Rules for your endpoints

Opami calls a custom app's endpoints for its actions (operations you import from your own OpenAPI document or enter in a form) and for its calendar. Every call goes through Opami's locked-down executor, under these rules.

Operations

Imported from the app's own OpenAPI 3 document (JSON, at most 512 KiB and 100 operations, local #/components/schemas references only) or entered in a form: name, method, path, input and output schema, description and class. The class follows the method unless x-opami-class names one of read, record_write, outgoing_text or destructive. Writes are stored disabled; a read-only connection test must pass and every write shows a preview before it runs.

Transport

HTTPS on the base URL's registered host only, a public address (private networks and cloud metadata addresses are refused after DNS and after every redirect). Port 443.

Authentication

The credential is stored in a vault, bound to the registered origin and added at call time: api_key as a header (default X-API-Key), bearer as Authorization: Bearer, basic as Authorization: Basic.

Limits

Answers

An answer is untrusted data: parsed, never followed as an instruction, never logged. Return JSON.

Idempotency

Opami sends a write once per approved preview; a write that times out is not retried. Make writes safe to receive twice where you can (for example key them on the Opami request).