> ## Documentation Index > Fetch the complete documentation index at: https://docs.usenexio.com/llms.txt > Use this file to discover all available pages before exploring further. # List a table's rows > Read one page of a registered source table by its own name, narrowed to its owner or its match filter. ## Behavior The response is the one list envelope: `data` holds one object per row, each with `row_key` (the row's opaque, stable identity) and `source_columns` (every registered column as text, keyed `.`, with NULL values left out), beside `page`, `source`, `unreachable`, `warnings` and `request_id`. The table's registration decides the filters it takes. [List a connection's tables](/api-reference/connections/list-tables) shows them for every table. * **Owner filter.** A table whose owner is `policy`, `account` or `claim` is read one owner at a time: send `policy_id`, `account_id` or `claim_id` as an instance key. A missing owner filter answers 400 `INVALID_ARGUMENT`, reason `FILTER_REQUIRED`; another owner's filter answers reason `FILTER_NOT_TAKEN`. A table whose owner is `none` is read whole and takes no owner filter. * **Match filter.** A table with a match column takes one filter named after that column, lower case, such as `cocode=` or `custid=`. Where the listing marks the filter as required, a read without it answers reason `FILTER_REQUIRED`. There is no generic `match=` parameter: it is refused with 400 `INVALID_ARGUMENT`, reason `FILTER_NOT_TAKEN`, and the detail names the table's own match filter. * **Paging.** `limit` defaults to 25; a value above 200 is coerced to 200 with a `LIMIT_COERCED` warning. Follow `page.next` with `cursor`; the cursor fixes the table and its filters. A cursor the read can no longer continue from answers reason `CURSOR_EXPIRED`, as on every Records list: start again from the first page. The person's authority applies before any read. An owner record outside the person's scope answers 404 `NOT_VISIBLE_OR_ABSENT`, the same as an unregistered table or a connection that is not your organization's. A table whose requirement the person's access policy does not grant, such as an accounting table without the accounting dataset, answers 403 `CAPABILITY_DENIED`, reason `DATASET_DENIED`. Direct identifiers are served only on a read narrowed to one owner. Send the person the request is for in `Nexio-Act-As` and `Nexio-Act-As-Email`, and the signed `Nexio-Assertion` when your organization enforces it. This route is for lineage, operators and proofs. Product code reads collections under `/records`. See [Source tables](/data-services/source-tables). ## OpenAPI ````yaml GET /connections/{id}/tables/{table} openapi: 3.1.0 info: title: Nexio API version: '1.0' description: | The Nexio public API. Submit runs to configured engines and read their results, hold conversations with configured assistants, make authorized reads over the planes and families of a connected system of record, and manage webhooks and environments. Six engine types are registered: comparison, matching, entity_analysis, diligence, triage, and opportunity. Every route under /api/v1/ requires `Authorization: Bearer `, except inbound event ingest (`POST /api/v1/events/ingest/{source_key}`), which authenticates each request against its ingest source instead: an HMAC-SHA256 signature for `nexio` and `github` sources, or a shared authentication code for an `ams360_ons` source. Error bodies share the `Error` schema. Call the API from servers only: it sends no CORS headers. contact: email: support@usenexio.com url: https://docs.usenexio.com servers: - url: https://api.usenexio.com description: >- Nexio API. Sandbox or live is chosen by the API key's environment, not by the host. security: - BearerAuth: [] tags: - name: EngineManagement description: >- Create, configure, version and manage engines. An engine is a configuration of one registered engine type. - name: Engines description: Engine-scoped endpoints for submitting runs and retrieving results. - name: Runs description: Retrieve and reconcile submitted runs. - name: Records description: >- Typed, authorized reads of the collections a connected system of record serves, and governed writes to the action ledger. - name: Connections description: >- The source tables registered on a connection, read by their own names: the estate surface, for lineage, operators and proofs. Product code reads collections under Records. - name: Graph description: >- The organization's data graph: a read-only map of connections and the derivations scheduled on them. Node kinds are a closed registry of 16; the API serves 14. - name: Environments description: >- The live environment and up to 5 sandbox environments in your org. Organization keys only. - name: Webhooks description: >- Manage