API & integrations
Tally's generated OpenAPI document is the source of truth for product route schemas. The Tally executable adds its authentication and authorization boundary around those routes.
Use the maintained contract#
Start with specs/openapi.json and the JSON schemas. Product routes use /api/v1/tally. Review the contract from the same release as the running binary; alpha APIs may change.
The generated product schema does not describe every Tally account route. The Tally authentication implementation and its integration tests define registration, sign-in, invitations, sessions, password recovery, and role checks.
Authentication and browser requests#
The Tally console signs in through POST /api/v1/auth/login and verifies its session with GET /api/v1/auth/me. A successful login sets the secure HttpOnly tally_session cookie. Protected product routes require a valid session, and administrative operations require the administrator role.
Browser clients should use the same HTTPS origin as the console and include credentials. Mutations are subject to origin checks. Do not expose the internal upgrade listener or assume that a route's presence in the product schema bypasses Tally permissions.
Check readiness#
Readiness and liveness routes are available without a user session. For a default local installation, trust its generated certificate explicitly:
curl --fail \
--cacert "$HOME/.local/share/godel-tally/tls/tally.crt" \
https://localhost:8443/api/v1/tally/health/readyUse your configured port and certificate path. A readiness response checks application availability; it does not certify every vendor connector or all inventory coverage.
Develop a connector#
Use the existing sanitized connector fixtures, normalization contracts, and Postman simulations to test pagination, retries, failures, and redaction. Keep source payloads and secrets out of durable observations.
Managed-agent and security-log simulations exercise the real collectors against local contract fixtures. They establish compatibility with those fixtures, not access to a customer's live vendor tenant. Validate account permissions and actual source availability separately.