API and Audit Registries

This page maps the public reference docs to HELM's OpenAPI, endpoint registry, config registry, contract registry, schema-version guide, and API lifecycle material.

The active backend source for these registries is apps/controlplane. HELM Console has one browser API backend and one route registry.

Audience

Use this page if you build against HELM APIs, review control-plane contracts, or audit whether route, config, and schema changes are tracked.

Outcome

You should know which file owns each reference surface and which public export or docs page to use for implementation.

Registry Flow

flowchart TD
    subgraph Ingestion["1. Ingestion & Context Plane"]
        router["Control-plane router"]
        endpoints["Endpoint registry"]
        config["Config sources"]
        configRegistry["Config registry"]
        contractRegistry["Contract registry"]
        schemas["Schema versions"]
        schemaGuide["Schema version guide"]
        openapi["openapi"]
        docs["Public reference docs"]
    end

    subgraph Execution["3. Execution & Verdict Plane"]
        contracts["Runtime contracts"]
    end

    %% Operational Flow Edges
    router --> endpoints
    config --> configRegistry
    contracts --> contractRegistry
    schemas --> schemaGuide
    openapi --> docs
    configRegistry --> docs
    contractRegistry --> docs
    schemaGuide --> docs

    %% Premium Styling Rules
    style contracts fill:#3182ce,stroke:#2b6cb0,stroke-width:2px,color:#fff

flowchart TD
    subgraph Ingestion["1. Ingestion & Context Plane"]
        router["Control-plane router"]
        endpoints["Endpoint registry"]
        config["Config sources"]
        configRegistry["Config registry"]
        contractRegistry["Contract registry"]
        schemas["Schema versions"]
        schemaGuide["Schema version guide"]
        openapi["openapi"]
        docs["Public reference docs"]
    end

    subgraph Execution["3. Execution & Verdict Plane"]
        contracts["Runtime contracts"]
    end

    %% Operational Flow Edges
    router --> endpoints
    config --> configRegistry
    contracts --> contractRegistry
    schemas --> schemaGuide
    openapi --> docs
    configRegistry --> docs
    contractRegistry --> docs
    schemaGuide --> docs

    %% Premium Styling Rules
    style contracts fill:#3182ce,stroke:#2b6cb0,stroke-width:2px,color:#fff

Reference Surfaces

Active Boundary

• Treat apps/controlplane/internal/http/router.go, the Console route registry, and api/openapi/helm.openapi.yaml as the canonical API inventory.
• Do not add a second browser API backend, standalone proof service, or duplicate route registry.

Source Truth

• docs/11_API_REFERENCE.md
• api/openapi/helm.openapi.yaml (source)
• docs/api/openapi.yaml (generated public mirror)
• docs/api/API_LIFECYCLE.md
• docs/audit/API_ENDPOINTS.md
• docs/audit/CONFIG_REGISTRY.md
• docs/audit/CONTRACT_REGISTRY.md
• docs/audit/SCHEMA_VERSION_GUIDE.md

Troubleshooting

Operational Readiness

Use this page as the public operating layer for API and Audit Registries. The source of truth is helm-ai-enterprise/docs/public/reference/api-and-audit-registries.md; if this page and the implementation disagree, update the source-backed doc and rerun the validation command before publishing.

Before relying on this surface, confirm three things: the source path above still exists, the referenced commands or contracts are still present in the owning repo, and the docs-platform export surfaces still show this page in search, Markdown, llms-full.txt, and MCP without exposing protected routes.

Validation command: corepack pnpm run docs:coverage && corepack pnpm run docs:truth. For website parity, also run npm run exports:boundary and npm run thin-pages:check from docs-platform.

Expected Output

A reader should leave with a concrete next action, the source file or contract to inspect, the command that proves the claim, and a clear boundary for what is public versus protected. For reference pages, the expected output is a correctly scoped request, schema, command, or diagnostic path. For operations pages, the expected output is a reproducible readiness or failure signal that can be attached to an evaluation or support thread.

Failure Modes

If the validation command fails, do not patch this page in isolation. First identify whether the drift is in code, generated contracts, source-owner docs, or the docs manifest. If the public page needs a protected deep link, describe the protected document by name instead of exposing its route. Commercial operator details, tenant data, key ceremonies, and deployment-sensitive internals stay in protected customer or staff docs; this public page only exposes the safe developer contract.