Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.
Request pipeline
Purpose
Per-route guard requirements. Contracts are illustrative, not frozen (API-and-Request-Pipeline).
Pipeline
Authenticate session, resolve membership, authorise record (role plus assignment), validate version or transition, commit mutation and event. See Authentication-and-Authorization.
Route guards (Proposed)
| Operation | Illustrative route | Required guard |
|---|---|---|
| Company context | GET /v1/me/company | Exactly one active membership |
| Draft and publish | POST /v1/opportunities, PATCH /v1/opportunities/{id}, POST /v1/opportunities/{id}/publish | Schema validation, owning-company role or assignment, expected version, approval binding |
| Discovery | GET /v1/opportunities, GET /v1/recommendations | Audience and active-status filtering before search, ranking, snippets, counts, pagination |
| Question or interest | POST /v1/opportunities/{id}/questions, /expressions | Authorised opportunity, no self-interest, meaningful fields, approved contributor submission, version reference, idempotency key |
| Accept discussion | POST /v1/expressions/{id}/accept | Owner-side authority, current response state, one discussion, state and event committed together |
| Messages and actions | GET/POST /v1/conversations/{id}/messages, POST /{id}/actions | Participant-company access plus role and assignment; eligible assignee; safe due-date transitions |
| Team and administration | invitation, membership, recovery endpoints | Company admin versus DG authority; DG MFA; one-company restriction; audit |
| Health | GET /v1/health | None; returns status only, no version, host or environment |
Failure behaviour
Consistent denial that never reveals existence; actionable validation; safe stale-write conflict; rate-limited abuse; retryable requests. Every enabled route is listed in the route inventory used by the isolation harness (Company-Isolation).
Open decisions
Blocked by Q02 (role matrix), Q08 (denial shape), Q09 (session and rate policy).
Change history
| Date | Change |
|---|---|
| 2026-10-20 | Created (bootstrap Phase 2) |