers` | Optional. Without it, Try it shows only the few headers browsers always expose. |

Try it sends no cookies, so your API doesn't need `Access-Control-Allow-Credentials`.

## Where this comes from

- `app/reference/_lib/playground/client.ts`
- `app/reference/_lib/playground/csp.ts`
- `app/workspace/[ws]/[project]/playground/page.tsx`

---

# Verified hosts

The proxy calls only hosts you've proved you control. Owners and admins add them on the project's Try it page, on Pro and up.

### 1. Add the host

Enter its name, such as `api.example.com`, or an `https` URL on it. Only the host is kept. A host is refused if it's an IP address, has a port or a user name, or isn't a public name, and so are latitude10.tech and Cloudflare's own names.

### 2. Put the token on it

The Try it page shows the project's token, which starts with `l10v_`. Put it in one of two places:

- a file at `/.well-known/latitude10-verify.txt` on the host, served over `https` with a `200` and holding only the token;
- a DNS TXT record at `_latitude10.<host>` whose value is the token.

The file is tried first, without following redirects, then the TXT record. The token isn't a secret: it only proves control.

### 3. Check it

Choose **Check now** beside the host. The page says which proof passed.

## Checked again

A proof is checked again when it's 7 days old, at the proxy's next call to that host. If that check fails, calls to the host are refused until you choose **Check now** again and it passes, so leave the file or the record in place.

## Hosts verified for MCP

The file holds one token per project, so a host your project's hosted MCP server has verified, and that isn't due a check, counts for the proxy too.

## How many

The number of hosts per project depends on your plan: see [Plans and limits](../get-started/plans-and-limits#api-client).

## Where this comes from

- `app/reference/_lib/playground/hosts.ts`
- `app/hosted-mcp/_lib/upstream.ts`
- `app/workspace/[ws]/[project]/playground/page.tsx`

---

# Shared collections

A collection is a named set of saved Try it requests for one project, shared by its members. Each saved request holds what the form sends for one operation: the server, its variables, the parameters and the body. It never holds a credential: see [Secrets](secrets).

## Who can do what

| Who | What |
| --- | --- |
| Owners, admins and editors | Create collections, save and reorder requests, rename and delete them. |
| Owners and admins | Publish a collection to readers, or take it back to members only. |
| Viewers | Read every collection and load its requests into Try it. |

Collections come with Pro and up. How many a project has, how many requests each holds, the saves a day and the bytes they take depend on the plan: see [Plans and limits](../get-started/plans-and-limits#api-client).

## Saving

Create a collection in the Collections panel on the project's page. Then, in the workspace's reference, fill in a Try it form and choose **Save to a collection**. A collection can also hold variables for its requests.

## Examples for readers

A published collection shows on the public reference as Examples, in the sidebar. The reference has to be published first. Readers can load an example into Try it, or read it as `curl` with placeholders where credentials go. A change to a published collection shows on the reader's next request.

## Across versions

A saved request finds its operation in the version on show by its operationId, or else by its method and path. Parameters and a body the operation no longer has are dropped and named when it loads; nothing is written back.

## Past the plan's limits

After a downgrade, collections over the new plan's limits stay readable and exportable to members, and can be deleted to get back under. They can't be changed or published, and readers don't see them. Saving answers: "This project has more collections than its plan holds, so they’re read-only. Export or delete some, or change the plan."

## Where this comes from

- `app/reference/_lib/collections/store.ts`
- `app/reference/_lib/collections/model.ts`
- `app/reference/_lib/collections/panel.ts`
- `app/workspace/actions.ts`
- `app/workspace/_lib/permissions.ts`

---

# Import and export

## Export

Any member can export a collection from the Collections panel on the project's page, on any plan, even after a downgrade. There are two formats:

| Button | File | Reads back into Latitude 10 |
| --- | --- | --- |
| **Export** | `<name>.latitude10.collection.json`, our own format, version 1 | Yes |
| **Export for Postman** | `<name>.postman_collection.json`, Postman Collection v2.1 | No |

The Postman file uses the latest version of your document: a `baseUrl` variable, each request's method, path, parameters and body, and Postman's own auth for each operation's security scheme, with empty `{{apiKey}}`, `{{token}}`, `{{username}}` or `{{password}}` variables for you to fill in. A saved request whose operation is gone from the latest version is left out, and the collection's description says how many.

Neither file holds a credential, because a collection never does: see [Secrets](secrets).

## Import

Editors and up import a `latitude10.collection.json` file in the Collections panel, on Pro and up. It becomes a new collection, unpublished. Each value is checked as a save is, the secret check included, and one refused value fails the whole file, with the request and the field named.

| An import of | Answers |
| --- | --- |
| A file over 1 MB | “Imports are at most 1 MB.” |
| A Postman collection | “Postman collections can’t be imported. Export from Latitude 10 instead, or save the requests from Try it.” |
| Any other JSON | That it should be a `latitude10.collection.json` file exported from Latitude 10. |
| A field the format doesn't have | The field, refused. |
| More requests than your plan holds per collection | The plan's number and the file's. |

## Where this comes from

- `app/reference/_lib/collections/exchange.ts`
- `app/reference/_lib/collections/respond.ts`
- `app/reference/_lib/collections/store.ts`
- `app/workspace/actions.ts`

---

# Secrets

A saved request or a collection variable never holds a credential. Credentials go in Try it's Environment, which stays in the reader's browser. Before every save, update, variable change and import, the server checks the values, whatever the browser already checked, and refuses one that looks like a credential.

## What's refused

| Where | Refused when |
| --- | --- |
| A header or query parameter | Its name is an `apiKey` parameter of a security scheme in your document. |
| A header or query parameter | Its name is `authorization`, `proxy-authorization`, `cookie` or `set-cookie`, or contains `token`, `secret`, `password`, `api-key`, `apikey` or `api_key`, and it has a value. |
| A collection variable | Its name is one of those, and it has a value. |
| Any value: a parameter, the body, the server, a server variable or a collection variable | It has the shape of a known secret, below. |

The shapes:

| Looks like | For example |
| --- | --- |
| A Stripe secret or restricted key | `sk_live_…`, `rk_test_…` |
| A GitHub token | `ghp_…`, `gho_…`, `github_pat_…` |
| A Slack token | `xoxb-…` |
| An AWS access key | `AKIA…` |
| A private key | `-----BEGIN` |
| One of our project or MCP keys | `l10p_…`, `l10m_…` |
| A JSON Web Token | `eyJ….eyJ….` |
| A bearer or basic credential | `Bearer` or `Basic` followed by a token |
| A user or password in a URL | `https://user@…` |

A plain random-looking string passes, because IDs look like that too.

## The answer

A refused save answers `422` with the reason and the field:

```json
{ "error": "X-Api-Key is the API key of the ApiKeyAuth scheme. Credentials are never saved: enter it in Environment, where it stays in your browser.", "field": "header:X-Api-Key" }
```

Every reason ends “Credentials are never saved: enter it in Environment, where it stays in your browser.” The reason names the field and the rule, never the value.

## Where this comes from

- `app/reference/_lib/collections/secrets.ts`
- `app/reference/_lib/collections/respond.ts`
- `app/reference/_lib/collections/store.ts`
- `tests/collections-parity.test.ts`

---

# Hosted MCP

Hosted MCP turns a registry version into an MCP server at `https://latitude10.tech/mcp/<workspace>/<project>`. Each operation in your document becomes a tool, and each tool call an agent makes is one request to your API's host, with the credential you stored.

## How it fits together

- The tools come from the version the server serves: the latest, or one you pin.
- Agents connect with an MCP key you hand them, or, on Pro and up, by signing in through your own identity provider.
- Calls go only to a host you've proved is yours, and the agent's own key never reaches your API.
- Agent analytics show which tools are called, by which kind of agent, day by day.

A server that's off answers the same `404` as a project that doesn't exist: “There’s no hosted MCP server here.”

## In this section

- [Set it up](setup): the base URL, the proof, the credential, the tools, the keys and the switch.
- [Refused hosts](refused-hosts): the base URLs a server won't call, and why.
- [Tool calls](tool-calls): how tools are named, checked and sent.
- [Errors](errors): every message an agent can get.
- [Keys and allow lists](keys-and-allow-lists): agents' keys, and which tools each one sees.
- [Agent analytics](analytics): which tools are called, and by which clients.
- [Protocol versions](protocol-versions): the MCP versions every endpoint serves.
- [OAuth sign-in](oauth): people signing in through your identity provider.

## Where this comes from

- `app/hosted-mcp/_lib/server.ts`
- `app/hosted-mcp/_lib/upstream.ts`
- `app/hosted-mcp/_lib/keys.ts`
- `app/mcp/[ws]/[project]/route.ts`

---

# Set up hosted MCP

Owners and admins set the server up on the project's MCP page. The project needs a version first: the server is made from it, off, with its read tools on.

### 1. Set the base URL

Enter your API's base URL under **Your API**, such as `https://api.example.com/v1`. Every tool's path is added to it. [Refused hosts](refused-hosts) lists what isn't accepted. Changing to another host means proving that one too.

### 2. Prove the host is yours

The page shows the server's token, which starts with `l10v_`. Put it in a file at `https://<host>/.well-known/latitude10-verify.txt`, or in a TXT record at `_latitude10.<host>`, then choose **Check now**. The proof is checked again every 7 days, on the next call after that. If that check fails, every call is refused until **Check now** passes again.

### 3. Store the credential

If your API needs one, store the credential agents' calls should carry: a header, or a query parameter, with its name and value. A header that describes the request itself, such as `Host` or `Content-Type`, can't hold it.

Your API credential for hosted MCP is sealed with AES-GCM 256 under a Worker secret, with a fresh IV each time, and one module decrypts it.

It's sent only to your verified host and never shown again: replace it to change it. Remove it, and calls go out with no credential.

### 4. Choose the tools

Reads (`GET` and `HEAD`) are on to start with. Turn each write on yourself, within the cap [Keys and allow lists](keys-and-allow-lists) gives.

### 5. Create a key

Create an MCP key under **Agents' keys** and hand it to the agent. It's shown once, and it opens this server only. The page shows how to connect Claude Code, Claude or any MCP client:

```sh
claude mcp add --transport http <project> https://latitude10.tech/mcp/<workspace>/<project> --header "Authorization: Bearer <your l10m_ key>"
```

### 6. Pick the version, and turn it on

Under **Status**, the server serves the latest version, so each push changes its tools, or a version you pin, so pushes don't until you move the pin. Then choose **Turn on**. **Turn off** makes the server answer `404` at once.

