Identity
schema · identityGoNestUsers and sign-in: password and email flows, sessions, TOTP MFA with recovery codes, Google/Apple/Microsoft OAuth, passkeys, account security, suspension and deletion.
- Routes
/v1/auth/*, OAuth/MCP consent and callbacks, passkey/MFA, /v1/identities/me/*- Jobs
- Credential cleanup and identity lifecycle jobs
- Provides
session, session_authentication, email, profiles, personal_data- Calls
- Account ownership and Authorization capabilities
- Publishes
identity.*: sign-in, sessions, MFA, OAuth/passkey and lifecycle facts- Notes
- Google, Apple and Microsoft OAuth; TOTP/recovery MFA; WebAuthn passkeys. Configure real provider credentials and callback origins per deployment.
Account
schema · accountGoNestWorkspaces and tenancy: accounts, memberships, invitations, ownership transfer, and close, reopen and purge.
- Routes
/v1/accounts…, /v1/accounts/invitations…- Jobs
prune_idempotency_keys, prune_invitations, purge_closed_accounts- Provides
shared_ownerships, personal_data- Calls
- Identity:
email, profiles. Entitlements: account for the member limit - Consumes
identity.deleted- Notes
- Declares its roles and permissions at startup (
account.roles_declared.v1).
Authorization
schema · authzGoNestRoles, role assignments and permission checks inside a workspace. The vocabulary comes from Account's declaration.
- Routes
- None public
- Provides
permission_check, personal_data- Consumes
- Account membership, role and lifecycle events;
identity.deleted - Publishes
authorization.role.*, role_assignment.granted- Notes
- Permission sets are cached. Closed and purged workspaces deny every permission.
Audit
schema · auditGoNestA hash-chained history of significant actions, fed by every producing module, with a read API and an export feed.
- Routes
/v1/accounts/{id}/audit-log, /v1/identities/me/security-activity- Jobs
verify_chain hourly, export_chain every 5 min, prune_entries daily- Provides
personal_data- Calls
- Identity:
profiles. Authorization: permission_check - Consumes
- Events from Identity, Account, Authorization, Billing, Files, Privacy and AI
Usage
schema · usageGoNestMetered consumption: counters with reserve, commit and release, and gauges projected from events. Meters come from a catalog shared by both backends.
- Routes
/v1/accounts/{id}/usage- Jobs
expire_reservations every minute, prune_usage hourly- Provides
reserve, commit, release, personal_data- Calls
- Authorization, Entitlements
- Consumes
- Account membership and lifecycle;
files.storage_changed
Files
schema · filesGoNestFile metadata, folders, trash, retention, purge and storage accounting. Uploads and downloads use presigned S3 URLs; SeaweedFS stands in for S3 locally. AI can request bounded access to available files.
- Routes
/v1/accounts/{id}/files, …/folders, …/trash- Jobs
purge_trash, sweep_purged_accounts, prune_idempotency_keys- Provides
read, describe, personal_data- Calls
- Authorization, Entitlements (the upload feature and storage limit)
- Consumes
account.purged, identity.deleted
Billing
schema · billingGoNestTrials, plans, Stripe checkout and customer portal, subscriptions, invoices, seat synchronization, usage reporting, signed webhooks and reconciliation. Provider calls sit behind an adapter.
- Routes
/v1/accounts/{id}/billing/*; local provider simulator is non-production only- Jobs
- Provider reconciliation and stale usage-report recovery
- Publishes
billing.subscription.changed.v1- Consumes
account.purged- Notes
- Stripe is implemented; select a provider and configure credentials and plans for each deployment.
Entitlements
schema · entitlementsGoNestFeatures and numeric limits for a workspace, resolved from its plan projection and the plan catalog.
- Routes
/v1/accounts/{id}/entitlements, /v1/entitlements/plans (public)- Provides
account- Calls
- Authorization
- Consumes
billing.subscription.changed, account.purged- Notes
- Resolutions are cached for 60 seconds. A missing limit is unconfigured, never unlimited.