webhook endpoints that receive terminal run events (run.completed, run.failed, run.cancelled) and run corrections (run.superseded). - name: Events description: >- Send inbound events to your organization's event log through an ingest source. Source kinds are nexio, github, ams360_ons and inbound_mail; a nexio source sends event types from your own vocabulary. - name: Converse description: The raw stateless conversational model turn (caller-owned state). - name: Conversations description: >- Conversation instances (orchestrators over engines) and their managed conversations, turns, annotations, evals, and exports. - name: Platform description: Service health. No key needed. paths: /connections/{id}/tables/{table}: get: tags: - Connections summary: List a table's rows description: >- One page of one registered source table of the connection, by the table's own name. Each row is `row_key` and `source_columns`: every registered column of the row as text, keyed `.`, with a NULL value left out. A table owned by a policy, an account or a claim is read one owner at a time (`policy_id`, `account_id` or `claim_id`), under that record's own access requirement. A table with a match column takes it as a filter named after the column, lower case (`cocode`, `custid`), as the listing shows; on some tables that filter is required. There is no generic `match` filter, and any other query parameter is refused, so a misspelt filter never widens a read. An accounting table is read only under the accounting dataset. Direct identifiers are served only on a read narrowed to one owner. The sandbox view answers each table's absence as data. A product read is a collection under `/records`, never this route. Credential: the organization's live API key, or a scoped key with `records:read`. A sandbox or test organization key gets 403 `CAPABILITY_DENIED`, reason `SCOPED_KEY_REQUIRED`. operationId: listTableRows parameters: - description: >- The person the request is for, as your identity provider's stable user id. Unset keeps the org-wide posture the key alone grants. The retired `X-Nexio-*` identity headers are refused on this route with 400 `INVALID_ARGUMENT`, reason `LEGACY_HEADER`. in: header name: Nexio-Act-As schema: description: >- The person the request is for, as your identity provider's stable user id. Unset keeps the org-wide posture the key alone grants. The retired `X-Nexio-*` identity headers are refused on this route with 400 `INVALID_ARGUMENT`, reason `LEGACY_HEADER`. type: string - description: >- The acting person's verified sign-in email, lowercased. Ignored without Nexio-Act-As. in: header name: Nexio-Act-As-Email schema: description: >- The acting person's verified sign-in email, lowercased. Ignored without Nexio-Act-As. type: string - description: >- The signed assertion over the identity headers (v1..). in: header name: Nexio-Assertion schema: description: >- The signed assertion over the identity headers (v1..). type: string - description: >- A caller-chosen request id, echoed in the Nexio-Request-Id response header. in: header name: Nexio-Request-Id schema: description: >- A caller-chosen request id, echoed in the Nexio-Request-Id response header. type: string - description: >- The caller's remaining budget for this request, in whole milliseconds (1 to 10 digits, greater than zero), relative to receipt. The engine stops work at the shorter of this and the route's own budget, and answers 504 request_timeout when it expires. A value above the route budget is capped to it; a malformed value is ignored. in: header name: Nexio-Timeout schema: description: >- The caller's remaining budget for this request, in whole milliseconds (1 to 10 digits, greater than zero), relative to receipt. The engine stops work at the shorter of this and the route's own budget, and answers 504 request_timeout when it expires. A value above the route budget is capped to it; a malformed value is ignored. type: string - description: >- The connection: one of the organization's connection ids, or `sandbox` for the sandbox seat's view of it. Any other id answers 404 `NOT_VISIBLE_OR_ABSENT`. in: path name: id required: true schema: description: >- The connection: one of the organization's connection ids, or `sandbox` for the sandbox seat's view of it. Any other id answers 404 `NOT_VISIBLE_OR_ABSENT`. type: string - description: >- The table: the system of record's own object name as the registry spells it, lower case. An AMS360 table is its name without the `AFW_` prefix (`company`, `custcontact`, `146schedequip`). An unregistered table answers 404 `NOT_VISIBLE_OR_ABSENT`. in: path name: table required: true schema: description: >- The table: the system of record's own object name as the registry spells it, lower case. An AMS360 table is its name