## Where this comes from

- `app/hosted-mcp/_lib/server.ts`
- `app/hosted-mcp/_lib/upstream.ts`
- `app/hosted-mcp/_lib/credential.ts`
- `app/hosted-mcp/_lib/keys.ts`
- `app/workspace/actions.ts`
- `app/workspace/_lib/onboarding.ts`
- `app/workspace/[ws]/[project]/mcp/page.tsx`

---

# Refused hosts

A base URL is checked before anything is fetched. These are refused, with the message the MCP page shows. A message never repeats the URL, in case a secret was pasted into it.

| Refused | Message |
| --- | --- |
| A URL that's too long | `Use a shorter URL.` |
| Anything but `https`, or a URL that doesn't parse | `Use an https:// URL.` |
| A user name or password in the URL | `Leave out the user name and password: store the credential instead.` |
| A port | `Leave out the port: only the default https port is called.` |
| A query or a fragment | `Leave out the query and the fragment: each tool adds its own.` |
| An IP address, a single-label name, a private name, latitude10.tech or Cloudflare's own names | `Use your API’s public host name, not an IP address or a private name.` |

Private names are those under `localhost`, `local`, `internal`, `localdomain`, `lan`, `arpa`, `test`, `invalid`, `example` and `onion`. An IP address is refused in any spelling, numeric names included.

The same check guards the API client's proxy hosts and the servers Try it may call.

## Where this comes from

- `app/hosted-mcp/_lib/upstream.ts`
- `app/reference/_lib/playground/proxy.ts`
- `app/reference/_lib/playground/csp.ts`

---

# Tool calls

## Tools and their names

Each operation in the version becomes a tool. Its name is the `x-agentify` or `x-mcp` name if the operation has one, else its operationId, else its method and path, with anything but letters, digits, `_`, `.` and `-` turned into `_`. A deprecated operation is left out. The tool's description is the operation's summary and description, and its title the summary when it's short.

Each parameter is an argument of the same name. If two would clash, the location goes in front, such as `query_id`.

Each tool carries hints for the client: reads are marked read-only, `DELETE`, `PUT` and `PATCH` destructive, and everything but `POST` and `PATCH` idempotent.

## Arguments are checked first

Before anything is sent, the arguments are checked against the tool's input schema: types, required properties, `additionalProperties`, items, `enum`, `const`, lengths, item counts, ranges and four formats. Values nested deeper than 8 levels aren't checked, and neither is anything else, such as `pattern`: both are left to your API. A failed check names each path that's wrong, never the value, and nothing is sent.

## The request

One request to your verified host, built from the tool, the arguments and the stored credential only. Nothing of the agent's own request is copied, its `Authorization` least of all.

- The path is your base URL plus the operation's path, with each path argument encoded. A value of `.` or `..`, or a path that would leave the base URL, is refused.
- Query and header arguments go where the document puts them.
- An argument can never set `Authorization`, `Proxy-Authorization`, `Cookie`, `Set-Cookie`, `Host`, `Content-Length`, `Content-Type`, `Accept`, `Accept-Encoding`, `Connection`, `Transfer-Encoding`, `X-Api-Key`, `Api-Key`, `X-Forwarded-For`, `Forwarded`, `X-Request-Id`, `Traceparent`, `Tracestate`, `User-Agent`, `X-Real-Ip`, `X-Payment`, or any `X-Agentify-*`, `Mcp-*` or `Payment-*` header.
- We send `Accept`, our own `User-Agent`, which names hosted MCP, and `X-Agentify-Operation` with the tool's name.
- The body, if the operation has one, is the body argument as JSON, with the operation's content type.
- The credential goes on last, so no argument can replace it.

It's sent once: never retried, and never redirected. It's cut off after 15 seconds.

## The answer

- A `2xx` answer comes back as text, JSON pretty-printed, read up to 1 MB. A longer one is cut, with a note saying so.
- A body that isn't text is described, by its size and type, instead of shown.
- A redirect comes back as an error with its `Location`. Another status comes back as an error with the start of its body.
- If your API echoes the credential back, the agent sees `[credential]` instead.

[Errors](errors) lists every message an agent can get.

## Where this comes from

- `app/hosted-mcp/_lib/upstream.ts`
- `app/hosted-mcp/_lib/validate.ts`
- `app/hosted-mcp/_lib/server.ts`
- `app/api/readiness/_lib/agentify/convert.ts`

---

# Hosted MCP errors

There are two kinds. A refusal of the request itself is a JSON-RPC error with an HTTP status. A failed tool call is a tool result marked `isError`, with HTTP `200`, so the agent can read it and try again. "…" stands for a value the message fills in.

## Refusals

| Message | HTTP | JSON-RPC | When |
| --- | --- | --- | --- |
| `There’s no hosted MCP server here.` | `404` | `-32000` | The project doesn't exist, or its server is off. |
| `Send a Latitude 10 MCP key for this server: Authorization: Bearer l10m_…` | `401` | `-32000` | No key or a wrong one, on a server that takes keys only. |
| `Sign in to use this server: your MCP client can start it from this response’s WWW-Authenticate header.` | `401` | `-32000` | No sign-in, on a server that takes signed-in users only. |
| `Sign in to use this server, or send a Latitude 10 MCP key: Authorization: Bearer l10m_…` | `401` | `-32000` | Neither, on a server that takes both. |
| `The pinned version (v…) is no longer kept. An owner can pin another version or follow the latest.` | `409` | `-32000` | The server is pinned to a version the registry deleted. |
| `This server has no version of its API yet. Push one to the registry.` | `409` | `-32000` | The project has no version. |
| `Version … of this API can’t be turned into tools.` | `409` | `-32000` | The version's document can't be read as tools. |
| `This server’s API host isn’t verified, so no calls are made. An owner can verify it in the workspace.` | `503` | `-32000` | The host was never verified, or its recheck failed. |
| `Hosted MCP isn’t available right now.` | `503` | `-32000` | The service can't reach its storage. |
| `Too many requests. Try again later.` | `429` | `-32000` | Too many requests from one address. |
| `Tool … isn’t available with this key.` | `200` | `-32602` | The tool is off, or not in the key's allow list. |
| `Too many calls with …: at most … a minute. Try again shortly.` | `200` | `-32029` | The calls a minute for this key, or this sign-in, are used. A signed-in user gets a key's limit. |
| `This workspace has used its tool calls for this month. They reset at ….` | `200` | `-32029` | The workspace's monthly calls are used. |

Under MCP revision 2026-07-28, the two limit errors carry `-32010` instead of `-32029`.

## Failed tool calls

| Message | When |
| --- | --- |
| `The arguments don’t match this tool:` | The arguments failed the check. Each wrong path follows on its own line. |
| `arguments.…: is required.` | A path argument is missing or empty. |
| `arguments.…: can’t be “.” or “..”.` | A path argument would move up the path. |
| `The tool’s path leaves the API’s base URL.` | The built path is outside your base URL. |
| `arguments.…: can’t contain line breaks.` | A header argument has a line break. |
| `arguments.…: isn’t a valid header value.` | A header argument can't be sent as a header. |
| `The API’s base URL isn’t allowed.` | The base URL no longer passes the host check. |
| `The stored credential can’t be used. Store it again.` | The credential can't be opened or sent. |
| `Your sign-in has expired. Sign in again from your MCP client.` | A signed-in user's identity provider session has ended. |
| `This server calls its API as each signed-in user; keys can’t be used.` | A key on a server that calls your API as each user, with no stored credential. |
| `The call couldn’t be built.` | Anything else went wrong before sending. |
| `The API didn’t answer within … seconds.` | Your API took longer than 15 seconds. |
| `The API couldn’t be reached.` | The connection failed. |
| `The API answered … Redirects are not followed` | Your API answered a redirect. Its `Location` follows. |
| `The API answered ….` | Your API answered an error status. The start of its body follows. |

## Where this comes from

- `app/hosted-mcp/_lib/upstream.ts`
- `app/hosted-mcp/_lib/mcp.ts`
- `app/hosted-mcp/_lib/server.ts`
- `app/hosted-mcp/_lib/credential.ts`
- `app/mcp/_lib/handler.ts`
- `app/mcp/_lib/modern.ts`

---

# Keys and allow lists

## Keys

Agents connect with an MCP key, which starts with `l10m_`. Owners and admins create them on the project's MCP page. A key is shown once, stored only as a hash, and opens its own project's server and no other. Revoke it on the same page and it stops working at once.

How many keys a server may have depends on your plan: see [Plans and limits](../get-started/plans-and-limits#mcp). After a downgrade, keys over the new number are kept but suspended, newest first, until the plan comes back or you revoke older ones.

## Which tools are on

When the server is made, its reads (`GET` and `HEAD`) are on and every write is off. Owners and admins turn each tool on or off. At most 60 tools can be on at once: an agent chooses worse from a long list.

## Allow lists

On Pro and up, a key can carry an allow list: it sees only the tools on that list that are also on for the server. A key without one sees every tool that's on. On Free, every key sees every tool that's on.

| Answer | When |
| --- | --- |
| “Tool allow lists come with Pro.” | An allow list on Free. |
| “Choose at most 60 of this server’s tools.” | An allow list too long, or with a tool name that isn't one. |
| “This server has its … keys. Revoke one first.” | The server has as many keys as the plan allows. |

## Where this comes from

- `app/hosted-mcp/_lib/keys.ts`
- `app/hosted-mcp/_lib/server.ts`
- `app/workspace/actions.ts`
- `app/workspace/_lib/quotas.ts`

---

# Agent analytics

On Pro and up, the project's MCP page links **Agent analytics**: a month of tool calls, by tool and by client, each with its calls, errors and the time your API took to answer.

## Which client called

Each call is put down to the client that made it, with only its major version kept, such as `Claude Code 2.x`:

| Label | How the client is known |
| --- | --- |
| Declared | The client named itself when it connected. |
| Inferred | Only its `User-Agent` names it. |

Known families, such as Claude Code, Claude, Codex, Cursor, ChatGPT, Copilot and Gemini, are named the same way whatever their exact build. A client nothing names is `unknown`.

## What's kept, and what isn't

Only daily totals per tool and client are stored, and older days are deleted as new ones come in. Never the arguments, the answers, the caller's address or the key.

The month's tool calls across the workspace, which count against your plan, are on the MCP page too: see [Plans and limits](../get-started/plans-and-limits#mcp).

## Where this comes from

- `app/hosted-mcp/_lib/usage.ts`
- `app/hosted-mcp/_lib/mcp.ts`
- `app/workspace/[ws]/[project]/mcp/analytics/page.tsx`

---

# Protocol versions

Every MCP endpoint here, hosted servers and docs servers alike, speaks MCP over Streamable HTTP, stateless: each request stands alone, and every answer is JSON, never a stream. A `GET` asking for a stream gets `405`.

## The current revision

| Version | How it's used |
| --- | --- |
| 2026-07-28 | No handshake. Every request carries its version and client in `_meta`, mirrored in the `MCP-Protocol-Version`, `Mcp-Method` and, for a tool call, `Mcp-Name` headers. |

A request whose headers don't match its body gets a header-mismatch error, and one naming a version we don't serve gets the list of versions we do.

