UAIO API

The UAIO (Unified Autonomous IT Operations) gateway at https://api.itechsmart.dev is the platform’s primary REST API: ProofLink ledger access, RAG incident classification, NeMo Guardrails validation, and live compliance scores. Everything on this page was generated from the gateway’s live OpenAPI spec and verified with real requests.

Resource	URL
Base URL	https://api.itechsmart.dev
Interactive Swagger UI	api.itechsmart.dev/docs
ReDoc	api.itechsmart.dev/redoc
Raw OpenAPI 3 spec	api.itechsmart.dev/openapi.json
Authentication	x-api-key header, optional for free tier

Core endpoints

Method	Path	Auth	Description
GET	/v1/health	None	Gateway liveness and status
GET	/v1/status	None	Platform-wide service status (30s cache)
GET	/v1/ledger	Optional	ProofLink ledger entries (paginated)
GET	/v1/receipt/{id}	Optional	Single receipt by ID or hash prefix
POST	/v1/classify	Optional	RAG incident classification + ProofLink receipt
POST	/v1/validate	Optional	NeMo Guardrails action validation
GET	/v1/compliance	Optional	Live compliance scores (NIST CSF, HIPAA, SOC 2)
GET	/v1/compliance/summary	Optional	Compact compliance summary
POST	/v1/keys/generate	Admin key	Issue a new API key (admin tier only)

GET /v1/health

Liveness check. No auth, no parameters.

curl https://api.itechsmart.dev/v1/health

Response (live, 2026-07-01):

{"status":"operational","service":"iTechSmart API Gateway","timestamp":"2026-07-01T23:48:27.286132+00:00"}

GET /v1/ledger

Returns ProofLink ledger entries, newest first. Query parameters: limit and offset.

curl "https://api.itechsmart.dev/v1/ledger?limit=1"

Response (live sample, details truncated):

{
  "total": 77194,
  "limit": 1,
  "offset": 0,
  "ots_attested_count": 0,
  "ots_attestation_policy": "OTS status is reported per receipt when proof metadata is present; otherwise receipts are SHA-256 hash-chained and tamper-evident.",
  "entries": [
    {
      "timestamp": "2026-07-01T23:48:25.616942+00:00",
      "category": "platform_health_check",
      "actor": "system:prometheus",
      "subject": "prometheus",
      "action": "ServiceDown: firing",
      "outcome": "CRITICAL — prometheus alert (firing)",
      "details": { "...": "..." }
    }
  ]
}

GET /v1/receipt/{id}

Fetch one receipt by its receipt ID or any unique hash prefix.

curl https://api.itechsmart.dev/v1/receipt/55d919bf7f1949c1

Returns the full ledger entry (timestamp, category, actor, subject, action, outcome, details). Unknown IDs return {"error": "Receipt not found", "receipt_id": "..."}.

POST /v1/classify

RAG-enhanced incident classification. Every call seals a SHA-256 ProofLink receipt to the public ledger (asynchronously, category api_classification). Request body:

Field	Type	Required	Description
description	string (10–2000 chars)	yes	Incident description to classify
source	string	no	Source system, e.g. servicenow, datadog, pagerduty (default api)

curl -X POST https://api.itechsmart.dev/v1/classify \
  -H "Content-Type: application/json" \
  -d '{"description": "nginx container restarting in a loop after deploy"}'

Response (live sample). classification, rag_context, provider and elapsed_seconds carry the classifier verdict and are null when the classification engine is unavailable; the ProofLink receipt is sealed either way:

{
  "classification": null,
  "rag_context": null,
  "provider": null,
  "elapsed_seconds": null,
  "proof": {
    "receipt_hash": "09c9e9e54972b8dc1516ef3aa8274956f59158261da9a1f3a16a0c30db81e8ea",
    "receipt_id": "09c9e9e54972b8dc",
    "hash_chained": true,
    "ots_attested": false,
    "ots_note": "Low-latency /v1/classify receipts are created with --no-ots; OTS attestation is reported only when proof metadata is present.",
    "verify_url": "https://verify.itechsmart.dev",
    "ots_verify": "https://opentimestamps.org"
  }
}

The sealed ledger entry’s subject is classify-<first 12 chars of receipt_hash> — the Quick Start shows how to find and verify it on the public ledger.

JavaScript (fetch):

const res = await fetch("https://api.itechsmart.dev/v1/classify", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": process.env.ITSK_KEY ?? "" },
  body: JSON.stringify({ description: "nginx container restarting in a loop after deploy" }),
});
const data = await res.json();
console.log(data.proof.receipt_hash);

Python (requests):

import requests

r = requests.post(
    "https://api.itechsmart.dev/v1/classify",
    json={"description": "nginx container restarting in a loop after deploy"},
    headers={"x-api-key": "itsk_partner_YOUR_KEY"},  # optional on free tier
    timeout=60,
)
print(r.json()["proof"]["receipt_hash"])

POST /v1/validate

Runs a proposed remediation action through NeMo Guardrails (input safety, execution bounds, output fact-check, retrieval integrity). Request body:

Field	Type	Required	Description
incident	string	yes	Incident description being remediated
action	object	no	Proposed action; recognised keys include confidence, blast_radius, touches_secrets

curl -X POST https://api.itechsmart.dev/v1/validate \
  -H "Content-Type: application/json" \
  -d '{"incident": "nginx crash-looping", "action": {"type": "restart_container", "confidence": 0.9, "blast_radius": "single-service", "touches_secrets": false}}'

The response is the Guardrails engine’s verdict, passed through verbatim. If the engine cannot be reached the gateway fails closed and returns {"error": "...", "approved": false}.

GET /v1/compliance

Live compliance scores computed from on-platform evidence.

curl https://api.itechsmart.dev/v1/compliance

Response (live sample, SOC 2 control breakdown truncated):

{
  "scores": {
    "nist_csf": {"score": 96, "max": 100, "status": "internal_assessment"},
    "hipaa":    {"score": 100, "max": 100, "status": "hl7_module_verified"},
    "soc2":     {"score": 96, "max": 100, "status": "type_ii_in_progress",
                 "controls_total": 12, "fully_evidenced": 11, "partial": 1, "gaps": 0,
                 "breakdown": [{"id": "CC1.1", "category": "Control Environment", "state": "pass"}, "..."]}
  }
}

POST /v1/keys/generate

Issues a new API key. Requires an admin-tier key in x-api-key; all other tiers receive 403. Body: {"tenant": "acme-corp", "tier": "partner"} (tier: free, partner or enterprise). Returns {"api_key": "itsk_partner_...", "tenant": "acme-corp", "tier": "partner"}.

The full API surface

The gateway’s live OpenAPI spec currently documents 139 operations across 129 paths, including the A2A agent-to-agent endpoints (/api/v1/a2a/*), Shield endpoint-security APIs (/v1/shield/*), device and tenant enrollment (/v1/devices/*, /v1/tenants), the CMDB knowledge graph (/v1/knowledge-graph/cmdb/*), integration health (/v1/integrations/*), and receipt sealing (POST /api/v1/receipts/seal). The endpoints above are the stable, documented core; for everything else use the live, always-current Swagger UI or pull openapi.json directly.