Surfaces

The raw OpenAPI documents list several hundred paths with little structure beyond tags. This site assigns every operation to a surface by its path prefix. A surface has one audience and one credential, so once you know which surface you are on you know what every request carries.

SOR surfaces

Surface	Prefix	Audience	Credential
Public API	/api/v1/public	A business's website or headless front end	X-API-Key (the site's key)
Edits API	/api/v1/edits	Assistants and tools making reviewed changes	Console bearer token, or MCP bearer token with X-Internal-Api-Key
Console API	/api/v1/admin, /api/v1/businesses, /api/v1/ai	The Keystone console	Console bearer token
Agent API	/api/v1/agent	Keystone's own agents	X-Internal-Api-Key
Internal API	/api/v1/internal	Other Keystone services	X-Internal-Api-Key
Webhooks and callbacks	/api/v1/webhooks, /api/v1/ads/webhook, /api/v1/voice	GitHub, Entri, Meta, the voice provider	The provider's signature
System	/health, /api/health, /api/v1/sites	Probes and the sites registry	None

Heimdal

Surface	Prefix	Audience	Credential
Auth service	/api/v1/auth, /users, /roles, /permissions, /oauth, /consumer, /internal	Console, websites, MCP clients, services	Credentials on sign-in; bearer tokens after; X-Internal-Api-Key for internal

Groups

Inside a surface, operations are grouped by the resource they manage: the spec's resource tag where FastAPI emitted one (contacts, website_mod, ads_campaigns), otherwise the first path segment after the prefix. Group pages carry every operation in full; surface pages list them one per line.

Why the console surface is so large

The Console API holds everything go.keystone.app does, for every area of the product. Most of it is per-business and scoped by the caller's memberships. Platform-staff endpoints (accounts, platform admins, promos, pricing) sit alongside and refuse non-staff callers.