## The legacy versions

These start with `initialize`, as they always did:

| Version |
| --- |
| 2025-11-25 |
| 2025-06-18 |
| 2025-03-26 |
| 2024-11-05 |
| 2024-10-07 |

The two from 2024 still work on `initialize`, but they aren't offered in a version error or in `server/discover`.

## Where this comes from

- `app/mcp/_lib/modern.ts`
- `app/mcp/_lib/handler.ts`

---

# OAuth sign-in

On Pro and up, people can connect to a hosted MCP server by signing in through your own identity provider instead of using a key. Each server gets its own authorization server at `https://latitude10.tech/oauth/<workspace>/<project>`. It signs nobody in itself: it registers MCP clients, asks the person's consent, sends them to your provider, and issues its own tokens for that one server.

Tested end to end with Auth0.

### 1. Register an app with your provider

Create an OpenID Connect app with the callback URL the MCP page shows, `https://latitude10.tech/oauth/<workspace>/<project>/callback`.

### 2. Connect it

On the project's MCP page, enter the provider's issuer, the app's client id and its secret. The secret is sealed the way the API credential is, and never shown again.

### 3. Choose who may connect

Choose keys only, sign-in only, or both. On "both", agents with a key and people who sign in can use the server side by side.

## Discovery

An MCP client finds everything from the server's `401`, whose `WWW-Authenticate` header points at the protected resource metadata:

| Document | Path |
| --- | --- |
| Protected resource metadata | `/.well-known/oauth-protected-resource/mcp/<workspace>/<project>` |
| Authorization server metadata | `/.well-known/oauth-authorization-server/oauth/<workspace>/<project>` |
| OpenID Connect discovery | `/.well-known/openid-configuration/oauth/<workspace>/<project>`, and `/oauth/<workspace>/<project>/.well-known/openid-configuration` |

The endpoints are `/authorize`, `/token`, `/revoke` and, when dynamic registration is on, `/register`, all under the server's `/oauth/<workspace>/<project>`.

## Clients

- A client can name itself with a client ID metadata document: its `client_id` is an `https` URL.
- Or, if you allow dynamic client registration, it registers and gets a `client_id` starting with `l10c_`.
- Every client is public: no client secret. PKCE with `S256` is required.
- The scopes are `tools` and `offline_access`.
- An owner or admin can revoke any client on the MCP page.

How many clients and sign-ins a server takes depends on the plan: see [Plans and limits](../get-started/plans-and-limits#mcp).

## Tokens

The server issues access tokens starting with `l10a_` and refresh tokens starting with `l10r_`, stored only as hashes. Refresh tokens rotate on every use, and a code or refresh token used twice ends the sign-in.

MCP sign-in tokens are bound to one server and never sent to your API.

Your API gets the stored credential, as with keys, or, if you choose, each person's own token from your provider.

## Claim rules

Rules give people tools by the claims in their ID token: a claim, a value, and the tools it opens, such as `groups` containing `support`. A person gets the server's tools that are on and that a rule they match names. With no rules, everyone who signs in gets every tool that's on. Each refresh asks your provider again, so a person's tools follow their groups.

## Where this comes from

- `app/hosted-mcp/_lib/oauth.ts`
- `app/hosted-mcp/_lib/signin.ts`
- `app/hosted-mcp/_lib/tokens.ts`
- `app/hosted-mcp/_lib/idp.ts`
- `app/hosted-mcp/_lib/server.ts`
- `app/hosted-mcp/_lib/oauth-admin.ts`
- `app/oauth/[ws]/[project]/.well-known/openid-configuration/route.ts`
- `docs/superpowers/specs/2026-10-22-api-platform-enterprise.md`

---

# Docs hosting

Your guides live as Markdown in your repository. CI pushes the folder as one archive with a project key, and the site is built once, at push: every page rendered, every link checked, the search index and the agent files written. Readers then get stored pages, so nothing is rendered per visit.

A site is served at `https://latitude10.tech/docs/<workspace>/<project>` once an owner or admin publishes it, with the project's reference as a section of its own once that's published too. On Pro and up it can also be served on your own domain.

Every site comes with `llms.txt`, `llms-full.txt`, a Markdown copy of each page, `skill.md` and a docs MCP server, with nothing to set up.

## In this section

- [The docs folder](bundle): its layout, `latitude10.docs.json`, front matter, page addresses and what's refused.
- [Markdown in guides](markdown): what a page may use, and how to work within it.
- [Push your docs](push): production, versions and previews.
- [Files for agents](agent-files): `llms.txt`, Markdown pages and the docs MCP server.
- [Custom domains](custom-domains): your own subdomain, with one CNAME.
- [Docs traffic](traffic): who reads the site, people and agents.

## Where this comes from

- `app/docs/_lib/bundle.ts`
- `app/docs/_lib/build.ts`
- `app/docs/_lib/site.ts`
- `app/api/registry/v1/docs/route.ts`
- `app/workspace/docs-actions.ts`

---

# The docs folder

## What goes in it

| File | What it becomes |
| --- | --- |
| Any `.md` file | A page. |
| A `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp` or `.svg` file | An image pages can show. Its contents must match its extension. |
| `latitude10.docs.json` | The site's settings, below. Optional. |
| `skill.md` | Your own agent skill, in place of the one we write. |

Anything else is left out with a warning. macOS's `.DS_Store`, `._` files and `__MACOSX/` are left out silently.

## latitude10.docs.json

| Key | What it sets |
| --- | --- |
| `title` | The site's name. Without it, the project's name. |
| `description` | One line about the site, for `llms.txt` and `skill.md`. |
| `logo` | The path of an image in the folder. If it isn't there, a warning. |
| `accent` | A colour for links and highlights. If it's too faint to read on the light or dark theme, that theme keeps the default, with a warning. |
| `nav` | The sidebar: a list of groups, each `{ "group": "Name", "pages": ["path/without/md"] }`. |
| `reference` | `{ "title": "…" }`, the name of the reference's section. |

An unknown key gets a warning. A key of the wrong type, or a file that isn't JSON, refuses the push.

With `nav`, every page that isn't hidden should be in it: one that's left out gets a warning, and so does a name with no page. Without `nav`, pages are grouped by their top folder, each group with its `index` first, then by `order`, then by path.

## Front matter

A page may start with front matter between two `---` lines:

| Field | What it does |
| --- | --- |
| `title` | The page's title. Without it, the page's first `#` heading, or else its file name. |
| `description` | The page's summary, for search engines and `llms.txt`. |
| `order` | A whole number that sorts the page within its group when there's no `nav`. |
| `hidden` | `true` serves the page but leaves it out of the sidebar. |

Other fields are ignored.

## Page addresses

A page's address is its path without `.md`, in lowercase, with spaces as dashes: `Guides/Web Hooks.md` is `/guides/web-hooks`. An `index.md` is its folder's address, and the root `index.md` is the home page. Two files that would share an address refuse the push.

The site serves these paths itself, so a page there would never show, and gets a warning: `mcp`, `reference`, `_search`, `_theme.css`, `llms.txt`, `llms-full.txt`, `sitemap.xml` and `robots.txt`, and anything under `v/`, `preview/`, `_assets/`, `.well-known/` or `mcp/`.

## What refuses a push

| Refusal | Status | Why |
| --- | --- | --- |
| Not gzip | `422` | The body isn't a `.tar.gz` archive. |
| Too large | `413` | The folder, unpacked, is over your plan's bundle size. |
| Too many pages | `413` | It has more pages than your plan builds. |
| Bad path | `422` | A path leaves the folder, or an entry is a link or a special file. |
| Collision | `422` | Two files would be the same page. |
| Bad config | `422` | `latitude10.docs.json` isn't valid. |

The sizes and page counts per plan are in [Plans and limits](../get-started/plans-and-limits#docs).

## Where this comes from

- `app/docs/_lib/bundle.ts`
- `app/docs/_lib/build.ts`
- `app/api/registry/v1/docs/route.ts`

---

# Markdown in guides

Pages are rendered by a safe Markdown renderer. Raw HTML is never passed through, so what a page can do is what this table says.

## What's rendered

| You write | You get |
| --- | --- |
| `#` to `####` | Headings, each with an anchor. The page's contents list shows the `##` and `###` ones. |
| Text separated by blank lines | Paragraphs. |
| `*em*`, `**strong**`, backticks | Emphasis, strong text and inline code. |
| A fence of three backticks with a language | A code block, with the language as its class. |
| Lines starting with `-`, `*`, `+` or `1.` | A flat list. |
| A table with a `---` row | A table, with column alignment. Cells hold inline text only. |
| Lines starting with `>` | A blockquote, up to three deep. |
| `> [!NOTE]`, `> [!TIP]` or `> [!WARNING]` on a quote's first line | A callout. |
| `---` alone on a line | A horizontal rule. |
| `![alt](_images/diagram.png)` | An image from the folder. |
| `[text](other-page#anchor)` | A link to another page, checked at build. |
| `[text](https://…)` or `mailto:` | A link out. |

## What isn't, and what to do instead

| Not supported | Instead |
| --- | --- |
| Nested lists: an indented item is plain text. | Make the sub-point its own sentence, or a table row. |
| A list item over two lines: the next line ends the list. | Keep each item to one line. |
| Code inside a list item: the fence ends the list, and a numbered list after it starts again at one. | Use `### 1.` headings for steps with code, each followed by its fence. |
| Raw HTML and HTML comments: they show as text. | Use Markdown, or leave it out. |
| Bare URLs, strikethrough, task lists, footnotes and hard line breaks. | Write links as `[text](url)`. |
| Other callouts, such as `[!IMPORTANT]`. | Use one of the three. |
| Images from another site: left out, with a warning. | Put the image in the folder. |
| Syntax highlighting and copy buttons. | Nothing: code shows as plain monospaced text. |

A link to a page that doesn't exist builds, but with a warning, and shows as plain text.

## Where this comes from

- `app/reference/_lib/markdown.ts`
- `app/docs/_lib/build.ts`

---

# Push your docs

Every push is the whole folder, as a gzipped tar archive, sent with a project key.

### 1. Pack the folder

```sh
tar -czf docs.tar.gz -C docs .
```

### 2. Send it

```sh
curl -sS -X POST "$BASE/docs?branch=main&commit=$GITHUB_SHA" -H "Authorization: Bearer $LATITUDE10_KEY" -H "Content-Type: application/gzip" --data-binary @docs.tar.gz
```

The answer, with `201`, holds the build's id, its kind, its label, its page count, its `url` and `warnings`: every broken link, missing image, unknown config key or page left out of the navigation. A push with warnings still builds, so read them in CI.

## Parameters

| Parameter | What it's for |
| --- | --- |
| `branch` | Required. The Git branch the folder came from. |
| `commit` | The commit SHA, kept with the build. |
| `version` | A label such as `v1`: the push becomes a versioned copy at `/v/<label>`. |
| `preview` | `1`: the push becomes a private preview of the branch. |

`version` and `preview` can't both be sent.