without the `AFW_` prefix (`company`, `custcontact`, `146schedequip`). An unregistered table answers 404 `NOT_VISIBLE_OR_ABSENT`. pattern: ^[a-z0-9_]+$ type: string - description: >- The policy id, as an instance key. Required on a table whose owner is `policy`; refused on any other. explode: false in: query name: policy_id schema: description: >- The policy id, as an instance key. Required on a table whose owner is `policy`; refused on any other. type: string - description: >- The account id, as an instance key. Required on a table whose owner is `account`; refused on any other. explode: false in: query name: account_id schema: description: >- The account id, as an instance key. Required on a table whose owner is `account`; refused on any other. type: string - description: >- The claim id, as an instance key. Required on a table whose owner is `claim`; refused on any other. explode: false in: query name: claim_id schema: description: >- The claim id, as an instance key. Required on a table whose owner is `claim`; refused on any other. type: string - description: >- Rows whose ATTACHID equals this value, on a table whose match column is ATTACHID (journalmemo, payee). explode: false in: query name: attachid schema: description: >- Rows whose ATTACHID equals this value, on a table whose match column is ATTACHID (journalmemo, payee). type: string - description: >- Rows whose ATTRCODE equals this value, on a table whose match column is ATTRCODE (prstring). explode: false in: query name: attrcode schema: description: >- Rows whose ATTRCODE equals this value, on a table whose match column is ATTRCODE (prstring). type: string - description: >- Rows whose BANKCODE equals this value, on a table whose match column is BANKCODE (bankaccount, bankrecstatement, cashdisbursment and 3 more). explode: false in: query name: bankcode schema: description: >- Rows whose BANKCODE equals this value, on a table whose match column is BANKCODE (bankaccount, bankrecstatement, cashdisbursment and 3 more). type: string - description: >- Rows whose BROKERCODE equals this value, on a table whose match column is BROKERCODE (broker). explode: false in: query name: brokercode schema: description: >- Rows whose BROKERCODE equals this value, on a table whose match column is BROKERCODE (broker). type: string - description: >- Rows whose BRSID equals this value, on a table whose match column is BRSID (bankreccleared). explode: false in: query name: brsid schema: description: >- Rows whose BRSID equals this value, on a table whose match column is BRSID (bankreccleared). type: string - description: >- Rows whose CHARGECODE equals this value, on a table whose match column is CHARGECODE (commissionie). explode: false in: query name: chargecode schema: description: >- Rows whose CHARGECODE equals this value, on a table whose match column is CHARGECODE (commissionie). type: string - description: >- Rows whose CHECKLISTNAME equals this value, on a table whose match column is CHECKLISTNAME (agencychecklist). explode: false in: query name: checklistname schema: description: >- Rows whose CHECKLISTNAME equals this value, on a table whose match column is CHECKLISTNAME (agencychecklist). type: string - description: >- Rows whose COCODE equals this value, on a table whose match column is COCODE (agent, aptinsurer, benefitcarrier and 13 more). explode: false in: query name: cocode schema: description: >- Rows whose COCODE equals this value, on a table whose match column is COCODE (agent, aptinsurer, benefitcarrier and 13 more). type: string - description: >- Rows whose CPNPLISTID equals this value, on a table whose match column is CPNPLISTID (targetlistbpol, targetlistcustomer, targetlistlob and 3 more). explode: false in: query name: cpnplistid schema: description: >- Rows whose CPNPLISTID equals this value, on a table whose match column is CPNPLISTID (targetlistbpol, targetlistcustomer, targetlistlob and 3 more). type: string - description: >- Rows whose CRHID equals this value, on a table whose match column is CRHID (cashreceiptdeposit). explode: false in: query name: crhid schema: description: >- Rows whose CRHID equals this value, on a table whose match column is CRHID (cashreceiptdeposit). type: string - description: >- Rows whose CUSTID equals this value, on a table whose match column is CUSTID (generalledgertransaction, onaccountinvoice, pendingcheckglt). explode: false in: query name: custid schema: description: >- Rows whose CUSTID equals this value, on a table whose match column is CUSTID (generalledgertransaction, onaccountinvoice, pendingcheckglt). type: string - description: >- Rows whose DBDHID equals this value, on a table whose match column is DBDHID (directbilldownloaddetail). explode: false in: query name: dbdhid schema: description: >- Rows whose DBDHID equals this value, on a table whose match column is DBDHID (directbilldownloaddetail). type: string - description: >- Rows whose DBEHID equals this value, on a table whose match column is DBEHID (directbillentrycommission, directbillentrycommissionbuabreakout, directbillentrydetail). explode: false in: query name: dbehid schema: description: >- Rows whose DBEHID equals this value, on a table whose match column is DBEHID (directbillentrycommission, directbillentrycommissionbuabreakout, directbillentrydetail). type: string - description: >- Rows whose DBSHID equals this value, on a table whose match column is DBSHID (directbillstmtdetail). explode: false in: query name: dbshid schema: description: >- Rows whose DBSHID equals this value, on a table whose match column is DBSHID (directbillstmtdetail). type: string - description: >- Rows whose ELFFORMTYPEID equals this value, on a table whose match column is ELFFORMTYPEID (elfformversion). explode: false in: query name: elfformtypeid schema: description: >- Rows whose ELFFORMTYPEID equals this value, on a table whose match column is ELFFORMTYPEID (elfformversion). type: string - description: >- Rows whose EMPCODE equals this value, on a table whose match column is EMPCODE (benefitemployee, emplicense, employee and 1 more). explode: false in: query name: empcode schema: description: >- Rows whose EMPCODE equals this value, on a table whose match column is EMPCODE (benefitemployee, emplicense, employee and 1 more). type: string - description: >- Rows whose ENTITYID equals this value, on a table whose match column is ENTITYID (refgroup). explode: false in: query name: entityid schema: description: >- Rows whose ENTITYID equals this value, on a table whose match column is ENTITYID (refgroup). type: string - description: >- Rows whose GJID equals this value, on a table whose match column is GJID (generaljournalrelation). explode: false in: query name: gjid schema: description: >- Rows whose GJID equals this value, on a table whose match column is GJID (generaljournalrelation). type: string - description: >- Rows whose GLDIVCODE equals this value, on a table whose match column is GLDIVCODE (directbilldownloadheader, directbillentryheader, directbillstmtheader and 3 more). explode: false in: query name: gldivcode schema: description: >- Rows whose GLDIVCODE equals this value, on a table whose match column is GLDIVCODE (directbilldownloadheader, directbillentryheader, directbillstmtheader and 3 more). type: string - description: >- Rows whose INVID equals this value, on a table whose match column is INVID (directbillstmtautorec, invoicebatch, invoicebillingevent and 7 more). explode: false in: query name: invid schema: description: >- Rows whose INVID equals this value, on a table whose match column is INVID (directbillstmtautorec, invoicebatch, invoicebillingevent and 7 more). type: string - description: >- Rows whose ISTID equals this value, on a table whose match column is ISTID (invoicesplitallocation). explode: false in: query name: istid schema: description: >- Rows whose ISTID equals this value, on a table whose match column is ISTID (invoicesplitallocation). type: string - description: >- Rows whose LLDID equals this value, on a table whose match column is LLDID (leadlistdefdetail). explode: false in: query name: lldid schema: description: >- Rows whose LLDID equals this value, on a table whose match column is LLDID (leadlistdefdetail). type: string - description: >- Rows whose PLANID equals this value, on a table whose match column is PLANID (equineage, equinebreed, equinecovuse and 8 more). explode: false in: query name: planid schema: description: >- Rows whose PLANID equals this value, on a table whose match column is PLANID (equineage, equinebreed, equinecovuse and 8 more). type: string - description: >- Rows whose POLID equals this value, on a table whose match column is POLID (invoicesplittemplate). explode: false in: query name: polid schema: description: >- Rows whose POLID equals this value, on a table whose match column is POLID (invoicesplittemplate). type: string - description: >- Rows whose PSHID equals this value, on a table whose match column is PSHID (paystatementdetail). explode: false in: query name: pshid schema: description: >- Rows whose PSHID equals this value, on a table whose match column is PSHID (paystatementdetail). type: string - description: >- Rows whose QUEID equals this value, on a table whose match column is QUEID (queidquestions). explode: false in: query name: queid schema: description: >- Rows whose QUEID equals this value, on a table whose match column is QUEID (queidquestions). type: string - description: >- Rows whose RELATIONSHIPTYPEID equals this value, on a table whose match column is RELATIONSHIPTYPEID (relationship). explode: false in: query name: relationshiptypeid schema: description: >- Rows whose RELATIONSHIPTYPEID equals this value, on a table whose match column is RELATIONSHIPTYPEID (relationship). type: string - description: >- Rows whose RLHID equals this value, on a table whose match column is RLHID (renewallistcc). explode: false in: query name: rlhid schema: description: >- Rows whose RLHID equals this value, on a table whose match column is RLHID (renewallistcc). type: string - description: >- Rows whose TTSHID equals this value, on a table whose match column is TTSHID (trusttransferstatementdetail). explode: false in: query name: ttshid schema: description: >- Rows whose TTSHID equals this value, on a table whose match column is TTSHID (trusttransferstatementdetail). type: string - description: >- Rows whose VENDORCODE equals this value, on a table whose match column is VENDORCODE (vendor, vendorinvoice, vendorinvoicetemplate). explode: false in: query name: vendorcode schema: description: >- Rows whose VENDORCODE equals this value, on a table whose match column is VENDORCODE (vendor, vendorinvoice, vendorinvoicetemplate). type: string - description: >- Rows whose VINVID equals this value, on a table whose match column is VINVID (vendorinvoicetransaction, vendorpayment). explode: false in: query name: vinvid schema: description: >- Rows whose VINVID equals this value, on a table whose match column is VINVID (vendorinvoicetransaction, vendorpayment). type: string - description: >- Not a filter: refused with 400 `INVALID_ARGUMENT`, reason `FILTER_NOT_TAKEN`. A table's match filter is named after its column (`cocode`, `brokercode`), as the listing shows it under `filter`. explode: false in: query name: match schema: description: >- Not a filter: refused with 400 `INVALID_ARGUMENT`, reason `FILTER_NOT_TAKEN`. A table's match filter is named after its column (`cocode`, `brokercode`), as the listing shows it under `filter`. type: string - description: >- Page size. Defaults to 25; a value above 200 is coerced to 200 with a `LIMIT_COERCED` warning. explode: false in: query name: limit schema: description: >- Page size. Defaults to 25; a value above 200 is coerced to 200 with a `LIMIT_COERCED` warning. type: integer format: int64 minimum: 1 - description: >- The opaque `page.next` of the previous page. The table and its filters are fixed inside it. explode: false in: query name: cursor schema: description: >- The opaque `page.next` of the previous page. The table and its filters are fixed inside it. type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListTableRow' description: OK '400': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: >- `INVALID_ARGUMENT`, with `reason`: `FILTER_REQUIRED` (the table's owner filter or required match filter is missing), `FILTER_NOT_TAKEN` (a filter the table does not take), `INVALID_ID` (an id that is not an instance key of its kind), `INVALID_CURSOR`, `CURSOR_FILTER_MISMATCH` or `CURSOR_SUBJECT_MISMATCH` (a cursor this read did not issue, or issued for another table, filter or subject), `CURSOR_EXPIRED` (a cursor the read can no longer continue from: start again from the first page), `INVALID_TABLE_QUERY` (a query the table's reader cannot serve), or `CONNECTION_MISMATCH`. The generic `match` parameter is refused with reason `FILTER_NOT_TAKEN`, naming the table's own match filter; any other undeclared parameter is refused before any read. '401': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Unauthorized '403': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: >- `CAPABILITY_DENIED`, reason `DATASET_DENIED`: the person's access policy does not grant the table's requirement, for example the accounting dataset. '404': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: >- `NOT_VISIBLE_OR_ABSENT`: the table is not registered, the id is not one of the organization's connections, or the owner record is outside the person's scope. '424': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: >- `SOURCE_UNAVAILABLE`: the warehouse could not answer the read now. `retry_after_ms`, when present, is the wait before a retry. '429': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Too Many Requests '500': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Internal Server Error '503': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Service Unavailable '504': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Gateway Timeout security: - BearerAuth: [] components: schemas: ListTableRow: additionalProperties: false properties: data: description: One page of the collection, in the requested sort order. items: $ref: '#/components/schemas/TableRow' type: - array - 'null' facets: additionalProperties: items: $ref: '#/components/schemas/FacetValue' type: - array - 'null' description: Present only for the facets the request named in facets=. type: object page: $ref: '#/components/schemas/Page' request_id: description: The request id, as echoed in the Nexio-Request-Id response header. type: string source: $ref: '#/components/schemas/Source' total: $ref: '#/components/schemas/Total' description: Present only when the request sent include_total=true. unreachable: description: >- Parts of the answer no source could fill, each with its reason. Empty when every part was filled. items: $ref: '#/components/schemas/Unreachable' type: - array - 'null' warnings: description: >- Adjustments the platform made to the request (a coerced limit, a dropped facet). items: $ref: '#/components/schemas/Warning' type: - array - 'null' required: - data - page - source - unreachable - warnings - request_id type: object Problem: additionalProperties: false properties: code: description: >- The stable machine-readable error code, UPPER_SNAKE_CASE, one meaning forever. enum: - INVALID_ARGUMENT - UNAUTHENTICATED - CAPABILITY_DENIED - NOT_VISIBLE_OR_ABSENT - IDEMPOTENT_REQUEST_IN_FLIGHT - ETAG_MISMATCH - VALIDATION_FAILED - IDEMPOTENCY_KEY_PAYLOAD_MISMATCH - SOURCE_UNAVAILABLE - RATE_LIMITED - INTERNAL - DEADLINE_EXCEEDED - UNAVAILABLE - CLIENT_CLOSED_REQUEST type: string detail: description: A human-readable sentence about this occurrence. type: string details: description: >- Structured detail for the reason (for example which owner selection rule failed). errors: description: Each invalid parameter, for INVALID_ARGUMENT. items: $ref: '#/components/schemas/ProblemError' type: - array - 'null' instance: description: The request path this occurrence answered. type: string reason: description: >- The finer cause within the code, UPPER_SNAKE_CASE (for example SCOPE_UNAVAILABLE under CAPABILITY_DENIED). type: string request_id: description: The request id, as echoed in the Nexio-Request-Id response header. type: string retry_after_ms: description: When a retry may succeed, the wait before it. format: int64 type: integer status: description: The HTTP status code. format: int64 type: integer title: description: The HTTP status phrase. type: string type: description: A URI naming the problem type, derived from the code. type: string required: - type - title - status - code - request_id type: object TableRow: additionalProperties: false properties: row_key: description: >- The row's identity in its table, opaque and stable: the order pages follow. type: string source_columns: additionalProperties: type: string description: >- Every registered column of the row as text, keyed `.` (`AFW_COMPANY.COCODE`). A NULL value is absent. A direct identifier is served only on a read narrowed to one owner. type: object required: - row_key - source_columns type: object FacetValue: additionalProperties: false properties: count: type: integer format: int64 label: type: string parent: type: string value: type: string required: - value - count type: object Page: additionalProperties: false properties: cursor: description: The cursor that produced this page; null for the first page. type: - string - 'null' limit: description: >- The page size the platform applied, after any coercion (see warnings). format: int64 type: integer next: description: The cursor of the following page; null at the end of the collection. type: - string - 'null' offset: description: >- The rows skipped before this page, echoed only when the request sent offset (a register's page jump). format: int64 type: integer prev: description: The cursor of the preceding page; null on the first page. type: - string - 'null' required: - cursor - next - prev - limit type: object Source: additionalProperties: false properties: actor: $ref: '#/components/schemas/Actor' connection: description: >- The id of the connection that answered; empty when the read had no connection. type: string elapsed_ms: description: A live source's call time for this read. format: int64 type: integer family: description: The registry family that answered. type: string freshness: description: fresh, cached, stale, live or stale_after_write. type: string id: description: >- The registry source id (warehouse, ams360_ems, ...), empty when absent. type: string kind: description: >- The kind of source that answered: the warehouse, the customer's system of record (whichever vendor; the vendor is in id), the platform's own store, or absent when no source serves the family. enum: - warehouse - system - store - absent type: string origin: description: Which input decided the source. enum: - default - connection - seat type: string reason: $ref: '#/components/schemas/SourceReason' description: Why the family is absent, when kind is absent. snapshot_at: description: >- The instant the