For AI agents: the complete documentation index is available at https://payhon.github.io/AppKernia/en-US/llms.txt, the full documentation bundle is available at https://payhon.github.io/AppKernia/en-US/llms-full.txt, and this page is available as Markdown at https://payhon.github.io/AppKernia/en-US/api/index.md.
AppKernia

Server API

AppKernia describes its server contract with OpenAPI 3.1. These pages explain common routes, examples, and security boundaries; server/openapi/openapi.yaml in the current repository remains the final source for fields, enums, status codes, and schemas.

Download the current OpenAPI YAML

Use the Admin online OpenAPI reference

SurfacePrefixClientIdentity boundary
App API/api/v1uni-app x and app usersak-mobile bearer token
Admin API/admin-api/v1React Adminak-admin access token plus secure cookie
Internal API/internal/v1Health and internal monitoringDeployment network boundary

Admin and Mobile tokens are not interchangeable. X-AppID selects a public active app; tenant and user scope still come from the verified session.

Authentication flow

Admin and Mobile use separate entry points and audiences. Refresh is a controlled one-time session rotation, not an automatic replay mechanism for arbitrary failed requests.

Admin and Mobile have separate entry points and audiences. A client must not blindly replay a failed write; automatic retry is allowed only when the endpoint has explicit idempotency semantics described in conventions.

API families

FamilyTypical resourcesStart here
Public AppConfig, regions, dictionaries, version, legalMobile resources
Mobile identitySign-in, refresh, sign-out, recovery, registrationMobile authentication
Mobile userProfile, preferences, notifications, sessionsMobile resources
Admin identitySign-in, refresh, MFA, sessionsAdmin authentication
Admin businessUsers, org, access, content, files, jobsAdmin core resources
InternalLive, ready, metricsDeployment network only
Accept: application/json
Accept-Language: en-US
X-Request-ID: 019…
X-AppID: 01900000-0000-7000-8000-000000000001
Authorization: Bearer YOUR_ACCESS_TOKEN

First request without authentication

After the local API starts, request public config with the development App ID from the repository manifest:

curl --fail-with-body \
  -H 'Accept: application/json' \
  -H 'Accept-Language: en-US' \
  -H 'X-AppID: 00000000-0000-4000-8000-000000000001' \
  http://127.0.0.1:8080/api/v1/public/config

A successful response has a 2xx status, a stable code, matching Content-Language, and no server secret.

Integration checklist

  • Generate clients from OpenAPI and verify the schema hash in CI.
  • Mobile calls only /api/v1; Admin calls only /admin-api/v1.
  • Send Accept-Language on every request; preserve Request IDs without logging tokens.
  • Cover denied paths with backend authorization tests—menus and buttons are not evidence.
  • Define idempotency keys, retry limits, and audit behavior for writes.
  • Validate SQL isolation with integration data from two tenants.

Start with the online OpenAPI reference and System menu, conventions, Mobile authentication, Mobile resources, Admin authentication, or Admin core resources.

Version statusThe current API is 0.1.0 and the project has no stable release yet. Generate clients from OpenAPI and verify the schema hash instead of maintaining hand-written DTOs from this page.