## The docs branch

Without `version` or `preview`, a push replaces the live site. The first branch you push becomes the project's docs branch, and a production push from any other branch answers `409`, so a feature branch can't replace the site by accident. Change the docs branch in the project's Docs panel.

## Previews

On Pro and up, `preview=1` builds a branch on its own. The answer adds `previewUrl`, a private address with a random token in it: share it with reviewers, since nobody can guess it. A preview expires after 14 days. Pushing the same branch again replaces its preview.

Delete a preview when its pull request closes:

```sh
curl -sS -X DELETE "$BASE/docs/previews/feature%2Fnew-guide" -H "Authorization: Bearer $LATITUDE10_KEY"
```

It answers `204` whether or not there was a preview. Encode a `/` in the branch name as `%2F`.

How many versions and previews a project keeps, and how many pushes it gets a day, depend on the plan: see [Plans and limits](../get-started/plans-and-limits#docs). A new version or preview past the plan's number is refused until you delete one in the workspace.

## Errors

| Status | When |
| --- | --- |
| `400` | `branch` is missing or malformed, `commit` or `version` is malformed, or both `version` and `preview` were sent. |
| `403` | The plan has no versions or previews, or already has as many as it keeps. |
| `409` | A production push from a branch that isn't the docs branch. |
| `413` | The folder is over the plan's size or page count. |
| `415` | The body isn't sent as `application/gzip`. |
| `422` | The archive or its config is refused: see [The docs folder](bundle). |
| `429` | The project's docs pushes for today are used. |

## Where this comes from

- `app/api/registry/v1/docs/route.ts`
- `app/api/registry/v1/docs/previews/[branch]/route.ts`
- `app/docs/_lib/store.ts`
- `app/docs/_lib/build.ts`
- `openapi/registry-v1.yaml`

---

# Files for agents

Every published docs site serves these, built at push from the same pages people read.

| Path | What it is |
| --- | --- |
| `/llms.txt` | Every page in the navigation, by group, with its title, its Markdown address and its description. |
| `/llms-full.txt` | Every page's Markdown in one file, in navigation order, then the reference. Very large sites are cut at a fixed size, with a note at the end. |
| `/<page>.md` | Any page as Markdown. A request with `Accept: text/markdown` gets the same at the page's own address. |
| `/skill.md` | An agent skill describing the site and pointing at the rest. Put a `skill.md` in your folder to use your own. |
| `/reference.md` | The project's API reference as Markdown, once the reference is published. |
| `/mcp` | The docs MCP server, below. |
| `/mcp/server-card` and `/.well-known/mcp` | The MCP server's card, as `application/mcp-server-card+json`. |
| `/.well-known/ai-catalog.json` | An AI Catalog pointing at that card, as `application/ai-catalog+json`. |

## The docs MCP server

Each site has its own MCP server at `/mcp`, with no key, since the docs are public once published. Its tools are read-only:

| Tool | What it does |
| --- | --- |
| `search_docs` | Full-text search over every page, answering each match's title, URL and a snippet. |
| `read_page` | One page as Markdown, by the path `search_docs` or `list_pages` gives. |
| `list_pages` | The navigation: groups of pages with their URLs. |

Its calls count against a daily number per site: see [Plans and limits](../get-started/plans-and-limits#docs). Past it, a call answers that the day's limit is reached, and when it resets.

## Where this comes from

- `app/docs/_lib/build.ts`
- `app/docs/_lib/site.ts`
- `app/docs/_lib/mcp.ts`
- `app/docs/_lib/search.ts`
- `app/docs/_lib/store.ts`

---

# Custom domains

On Pro and up, a docs site can also be served at a subdomain you own, such as `docs.example.com`, with the reference as a section of it. Its certificate is issued and renewed for you.

### 1. Add the domain

In the project's Docs panel, add the subdomain. It must be a subdomain: an apex domain such as `example.com` isn't supported yet. An IP address, a latitude10.tech name, or a domain already connected to another project is refused.

### 2. Add the CNAME

At your DNS provider, add the record the panel shows:

```
docs.example.com  CNAME  domains.latitude10.tech
```

Every domain points at `domains.latitude10.tech`.

### 3. Check it

Choose **Check now**. The domain is live once both its hostname and its certificate are active; until then the panel shows each one's status.

## How many

The number of custom domains per workspace depends on the plan: see [Plans and limits](../get-started/plans-and-limits#docs).

## After a downgrade

If the workspace has more domains than its new plan includes, the oldest ones keep working, and the rest are paused: the panel marks them "paused: over the plan". A paused domain is never deleted. It comes back when the plan does, or remove it yourself.

## Where this comes from

- `app/docs/_lib/domains.ts`
- `app/docs/_lib/site.ts`
- `app/docs/_lib/edge.ts`
- `app/workspace/[ws]/[project]/DocsPanel.tsx`

---

# Docs traffic

On Pro and up, the project's docs traffic page shows the last month, day by day: people, and each family of AI agents, by what they read.

## Who's counted

| Audience | How it's known |
| --- | --- |
| People | A browser's `User-Agent`. |
| An agent family, such as Claude, ChatGPT or Gemini | Its `User-Agent` names it. |
| Other agents | Anything else that isn't a browser. |

## What's counted

| Kind | A read of |
| --- | --- |
| Pages | A page, as HTML. |
| Markdown | A page as Markdown, `skill.md` or `reference.md`. |
| `llms.txt` | `llms.txt` or `llms-full.txt`. |
| MCP | A docs MCP tool call. |

Members reading their own docs in the workspace aren't counted.

## What isn't kept

Only a count per day, audience and kind. Never which pages a visitor read, their address, or anything that tells one visitor from another. Older days are deleted as new ones come in.

On Free, the site, `llms.txt` and the MCP server work the same, but the traffic page isn't included.

## Where this comes from

- `app/docs/_lib/usage.ts`
- `app/docs/_lib/site.ts`
- `app/docs/_lib/mcp.ts`
- `app/hosted-mcp/_lib/usage.ts`

---

# SDKs

On Pro and up, your CI asks the registry API for an SDK made from a registry version and your `latitude10.sdk.json`, and gets the package back as a `.tgz`. It then publishes it to your own npm or PyPI account. We never publish for you, and the generated code is yours, under the MIT licence.

- **TypeScript:** an ESM package with no runtime dependencies, for Node.js 20+, Deno, Bun, Workers and browsers.
- **Python:** a package for Python 3.11+, with `httpx` as its one dependency.

Each package's version follows the registry's breaking-change diff, and the same config and registry version give the same package again.

### 1. Add the config

Commit a `latitude10.sdk.json` naming your package: see [The config](config).

### 2. Generate the package

```sh
curl -sS -X POST "$BASE/sdks/typescript?version=latest" -H "Authorization: Bearer $LATITUDE10_KEY" -H "Content-Type: application/json" --data-binary @latitude10.sdk.json -o sdk.tgz
```

`version` is `latest`, the default, or a registry version number.

Members can also download a preview of the package from the SDK panel on the project's page.

How many endpoints an SDK may have, and how many builds a project gets a day, depend on the plan: see [Plans and limits](../get-started/plans-and-limits#sdks).

## In this section

- [The config](config): every field of `latitude10.sdk.json`.
- [The TypeScript package](typescript): its files, retries, errors and pagination.
- [The Python package](python): its clients, types and errors.
- [The publishing workflow](workflow): from a push to npm and PyPI.
- [SDK versioning](versioning): how each version is worked out.
- [OpenAPI extensions](openapi-extensions): naming, grouping and pagination.
- [Coverage](coverage): what's left out or typed as unknown.

## Where this comes from

- `app/sdk/_lib/builds.ts`
- `app/sdk/_lib/config.ts`
- `app/api/registry/v1/sdks/typescript/route.ts`
- `app/sdk/_lib/typescript/emit.ts`

---

# The SDK config

`latitude10.sdk.json` is the body of every generation request, at most 16 KB. An unknown key is a warning; a field that fails its check refuses the request with `422` and a sentence that says what to fix.

```json
{
  "generator": 1,
  "package": "@acme/sdk",
  "clientName": "Acme",
  "firstVersion": "0.1.0",
  "license": { "holder": "Acme, Inc." },
  "homepage": "https://docs.acme.example",
  "exclude": { "operations": ["getInternalStats"] },
  "python": { "package": "acme-sdk", "module": "acme_sdk" }
}
```

## The fields

| Field | What it sets | Checked |
| --- | --- | --- |
| `package` | The npm package name. Required. | A valid npm name, scoped or not, in lowercase. |
| `clientName` | The client class's name. | A JavaScript identifier, and not a reserved word. |
| `firstVersion` | The version of the first package. Default `0.1.0`. | A version such as `1.0.0`, with no prerelease. |
| `include` | Only these operations: `{ "tags": […], "operations": […] }`. | Lists of names. |
| `exclude` | Leave these out, in the same shape. | Lists of names. |
| `license` | `{ "holder": "…" }`, the copyright holder in the MIT licence. Default: the workspace. | A name. |
| `repository` | The package's repository link. | An `https://` URL. |
| `homepage` | The package's homepage link. | An `https://` URL. |
| `generator` | The generator's version. | `1`, the only one so far. |
| `python` | The Python package, below. Without it, no Python package can be made. | An object with at least `package`. |

## The python section

| Field | What it sets | Checked |
| --- | --- | --- |
| `python.package` | The PyPI project name, normalised as PyPI does. Required. | A valid PyPI name. |
| `python.module` | The import name. Default: the package name with `-` as `_`. | A Python identifier, not a keyword or a standard library module. |
| `python.firstVersion` | The first Python package's version. Default `0.1.0`. | As `firstVersion`. |
| `python.include` | Python's own include filter, in place of the shared one. | As `include`. |
| `python.exclude` | Python's own exclude filter, in place of the shared one. | As `exclude`. |

## One file, two languages

Each language builds from its own view of the file. TypeScript's is the top-level keys. Python's is the same keys with the `python` section's name, module, first version and filters in their place. A package is identified by its own view, so changing a Python key never moves the TypeScript version line, and the reverse.

## Where this comes from

- `app/sdk/_lib/config.ts`
- `app/sdk/_lib/names.ts`
- `app/sdk/_lib/builds.ts`
- `openapi/latitude10.sdk.json`

---

# The TypeScript package

An ESM package with strict types and no runtime dependencies. It uses the standard `fetch`, so it runs on Node.js 20+, Deno, Bun, Cloudflare Workers and in browsers, and it never calls Latitude 10.