Notifications
schema · notificationsGoNestDurable in-app inbox and categorized email delivery, with preferences, mutes, unsubscribe, retention, erasure and retry handling. Chat messages create content-free inbox notices for other participants.
- Routes
- Inbox and preference routes under
/v1/accounts/{id} - Jobs
- Leased email delivery and retention cleanup
- Consumes
- Identity, Account, Billing and Chat notification events
- Notes
- Email uses an SMTP adapter; configure and verify the production provider.
Privacy
schema · privacyGoNestPersonal data exports gathered from every module, and an erasure ledger that survives backup restores.
- Routes
/v1/identities/me/exports, …/{id}/download- Jobs
process_exports every 15 s, prune_exports- Calls
- Every
*.personal_data.v1; Identity: session_authentication - Consumes
identity.deleted, account.purged, account.invitee_erased
AI
schema · aiGoNestProvider-neutral, versioned AI tasks with usage billing: document summaries, grounded fact extraction, image description, evidence evaluation, draft responses and a workspace assistant. The assistant supports persistent conversations, selected-file retrieval with citations, workspace tools and optional approved MCP tools. Retrieval supports lexical search and pgvector embeddings.
- Routes
- Workspace task catalog and runs, retrieval, assistant conversations, plus the protected MCP server at
/v1/mcp - Jobs
- Durable run processing, retry/cancel handling, conversation and idempotency cleanup
- Provides
run_access, personal_data- Calls
- Authorization, Entitlements, Files, Usage and Integrations through capabilities
- Notes
- Adapters include fake, OpenAI-compatible and Anthropic. Hosted model availability, quality and price depend on deployment configuration. MCP tool execution requires explicit user confirmation.
Realtime
schema · realtimeGoNestA WebSocket that pushes workspace events, AI run streams, presence and signals to open clients.
- Routes
GET /v1/realtime, subprotocol bento.realtime.v1- Calls
- Identity:
session, profiles. Authorization. AI: run_access - Consumes
- Events from Identity, Account, Audit, Billing, Files, Privacy, AI and Chat
- Notes
- Fans out workspace and per-principal hints across instances over the broadcast bus; clients refetch authorized content.
Integrations
schema · integrationsGoNestWorkspace and personal API keys, signed webhooks, outbound MCP connections and approved tool discovery/calls, plus the inbound MCP OAuth server. Secrets are sealed at rest, scoped, audited and omitted from personal-data exports.
- Routes
/v1/accounts/{id}/api-keys, …/webhooks, …/mcp-connections, /v1/mcp- Provides
- Approved outbound MCP tools to AI through a capability; protected inbound MCP tools to authorized clients
- Notes
- Outbound workspace bearer-token authentication is implemented. OAuth credential consent/refresh for outbound connections is a future expansion.
Chat
schema · chatGoNestWorkspace direct and group conversations, immutable ordered messages, Files attachments, participant read cursors, unread state, and paginated history. Membership is fixed at creation; participants may leave and lose access. Identity erasure anonymizes the sender while preserving shared content.
- Routes
/v1/accounts/{id}/chat/conversations, messages, read cursor and leave- Calls
- Authorization, Account, Identity and Files
- Publishes
- Content-free
chat.message_sent.v1 for realtime hints and inbox notifications - Notes
- Edits and AI participation are outside the v1 baseline.
Operations
schema · operationsGoNestPlatform operations for staff: global maintenance mode and workspace freezes, with versioned state, audit events and scheduled expiry.
- Routes
- Public service status at
/v1/status; staff maintenance controls under /v1/staff/maintenance and /v1/staff/accounts/…/maintenance - Jobs
expire_maintenance every 30 seconds- Provides
operations.maintenance.v1 to backend modules- Consumes
- Account lifecycle and purge events
- Notes
- Staff endpoints require staff authorization and MFA; maintenance pauses writes while reads and provider webhooks continue.