rows were read at: the warehouse pin, or the live call's time. format: date-time type: - string - 'null' snapshot_id: description: The warehouse snapshot the rows came from, when one names them. type: string stale_since: description: When the snapshot stopped being current, for a stale read. format: date-time type: string subject: $ref: '#/components/schemas/Subject' system: deprecated: true description: 'Deprecated: read kind instead. The system behind the source.' enum: - warehouse - ams360 - store - absent type: string required: - family - kind - connection - system - id - origin - freshness - snapshot_at - subject - actor type: object Total: additionalProperties: false properties: exact: type: boolean value: type: integer format: int64 required: - value - exact type: object Unreachable: additionalProperties: false properties: detail: type: string part: description: The envelope part (a field path or a child family). type: string reason: description: 'Why: no_adapter, not_documented, absent, source_unavailable, ...' type: string ref: description: The vendor reference id of the call that failed, when one did. type: string required: - part - reason type: object Warning: additionalProperties: false properties: code: description: >- UPPER_SNAKE_CASE, one meaning forever (LIMIT_COERCED, FACET_DROPPED, ...). type: string detail: type: string required: - code type: object ProblemError: additionalProperties: false properties: location: description: Where the input was, for example query.limit. type: string message: type: string value: {} required: - message type: object Actor: additionalProperties: false properties: impersonation_kind: enum: - act_as - workos type: string impersonator: description: The operator behind an impersonated session. type: string member: description: The acting member (Nexio-Act-As); empty for a key acting as itself. type: string type: object SourceReason: additionalProperties: false properties: kind: type: string note: type: string ref: type: string required: - kind type: object Subject: additionalProperties: false properties: member: $ref: '#/components/schemas/SubjectMember' description: >- The member whose book was read, when the request read as another member. scope: description: The scope kind the acting seat resolved to (self, office, all, ...). type: string selection: description: >- The subject selection served, as subject= tokens (own, book:, producer:, client_manager:, member:). Empty when none was sent. items: type: string type: - array - 'null' selection_kind: description: >- own, code, client_manager, account, boundary or whole: what the served relation is. type: string selection_source: description: >- request when the caller chose the selection; none when it chose nothing. type: string required: - scope - selection - selection_kind - selection_source type: object SubjectMember: additionalProperties: false properties: display_name: type: string id: type: string scope: type: string required: - id - display_name - scope type: object securitySchemes: BearerAuth: type: http scheme: bearer description: > Send the key as `Authorization: Bearer `. Two kinds of key exist. Organization keys are issued in the portal (Settings, then API keys), each bound to one environment, shaped `nx__<64 hex>`. They carry no capabilities and pass every capability check, with one exception: routes under /records, /actions, /operations, /api/v1/engines/{id}/opportunities, /api/v1/graph and /api/v1/catalog/documents accept an organization key only when its environment is `live`, and refuse any other with 403 `scoped_key_required`. Revocation takes effect within 60 seconds. Scoped keys are issued by Nexio on request, shaped `nxsk_v1_<24 hex key id>_<43 character secret>`. Each is bound to one org, one environment, a set of engines and a set of capabilities. A malformed, unknown or revoked `nxsk_` key fails with 401 and is never retried as an organization key. Revocation takes effect on the next request. A scoped key without a route's capability gets 403 `insufficient_capability`; a scoped key not bound to the engine gets 403 `engine_binding_forbidden`. Key-grantable capabilities: `engines:read`, `runs:write`, `runs:read`, `runs:defensibility:read`, `runs:test`, `catalog:read`, `catalog:documents:read`, `webhooks:manage`, `conversations:use`, `conversations:export`, `records:read`, `records:opportunities:run`, `actions:write`, `actions:read`, `graph:read`, `records:analyze`. Routes that accept organization keys only (every scoped key gets 403 `insufficient_capability`): environment management, engine create, update, configuration and publish, and conversation instance authoring. Each operation description names the capability a scoped key needs. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.