## Its files

| File | What it holds |
| --- | --- |
| `package.json` | The name and version, `"type": "module"` and `"engines": { "node": ">=20" }`. |
| `src/client.ts` | The client class, named by `clientName`. |
| `src/resources/` | The operations, grouped by tag, a method each. |
| `src/models.ts` | The types from your document's schemas. |
| `src/core.ts` | The runtime, the same file in every SDK we generate. It holds no text from your document. |
| `src/index.ts` | What the package exports. |
| `README.md` | Install, use, each resource's methods, errors and retries. |
| `GENERATION.md` | How it was generated, and anything skipped. |
| `CHANGELOG.md` | What changed in each version. |
| `LICENSE` | MIT, in the holder's name. |
| `tsconfig.json` | The build settings. |

## Auth

The client takes `apiKeys` by security scheme name, `bearerToken` as a string or a function it asks before every request, so you can refresh it, or `username` and `password` for basic auth. Each operation sends the first of its schemes the client has credentials for.

## Retries and timeouts

- Connection errors, timeouts, `408`, `429` and `5xx` are retried with backoff, and `Retry-After` is honoured.
- `POST` and `PATCH` are retried only with an idempotency key: `idempotencyKey` in a call's options, or one made for you when the operation declares an `Idempotency-Key` header.
- Set `maxRetries` and `timeoutMs` on the client or per call, and pass `signal` to cancel.

## Errors

A response outside `2xx` throws an `APIError` with `status`, `headers`, `body` and `requestId`, as one of `BadRequestError`, `AuthenticationError`, `PermissionDeniedError`, `NotFoundError`, `ConflictError`, `UnprocessableEntityError`, `RateLimitError` or `InternalServerError`. A network failure throws `APIConnectionError`, a timeout `APITimeoutError`. All of them extend the client's own error class.

Every method also has a `…WithResponse` sibling that returns `{ data, response }`, for the headers and the status.

## Pagination

An operation that pages, by cursor, offset or page number, returns a page you can await for the first page, or walk with `for await` for every item of every page. [OpenAPI extensions](openapi-extensions) says how a paging operation is found, and `GENERATION.md` says which methods page.

## Where this comes from

- `app/sdk/_lib/typescript/emit.ts`
- `app/sdk/_lib/typescript/runtime/core.ts`
- `app/sdk/_lib/model.ts`
- `tests/fixtures/sdk/petstore/expected/README.md`

---

# The Python package

A package for Python 3.11 or newer, with one dependency, `httpx`. It has a sync and an async client, and type hints throughout.

## Its files

| File | What it holds |
| --- | --- |
| `pyproject.toml` | The name, version, `requires-python = ">=3.11"`, the `httpx` dependency, and pyright in strict mode. |
| `src/<module>/_client.py` | The sync and async clients. |
| `src/<module>/resources/` | The operations, grouped by tag, a method each. |
| `src/<module>/types.py` | A `TypedDict` for each schema. |
| `src/<module>/_core.py` | The runtime, the same file in every Python SDK we generate. |
| `src/<module>/py.typed` | The marker that tells type checkers the package is typed. |
| `README.md`, `GENERATION.md`, `CHANGELOG.md`, `LICENSE` | As in the TypeScript package. |

The code is laid out as `ruff format` lays it out, so `ruff format --check` passes, and it type-checks under pyright's strict mode.

## Clients

The client is named from `clientName`, and its async twin has `Async` in front: `Acme` and `AsyncAcme`. Both take the same arguments. Credentials are passed in, never read from the environment. Pass `http_client=` to use your own `httpx.Client`, and close a client with `close()`, `aclose()` for the async one, or a `with` block.

## Retries, errors and responses

- Connection errors, timeouts, `408`, `429` and `5xx` are retried with backoff, and `Retry-After` is honoured. `POST` and `PATCH` are retried only with an idempotency key: `idempotency_key=` on a call, or one made for you when the operation declares an `Idempotency-Key` header. Set `max_retries` and `timeout` on the client or per call.
- A response outside `2xx` raises an `APIError` with `status_code`, `headers`, `body` and `request_id`, as the same classes the TypeScript package throws. A network failure raises `APIConnectionError`, a timeout `APITimeoutError`.
- Methods return the parsed JSON body, typed by the `TypedDict`s. Every method has a `…_with_response` sibling that returns `(data, response)`, the `httpx.Response`.

## Where this comes from

- `app/sdk/_lib/python/emit.ts`
- `app/sdk/_lib/python/types.ts`
- `app/sdk/_lib/python/layout.ts`
- `app/sdk/_lib/python/runtime/_core.py`
- `tests/fixtures/sdk/petstore/expected-python/README.md`

---

# The publishing workflow

The SDK panel on the project's page shows a whole workflow for `.github/workflows/sdk.yml`. On every push to `main` that changes `openapi.yaml` or `latitude10.sdk.json`, it pushes the document to the registry, generates the TypeScript package, builds it and publishes it to npm, then does the same for Python when the config has a `python` section.

### 1. Add the key

Save your project key as the repository secret `LATITUDE10_KEY`.

### 2. Set up trusted publishing

On npm and on PyPI, add this repository and workflow as a trusted publisher for your package. The workflow then publishes with your own accounts' trust: npm with provenance, PyPI through its trusted publishing.

### 3. Add the workflow

```yaml
name: SDK
on:
  push:
    branches: [main]
    paths: [openapi.yaml, latitude10.sdk.json]
permissions:
  contents: read
  id-token: write # npm trusted publishing
jobs:
  sdk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
      - name: Push the spec to Latitude 10
        run: >
          curl --fail-with-body -X POST
          "https://latitude10.tech/api/registry/v1/versions?git_sha=$GITHUB_SHA&git_ref=$GITHUB_REF"
          -H "Authorization: Bearer $LATITUDE10_KEY"
          --data-binary @openapi.yaml
        env:
          LATITUDE10_KEY: ${{ secrets.LATITUDE10_KEY }}
      - name: Generate the SDK
        run: >
          curl --fail-with-body -X POST
          "https://latitude10.tech/api/registry/v1/sdks/typescript?version=latest"
          -H "Authorization: Bearer $LATITUDE10_KEY"
          -H "Content-Type: application/json"
          --data-binary @latitude10.sdk.json -o sdk.tgz
          && tar -xzf sdk.tgz
        env:
          LATITUDE10_KEY: ${{ secrets.LATITUDE10_KEY }}
      - name: Build the SDK
        working-directory: package
        run: npm install --no-audit --no-fund && npm run build
      - name: Publish it unless this version is already on npm
        working-directory: package
        run: |
          NAME=$(node -p 'require("./package.json").name')
          VERSION=$(node -p 'require("./package.json").version')
          if npm view "$NAME@$VERSION" version > /dev/null 2>&1; then
            echo "$NAME@$VERSION is already on npm"
          else
            npm publish --provenance --access public
          fi
        # Without trusted publishing, save an npm token as NPM_TOKEN and uncomment:
        # env:
        #   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  python-sdk:
    runs-on: ubuntu-latest
    needs: sdk
    permissions:
      contents: read
      id-token: write # PyPI trusted publishing
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v7
        with:
          python-version: "3.13"
      - name: Generate the Python SDK
        run: >
          curl --fail-with-body -X POST
          "https://latitude10.tech/api/registry/v1/sdks/python?version=latest"
          -H "Authorization: Bearer $LATITUDE10_KEY"
          -H "Content-Type: application/json"
          --data-binary @latitude10.sdk.json -o sdk-python.tgz
          && mkdir -p sdk-python && tar -xzf sdk-python.tgz -C sdk-python
        env:
          LATITUDE10_KEY: ${{ secrets.LATITUDE10_KEY }}
      - name: Type-check and build the Python SDK
        working-directory: sdk-python/package
        run: python -m pip install build pyright httpx && pyright && python -m build
      - name: Publish it to PyPI unless this version is already there
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: sdk-python/package/dist
          skip-existing: true
          # Without trusted publishing, save a PyPI API token as PYPI_API_TOKEN and uncomment:
          # password: ${{ secrets.PYPI_API_TOKEN }}
```

A version already on npm or PyPI is skipped, so re-running the workflow is safe.

## Without trusted publishing

Save an npm token as `NPM_TOKEN`, or a PyPI API token as `PYPI_API_TOKEN`, and uncomment the lines the workflow marks.

The packages are published from your repository, to your accounts. Latitude 10 never publishes a package for you and never opens a pull request in your repository.

## Where this comes from

- `app/sdk/_lib/ci.ts`
- `app/api/registry/v1/sdks/typescript/route.ts`
- `app/api/registry/v1/sdks/python/route.ts`

---

# SDK versioning

The first package of each language gets your config's `firstVersion`. After that, each package's version is worked out from the last one, the registry's diff between their versions, and the names the SDK exports. The biggest bump that applies wins.

| What changed | Bump |
| --- | --- |
| A breaking change in the diff, or a changed operationId (a renamed method) | Major |
| An exported name is gone from the SDK | Major |
| Any other change in the diff, such as a new operation or a deprecation | Minor |
| A new exported name | Minor |
| No diff to compare with | Minor, compared by exported names only |
| Only a removed description, or nothing | Patch |

[Breaking changes](../registry/breaking-changes) lists every kind of change the diff finds.

## Below 1.0.0

As semver does for versions below `1.0.0`, a major change moves the minor number, and anything else the patch: `0.3.2` becomes `0.4.0` or `0.3.3`.

## The same input, the same package

The same config and the same registry version give the same package and version again, so a re-run never moves the version.

## Previews

A preview from the SDK panel is versioned so it can't be mistaken for a release: `0.0.0-preview.7` for TypeScript and `0.0.0.dev7` for Python, for registry version 7. A preview can be made from the sample document; a package to publish can't.

## Where this comes from

- `app/sdk/_lib/version.ts`
- `app/sdk/_lib/builds.ts`
- `app/registry/_lib/diff.ts`

---

# OpenAPI extensions for SDKs

The generator reads two extensions on an operation, both ours. Other vendors' `x-` keys aren't read.

## x-latitude10-sdk

`x-latitude10-sdk` names and groups an operation's method:

```yaml
paths:
  /orders:
    get:
      operationId: listOrders
      x-latitude10-sdk:
        name: list
        group: orders
```

| Field | What it does |
| --- | --- |
| `name` | The method's name, in place of the operationId. |
| `group` | The resource the method goes in, in place of the operation's first tag. |
| `exclude` | `true` leaves the operation out of the SDK. |

Without it, a method is named from the operationId, or else from its method and path, and grouped by its first tag.

## x-latitude10-pagination

`x-latitude10-pagination` declares how an operation pages, so its method can walk every page:

```yaml
x-latitude10-pagination:
  type: cursor
  cursorParam: cursor
  nextCursor: $.next_cursor
  items: $.data
```

| `type` | Also needs |
| --- | --- |
| `cursor` | `cursorParam`, a query parameter, and `nextCursor`, a path in the response. |
| `offset` | `offsetParam` and `limitParam`, two different query parameters. |
| `page` | `pageParam`, a query parameter. |

Every type needs `items`, the path of the list in the response, such as `$.data`. A declaration that's missing something leaves the operation unpaginated, with a warning in `GENERATION.md` saying what.

## Detected without the extension

Only one common shape is detected, never guessed: a query parameter named `cursor`, `after`, `starting_after` or `page_token`, and a response object with exactly one array property and either a `next_cursor` or `next_page_token` field, or a `has_more` field with items that have an `id`, the last of which is the next cursor.

## Where this comes from

- `app/sdk/_lib/model.ts`
- `app/sdk/_lib/names.ts`
- `tests/fixtures/sdk/`

---

# What the SDKs cover

The generator takes OpenAPI 3.0 and 3.1. Swagger 2.0 is refused: convert it first. Whatever it can't turn into code is left out or typed as `unknown`, never guessed, and each case is a line under "Warnings" in the package's `GENERATION.md`.

## Left out

| What | Why |
| --- | --- |
| Webhooks | An SDK only calls the API. |
| Callbacks and response links | The same. |
| Cookie parameters | The SDK doesn't send cookies. |
| A header the SDK sets itself, or one that carries a credential | The client sets it. |
| A header with the same name as a query parameter | They'd be one field. |
| A path that names a parameter nothing declares, or a path parameter that isn't in the path | The method couldn't be built. |
| An API key in a cookie, and security schemes other than API keys, bearer, OAuth 2, OpenID Connect and basic | Not supported. |
| An operation with `x-latitude10-sdk.exclude`, or outside `include` and `exclude` | You asked. |

## Typed as unknown

| What | Note |
| --- | --- |
| A `$ref` to another file or a URL | Only local `$ref`s are read. |
| A `$ref` that doesn't resolve, or a chain of too many | |
| A schema nested too deeply | |
| `not`, and `patternProperties` | They can't be typed. |
| Schemas that refer to each other with no object in between | |
| A document with more schema types than the generator takes | The rest are `unknown`. |

## The operations cap

A document with more operations than the generator takes is refused with `403`, whatever the plan. Below that, a document with more operations than your plan's endpoints is refused too: use `include` or `exclude` to generate fewer. See [Plans and limits](../get-started/plans-and-limits#sdks).

## Where this comes from

- `app/sdk/_lib/model.ts`
- `app/sdk/_lib/builds.ts`
- `app/sdk/_lib/names.ts`
- `tests/fixtures/sdk/`

---

# Enterprise

SSO, the admin and viewer roles and the audit log come with Business and Enterprise. Enterprise adds the SLA and limits set by contract: see [Plans and limits](../get-started/plans-and-limits#enterprise).

| | |
| --- | --- |
| [SSO](sso) | Sign in through your identity provider over OpenID Connect, and require it for the workspace. |
| [Email domains](domains) | Prove your company's domains, so your provider speaks for addresses there. |
| [Roles](roles) | Owner, admin, editor and viewer, and what each may do. |
| [Break-glass](break-glass) | Owners' logged way in when your provider is down. |
| [Audit log](audit-log) | Every sign-in and change, exportable as CSV or JSON Lines. |
| [The SLA](https://latitude10.tech/legal/sla) | The service levels Enterprise is held to. |

## What's true in code

Sign-in is with GitHub or an emailed link that works once, for 15 minutes. SSO is OpenID Connect, on Business and Enterprise.

The audit log is append-only: the database refuses changes, and deletes of events younger than 30 days. It's kept 90 days on Business and 365 on Enterprise.

Uptime is published on our status page, and the SLA covers Enterprise.

The [status page](https://status.latitude10.tech) shows each check and every incident.

## Where this comes from

- `app/enterprise/_lib/sso.ts`
- `app/enterprise/_lib/audit.ts`
- `app/legal/_content/sla.tsx`
- `app/security/_lib/facts.ts`
- `migrations/0015_enterprise.sql`
- `app/workspace/_lib/quotas.ts`

---

# SSO

On Business and Enterprise, members can sign in through your company's identity provider. It's OpenID Connect only, with the authorization code flow, PKCE and a nonce. There's no SAML.

Tested end to end with Okta.

### 1. Register an app with your provider

Create an OpenID Connect web app with this callback URL:

```
https://latitude10.tech/api/workspace/auth/sso/callback
```

The callback's path is `/api/workspace/auth/sso/callback`.

### 2. Connect it

Owners do this on the workspace's SSO settings page: enter the provider's issuer URL, the app's client id and its secret. The provider's endpoints are found from the issuer by discovery. The secret is sealed and never shown again.

### 3. Prove your email domains

Your provider is trusted only for addresses on domains the workspace has proved: see [Email domains](domains).

### 4. Test it

**Run a test sign-in** goes through the provider once and shows the claims it sent. It passes when your email is on a proved domain, and your session doesn't change. A passing test is recorded on the connection.

### 5. Require it, if you want

With **Require SSO** on, members get into the workspace only with a session made through this connection in the last 12 hours. Owners keep a logged way in if the provider breaks: see [Break-glass](break-glass).

## What we ask for and use

- The scopes `openid email profile`.
- `sub`, which ties the provider's user to one account here.
- `email`, which must be on a proved domain, and isn't accepted when `email_verified` is false.
- `name`, for display.

An account is tied to the provider's `sub`. If a provider's user signs in with an address that another account here already has, the sign-in is refused, so an account can't be taken over by changing the provider's records.

## New people

Optionally, people with an address on a proved domain who aren't members yet can join on their first SSO sign-in, as viewers or editors, while a seat is free. Without it, they need an invitation.

## Where this comes from

- `app/enterprise/_lib/sso.ts`
- `app/enterprise/_lib/gate.ts`
- `app/enterprise/_lib/domains.ts`
- `app/hosted-mcp/_lib/idp.ts`
- `app/api/workspace/auth/sso/callback/route.ts`
- `app/workspace/enterprise-actions.ts`
- `docs/runbooks/enterprise.md`

---

# Email domains

SSO trusts your identity provider only for addresses on domains the workspace has proved. That's the whole trust model, so it's checked on every sign-in.

### 1. Add the domain

On the workspace's SSO settings page, add your company's domain, such as `acme.com`. The page gives a token starting with `l10-sso-`.

### 2. Publish the TXT record

Add a TXT record at `_latitude10-sso.<domain>` whose value is the token, for example at `_latitude10-sso.acme.com`.

### 3. Check it

Choose **Check now** beside the domain. Once the record is found, the domain is proved.

## The rules

- A proved domain belongs to one workspace at a time.
- Public email services, such as Gmail, Outlook, Yahoo, iCloud and Proton, can't be proved: owning an address there says nothing about a company.
- A proof is checked again on a sign-in once it's 30 days old. If the record is gone, the domain stops being proved. If DNS can't answer, nothing changes.
- How many domains a workspace may prove depends on the plan: see [Plans and limits](../get-started/plans-and-limits#enterprise).

## Where this comes from

- `app/enterprise/_lib/domains.ts`
- `app/enterprise/_lib/sso.ts`
- `app/hosted-mcp/_lib/upstream.ts`

---

# Roles

Every member of a workspace has one role. This table is the one the workspace checks before every action.

| Permission | What it allows | Owner | Admin | Editor | Viewer |
| --- | --- | --- | --- | --- | --- |
| `workspace.read` | See the workspace, its projects and their versions, and read shared collections. | Yes | Yes | Yes | Yes |
| `project.write` | Create projects, push versions and edit shared collections. | Yes | Yes | Yes | No |
| `project.publish` | Publish the hosted reference and docs, set up Try it and its proxy, and publish collections to readers. | Yes | Yes | No | No |
| `project.delete` | Delete a project. | Yes | Yes | No | No |
| `keys.manage` | Create and revoke CI keys, and run the project’s hosted MCP server: its host, credential, keys, tools and sign-in. | Yes | Yes | No | No |
| `members.manage` | Invite and remove members, and change their roles. | Yes | Yes | No | No |
| `audit.read` | Read and export the audit log. | Yes | Yes | No | No |
| `sso.manage` | Set up SSO, its email domains, and whether it’s required. | Yes | No | No | No |
| `sso.break_glass` | Open a workspace that requires SSO without signing in through it. Each day it’s used is logged. | Yes | No | No | No |
| `billing.manage` | Start, change and cancel the subscription. | Yes | No | No | No |
| `workspace.rename` | Rename the workspace. | Yes | No | No | No |
| `workspace.delete` | Delete the workspace. | Yes | No | No | No |

Admin and viewer come with SSO: see [Plans and limits](../get-started/plans-and-limits#enterprise). On a plan without SSO, an admin acts as an editor, so a downgrade never gives anyone more.

## When a role may not

A refused action answers with one of these:

- “Only workspace owners can do this.”
- “Only workspace owners and admins can do this.”
- “Viewers can look, but not change anything.”

## Where this comes from

- `app/workspace/_lib/permissions.ts`
- `tests/permissions-matrix.test.ts`

---

# Break-glass

When a workspace requires SSO, a member gets in only with a recent SSO session through its connection. If your identity provider breaks, that would lock everyone out, so owners keep a way in.

## Who

Only owners, by the `sso.break_glass` permission: see [Roles](roles). An owner who signs in with GitHub or an emailed link still gets into the workspace. Admins, editors and viewers without an SSO session are turned away.

## How it's recorded

- Each owner who comes in this way is recorded as `sso.break_glass` in the [audit log](audit-log), once a day per person, with how they signed in.
- The SSO settings page lists the owners who came in without SSO lately, with a link to the audit log.
- Each member turned away is recorded as `sso.required`, the same way.

## What it doesn't touch

Requiring SSO guards the workspace's pages and actions for people. CI's project keys, agents' MCP keys and MCP sign-in tokens don't go through it, so pushes and agents keep working while your provider is down.

An invitation to a workspace that requires SSO is accepted only from an SSO session of its connection, whatever its role: break-glass is for people who already own the workspace.

## Where this comes from

- `app/enterprise/_lib/gate.ts`
- `app/enterprise/_lib/audit.ts`
- `app/workspace/_lib/access.ts`
- `app/workspace/_lib/permissions.ts`
- `app/workspace/[ws]/settings/sso/page.tsx`

---

# Audit log

The audit log records who did what in a workspace, and when. Each event carries only the detail keys listed for its action, so a secret can’t ride along.

## What it records

### Sign-ins and access

| Action | What happened | Details |
| --- | --- | --- |
| `sso.signed_in` | Someone signed in through the workspace’s SSO. `joined` says whether that made them a member. | `joined` |
| `sso.refused` | An SSO sign-in was refused, with the reason. | `reason` |
| `sso.break_glass` | An owner opened a workspace that requires SSO without an SSO session. Recorded once a day per person. | `method` |
| `sso.required` | A member without an SSO session was turned away from a workspace that requires SSO. Recorded once a day per person. | `method` |

### SSO settings

| Action | What happened | Details |
| --- | --- | --- |
| `sso.connection_saved` | The SSO connection was saved. | `issuer`, `client_id` |
| `sso.connection_tested` | The SSO connection was tested with a sign-in. | `issuer` |
| `sso.connection_deleted` | The SSO connection was deleted. | `issuer` |
| `sso.domain_added` | An email domain was added for SSO. | `domain` |
| `sso.domain_verified` | An email domain’s TXT record was verified. | `domain` |
| `sso.domain_check_failed` | A check of an email domain’s TXT record failed. | `domain` |
| `sso.domain_removed` | An email domain was removed. | `domain` |
| `sso.enforcement_changed` | Requiring SSO was turned on or off. | `on` |
| `sso.joining_changed` | Joining through SSO changed: the role new people get, or off. | `role` |

### Members

| Action | What happened | Details |
| --- | --- | --- |
| `member.invited` | Someone was invited, with a role. | `role` |
| `member.invite_revoked` | An invitation was revoked. | None |
| `member.joined` | Someone joined, by an invitation or through SSO. | `role`, `via` |
| `member.role_changed` | A member’s role changed. | `from`, `to` |
| `member.removed` | A member was removed. | `role` |
| `member.left` | A member left the workspace. | `role` |

### Projects

| Action | What happened | Details |
| --- | --- | --- |
| `project.created` | A project was created. | None |
| `project.deleted` | A project was deleted. | None |
| `project.version_uploaded` | A version was added on the project page: uploaded, fetched from a URL, or the sample. | `seq`, `source` |
| `reference.changed` | The hosted reference was published or unpublished, or its indexing or download setting changed. | `change` |
| `docs.changed` | The docs site was published or unpublished, or its indexing changed. | `change` |
| `docs.branch_changed` | The branch the docs site serves changed. | `branch` |
| `docs.build_deleted` | A docs build was deleted. | `build` |
| `docs.domain_added` | A custom domain was added to the docs site. | `hostname` |
| `docs.domain_removed` | A custom domain was removed from the docs site. | `hostname` |
| `playground.changed` | Try it, or its proxy, was turned on or off. | `change` |
| `playground.host_added` | A host was added for the proxy. | `host` |
| `playground.host_verified` | A proxy host was verified. | `host`, `by` |
| `playground.host_removed` | A proxy host was removed. | `host` |
| `collection.created` | A shared collection was created. | `name` |
| `collection.deleted` | A shared collection was deleted. | `name`, `requests` |
| `collection.published` | A shared collection was published to readers. | `name`, `requests` |
| `collection.unpublished` | A shared collection was unpublished. | `name` |
| `collection.imported` | A collection was imported. | `name`, `requests` |
| `collection.exported` | A collection was exported. | `name`, `format`, `requests` |

### Keys and credentials

| Action | What happened | Details |
| --- | --- | --- |
| `key.created` | A CI key was created. Only its shown prefix is recorded. | `prefix`, `label` |
| `key.revoked` | A CI key was revoked. | None |
| `mcp.changed` | A hosted MCP server setting changed, such as turning it on, pinning a version or its host. | `change`, `value` |
| `mcp.credential_set` | The MCP server’s API credential was stored. Its kind and name are recorded, never its value. | `kind`, `name` |
| `mcp.credential_cleared` | The MCP server’s API credential was removed. | None |
| `mcp.key_created` | An MCP key was created. Only its shown prefix is recorded. | `prefix`, `label`, `scoped` |
| `mcp.key_revoked` | An MCP key was revoked. | None |
| `mcp.oauth_changed` | The MCP server’s sign-in changed, such as its identity provider, its mode or a claim rule. | `change`, `value` |

### Billing

| Action | What happened | Details |
| --- | --- | --- |
| `billing.plan_changed` | The workspace’s plan changed. | `from`, `to`, `source` |
| `billing.subscription_cancelled` | The subscription was cancelled. | `by` |

### Workspace

| Action | What happened | Details |
| --- | --- | --- |
| `workspace.renamed` | The workspace was renamed. | `from`, `to` |
| `workspace.deleted` | The workspace was deleted. | None |

### The audit log

| Action | What happened | Details |
| --- | --- | --- |
| `audit.exported` | The audit log was exported. | `from`, `to`, `format`, `rows` |

## Exporting it

Owners and admins export a range of up to 31 days from the audit settings page, as CSV or JSON Lines. The columns are `at`, `actor_type`, `actor_id`, `actor_label`, `action`, `target_type`, `target_id`, `target_label`, `ip`, `country`, `details`. JSON Lines carries the same fields and the event's `id`, with `details` as JSON. A CSV cell that a spreadsheet would run as a formula starts with a quote.

The response's `x-content-sha256` header is the SHA-256 of the file, so you can tell whether a copy was changed after download.

How many rows one export holds depends on your plan: see [Plans and limits](../get-started/plans-and-limits#enterprise).

## How long it’s kept

Events are kept for your plan’s retention: see [Plans and limits](../get-started/plans-and-limits#enterprise). No event is ever changed, and none younger than 30 days can be deleted, whatever runs against the database.

## Where this comes from

- `app/enterprise/_lib/actions.ts`
- `app/enterprise/_lib/export.ts`
- `app/enterprise/_lib/filter.ts`
- `app/enterprise/_lib/audit.ts`
- `migrations/0015_enterprise.sql`

---

# Changelog

Customer-visible changes, newest first. Each line names the pull request it shipped in.

## 2026-10-22

- Our own registry API now runs on the platform: its hosted reference with Try it, and these docs at docs.latitude10.tech. (#119)
- These docs are served at docs.latitude10.tech. (#120)
- The platform's pages show our own live reference, docs and MCP server as proof. (#126)
- A new workspace goes from sign-up to a published reference with a checklist, and can start from a sample document. (#121)
- The site is organised as an API platform: the Platform, Docs, Pricing and Enterprise navigation, a page per module, and the Enterprise page. (#122)
- One message across the site, with Start free as the way in. (#114)
- Python SDKs, generated beside the TypeScript ones from the same registry version and config. (#113)
- Shared collections for the API client: saved Try it requests, Examples for readers, and export to Postman. (#112)
- Enterprise is available, with the SLA. (#108)
- The SLA schedule is published. (#107)
- SSO over OpenID Connect, the admin and viewer roles, and the audit log, and the Business plan launches. (#106)
- The pricing page no longer shows a stale note about planned features. (#110)

## 2026-10-21

- The CI readiness gate, our GitHub Action, is available, and the Pro plan launches. (#104)
- The API client: Try it in every hosted reference, with a proxy on Pro for APIs without CORS. (#101)

## 2026-10-20

- Every MCP endpoint also serves MCP protocol revision 2026-07-28. (#100)
- The SDK generator: TypeScript SDKs from a registry version, built and published from your CI. (#98)
- Sign-in to hosted MCP servers through your own identity provider. (#99)
- Hosted docs: Markdown guides pushed from CI, with files and an MCP server for agents. (#97)
- Hosted MCP servers made from a registry version. (#95)
- The hosted API reference: publish it, embed it, and members' own view. (#94)
- The registry: every version of your OpenAPI document, scored, with breaking changes found. (#92)
- The customer workspace: sign in with GitHub or an emailed link, workspaces, members, projects and CI keys. (#89)

## 2026-10-19

- The API platform: the platform's story, its plans and its services on the site. (#88)

---

# Registry API

The registry API is what your CI calls. With one project key it can:

- push a version of your OpenAPI document and read its score, its report and its diff;
- get rules-only fixes for a document, as JSON Patch, on the paid plans;
- push your docs folder, which becomes a site like this one;
- generate your TypeScript and Python SDKs from a version.

Every operation, with its parameters and answers, is in the [reference](https://docs.latitude10.tech/reference).

## Base URL

```
https://latitude10.tech/api/registry/v1
```

## Authentication

Send a project key as a bearer token:

```
Authorization: Bearer $LATITUDE10_KEY
```

Project keys start with `l10p_`. Create one on your project's page under **CI keys**; it's shown once. The key names its project, so no workspace or project appears in a URL, and it can push to that project only. Keep it in your CI's secrets. Revoke it on the same page and it stops working at once.

A missing or revoked key gets `401`. See [Errors](errors).

## Quotas

Pushes, fix runs, docs pushes and SDK generations each count against a quota set by your plan: see [Plans and limits](../get-started/plans-and-limits). Past one, the API answers `429` with `resetsAt`, when the quota resets, and a `Retry-After` header. A retry before then gets the same answer.

## For agents

[llms.txt](https://docs.latitude10.tech/llms.txt) lists these pages for a model to read, and the docs' MCP server at `/mcp` lets an agent search them with no key.

To call the API from your browser, open the [reference on latitude10.tech](https://latitude10.tech/r/jorge-ortega/registry-api), paste your key into Try it and send a request.

## Where this comes from

- `openapi/registry-v1.yaml`
- `app/api/registry/v1/_lib/route.ts`
- `app/workspace/_lib/keys.ts`
- `app/registry/_lib/usage.ts`

---

# Errors

Every error is JSON with one field, `error`, a sentence that says what went wrong and what to do:

```json
{ "error": "There is no version 7." }
```

A `429` adds `resetsAt`:

```json
{ "error": "Quota reached for this period. It resets at 2026-10-24T00:00:00.000Z.", "resetsAt": "2026-10-24T00:00:00.000Z" }
```

## Statuses

| Status | When | What it says, for example |
| --- | --- | --- |
| `400` | A parameter is malformed, such as a version number or a branch name. | `seq must be a version number.` |
| `401` | No project key was sent, or it was revoked. | `Send a project key: Authorization: Bearer l10p_…` |
| `402` | You asked for an SDK on a plan without SDKs. | `SDKs come with Pro.` |
| `403` | Your plan doesn't include what you asked for, or the project is read-only. | `This project is read-only: the workspace has more projects than its plan includes.` |
| `404` | The version you named doesn't exist. | `This project has no versions yet.` |
| `409` | Another push landed at the same moment, or a docs push names a branch that isn't the docs branch. | `Another version was pushed at the same moment. Push again.` |
| `413` | The body is larger than your plan allows. | The size you sent and the most that's read. |
| `415` | A docs push isn't a gzipped tar. | `Send the docs as a .tar.gz with Content-Type: application/gzip.` |
| `422` | The body isn't an OpenAPI 3.0 or 3.1 document, has an external `$ref`, or has more operations than the registry takes. | What's wrong with the document. |
| `429` | A quota is reached. | The time it resets, in `resetsAt`, and a `Retry-After` header. |
| `503` | The registry can't be reached right now. | `The registry is unavailable right now. Try again later.` |

A project becomes read-only when the workspace has more projects than its plan includes, for example after a downgrade. Reading still works.

Each operation's own errors are listed in the [reference](https://docs.latitude10.tech/reference).

## Where this comes from

- `openapi/registry-v1.yaml`
- `app/api/registry/v1/_lib/route.ts`
- `app/api/registry/v1/versions/route.ts`
- `app/api/registry/v1/docs/route.ts`
- `app/registry/_lib/usage.ts`
- `app/registry/_lib/bundle.ts`
- `app/sdk/_lib/builds.ts`

---

# Latitude 10 Registry API (1.0.0)

The API a Latitude 10 project's CI calls: push a version of the project's OpenAPI document and read its readiness report and breaking-change diff, get rules-only fixes as JSON Patch, push the project's docs, and generate its TypeScript and Python SDKs.
Every request carries a project key, `Authorization: Bearer l10p_…`, created on the project page under CI keys. The key names the project, so no workspace or project appears in a URL. Quotas are per plan; a request over one answers 429 with `resetsAt`, and retrying before then won't help.

Base URL: https://latitude10.tech/api/registry/v1

## Authentication
- projectKey: http, bearer. A project key (l10p_…) from the project page's CI keys. It names the project and can push to it, so keep it in your CI's secrets.

## Versions

The project's OpenAPI document, one version per push.

### GET /versions

List the project's versions

Lists every version of the project's OpenAPI document that the plan keeps, newest first, each with its readiness score and diff counts. The list isn't paginated; a plan keeps at most a few hundred versions.

Responses:
- 200: The versions, newest first.
- 401: No project key was sent, or it was revoked.
- 503: The registry is unavailable right now. Try again later.

### POST /versions

Push a version of the OpenAPI document

Pushes the project's OpenAPI document (3.0 or 3.1, YAML or JSON, bundled into one file) as the request body. The registry scores it with the readiness rules and diffs it against the latest version. Answers 201 with the new version, or 200 with the latest version when the bytes are the same as the latest's, so pushing the same document twice keeps one version. Every push counts toward the daily push quota, the repeated one too.

Parameters:
- `label` (query, string): A label shown beside the version, such as a short commit SHA or a release tag. Longer than 100 characters, it is cut to 100. Without one, the document's info.version is the label.
- `git_sha` (query, string): The Git commit the document was pushed from.
- `git_ref` (query, string): The Git ref the document was pushed from.

Request body: application/json, required. The OpenAPI document, as YAML or JSON text, up to the plan's document size.

Responses:
- 200: The document is the same as the latest version's; that version is answered and no new one is made.
- 201: The new version.
- 401: No project key was sent, or it was revoked.
- 403: The project is read-only, because the workspace has more projects than its plan includes.
- 409: Another version was pushed at the same moment. Push again.
- 413: The document is larger than the plan keeps.
- 422: The body isn't an OpenAPI 3.0 or 3.1 document, or it has an external $ref.
- 429: A quota of the plan is reached for this period. Wait until resetsAt; retrying sooner answers the same.
- 503: The registry is unavailable right now. Try again later.

### GET /versions/latest

Get the latest version

Answers the newest version of the project's document with its readiness score, its finding count and its breaking-change counts against the version before it. Answers 404 when nothing has been pushed yet.

Responses:
- 200: The latest version.
- 401: No project key was sent, or it was revoked.
- 404: This project has no versions yet.
- 503: The registry is unavailable right now. Try again later.

### GET /versions/{seq}/report

Get a version's readiness report

Answers the readiness report stored when the version was pushed, with the score, the rules version, and every rule with its findings and suggested fix. Use it to show why a version scored what it did.

Parameters:
- `seq` (path, required, string): The version's number, as listed by listVersions.

Responses:
- 200: The stored report.
- 400: seq isn't a version number.
- 401: No project key was sent, or it was revoked.
- 404: There is no version with that number.
- 503: The registry is unavailable right now. Try again later.

### GET /versions/{seq}/source

Download a version's document as pushed

Answers the version's OpenAPI document byte for byte as it was pushed, as application/json when it was pushed as JSON and application/yaml otherwise. Use it to restore or compare a version.

Parameters:
- `seq` (path, required, string): The version's number, as listed by listVersions.

Responses:
- 200: The document as pushed.
- 400: seq isn't a version number.
- 401: No project key was sent, or it was revoked.
- 404: There is no version with that number.
- 503: The registry is unavailable right now. Try again later.

### GET /diff

Compare two versions

Lists what changed between any two versions of the project's document, each change marked breaking, warning or info. The diff stored on push answers when the pair is a version and the one before it; any other pair is computed on request.

Parameters:
- `from` (query, required, string): The older version's number.
- `to` (query, required, string): The newer version's number.

Responses:
- 200: The changes from one version to the other.
- 400: from or to is missing or isn't a version number.
- 401: No project key was sent, or it was revoked.
- 404: There is no version with that number.
- 503: The registry is unavailable right now. Try again later.

## Fixes

Rules-only fixes for a document, as JSON Patch.

### POST /fixes

Get rules-only fixes for a document

Scores the OpenAPI document in the body with the readiness rules and answers the fixes that raise its score, as a JSON Patch to apply to the document, with the score before and after. The fixes come from the rules alone; no model is called, so the same document always gets the same patch. Each call counts toward the workspace's monthly fix runs. Paid plans only.

Request body: application/json, required. The OpenAPI document, as YAML or JSON text.

Responses:
- 200: The fixes, as JSON Patch.
- 401: No project key was sent, or it was revoked.
- 403: Suggested fixes are part of the paid plans.
- 413: The document is larger than the plan reads.
- 422: The body isn't an OpenAPI 3.0 or 3.1 document, or it has an external $ref.
- 429: A quota of the plan is reached for this period. Wait until resetsAt; retrying sooner answers the same.
- 503: The registry is unavailable right now. Try again later.

## Docs

The project's hosted docs, pushed as a folder.

### POST /docs

Push the docs folder

Pushes the project's docs folder as a .tar.gz and builds the hosted docs from it. Without version or preview, the push replaces the production site, and only from the project's docs branch (the first branch pushed, until changed in the workspace). With version=<label> it becomes a versioned copy; with preview=1, a private preview of the branch that expires after 14 days. Counts toward the daily docs pushes.

Parameters:
- `branch` (query, required, string): The Git branch the docs were built from (letters, digits, ., _, / and -).
- `commit` (query, string): The Git commit SHA, 7 to 40 hex characters.
- `version` (query, string): Push as a versioned copy under this label (up to 20 lowercase letters, digits, dots and dashes). Not with preview.
- `preview` (query, string): Send 1 to push a private preview of the branch. Not with version. Any other value is ignored, and the push goes to production.

Request body: application/gzip, required. The docs folder as a .tar.gz, with its latitude10.docs.json and Markdown pages.

Responses:
- 201: The docs were built.
- 400: A query parameter is missing or malformed, or the body is empty.
- 401: No project key was sent, or it was revoked.
- 403: The project is read-only, or the plan has no room for another docs version or preview.
- 409: The branch isn't the project's docs branch. Push it with preview=1, or change the docs branch in the workspace.
- 413: The folder is larger, or has more pages, than the plan builds.
- 415: The body isn't a .tar.gz. Send Content-Type application/gzip.
- 422: The archive can't be read, or its latitude10.docs.json is invalid.
- 429: A quota of the plan is reached for this period. Wait until resetsAt; retrying sooner answers the same.
- 503: The registry is unavailable, or docs pushes on the Free plan are paused for now.

### DELETE /docs/previews/{branch}

Delete a branch's docs preview

Deletes the docs preview of a branch, for when its pull request closes. Answers 204 whether or not the branch had a preview, so it's safe to call on every closed pull request.

Parameters:
- `branch` (path, required, string): The branch, URL-encoded (feature%2Fsearch for feature/search).

Responses:
- 204: The branch has no preview now.
- 401: No project key was sent, or it was revoked.
- 503: The registry is unavailable right now. Try again later.

## SDK

TypeScript and Python SDKs generated from a version.

### POST /sdks/typescript

Generate the TypeScript SDK

Generates the project's TypeScript SDK from a registry version and the project's latitude10.sdk.json, sent as the body, and answers the npm package as a .tgz. The package version follows the registry diff (breaking changes bump the major). The same config and version answer the same build again. Counts toward the daily SDK generations. Pro and Business.

Parameters:
- `version` (query, string): The registry version to generate from, latest (the default) or a version number.

Request body: application/json, required. The project's latitude10.sdk.json, up to 16 KB.

Responses:
- 200: The generated package as a .tgz, with its GENERATION.md listing anything left out.
- 400: version isn't latest or a version number.
- 401: No project key was sent, or it was revoked.
- 402: SDKs come with Pro.
- 403: The document has more operations than the plan generates SDKs for. Use include or exclude in latitude10.sdk.json.
- 404: The project has no registry versions yet, or not the one asked for.
- 409: The registry version is older than the package's last build. Generate from that version or later.
- 413: latitude10.sdk.json is over 16 KB.
- 422: latitude10.sdk.json is invalid or has no section for this language, or the version can't be read or modelled.
- 429: A quota of the plan is reached for this period. Wait until resetsAt; retrying sooner answers the same.
- 503: The registry is unavailable right now. Try again later.

### GET /sdks/typescript/builds

List the TypeScript SDK builds

Lists the project's TypeScript SDK builds, newest first, with each one's package version, the registry version it was built from, and the changes that set its version bump.

Responses:
- 200: The builds, newest first.
- 401: No project key was sent, or it was revoked.
- 503: The registry is unavailable right now. Try again later.

### POST /sdks/python

Generate the Python SDK

Generates the project's Python SDK from a registry version and the python section of the project's latitude10.sdk.json, sent as the body, and answers the package's source as a .tgz to build and upload to PyPI. The same config and version answer the same build again. Counts toward the daily SDK generations. Pro and Business.

Parameters:
- `version` (query, string): The registry version to generate from, latest (the default) or a version number.

Request body: application/json, required. The project's latitude10.sdk.json, up to 16 KB.

Responses:
- 200: The generated package as a .tgz, with its GENERATION.md listing anything left out.
- 400: version isn't latest or a version number.
- 401: No project key was sent, or it was revoked.
- 402: SDKs come with Pro.
- 403: The document has more operations than the plan generates SDKs for. Use include or exclude in latitude10.sdk.json.
- 404: The project has no registry versions yet, or not the one asked for.
- 409: The registry version is older than the package's last build. Generate from that version or later.
- 413: latitude10.sdk.json is over 16 KB.
- 422: latitude10.sdk.json is invalid or has no section for this language, or the version can't be read or modelled.
- 429: A quota of the plan is reached for this period. Wait until resetsAt; retrying sooner answers the same.
- 503: The registry is unavailable right now. Try again later.

### GET /sdks/python/builds

List the Python SDK builds

Lists the project's Python SDK builds, newest first, with each one's package version, the registry version it was built from, and the changes behind each bump.

Responses:
- 200: The builds, newest first.
- 401: No project key was sent, or it was revoked.
- 503: The registry is unavailable right now. Try again later.