Skip to content
Zerker Gateway

Read which surfaces, limits, and posture this gateway has

GET
/v1/capabilities
curl --request GET \
  --url https://example.com/v1/capabilities \
  --header 'Authorization: Bearer <token>'

Reports which route families this deployment mounted, the limits it enforces, and the mode it is running in.

RegisterRoutes mounts whole families conditionally, so a gateway with no credential service answers GET /v1/credentials with 404 — the same status as a mistyped path and as a missing resource. Without this endpoint a client cannot tell those apart, and either renders an affordance that cannot work or invents an explanation for the 404.

Posture reports modes, never values (invariant #9): which kind of store, whether a KMS key was supplied — never the DSN, never the key. Authenticated like every route that is not /healthz or /version: the answer is the same for every caller, but an unauthenticated deployment inventory is a reconnaissance gift.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

This gateway’s capabilities.

Media typeapplication/json

Which surfaces this gateway mounted, the limits it enforces, and its posture.

object
surfaces
required

Which route families are mounted. Agents are unconditional and have no field. A false here is why a route answers 404.

object
credentials
required
boolean
invocations
required
boolean
analytics
required
boolean
proxy
required
boolean
agent_events
required
boolean
settlement
required
boolean
policy
required
boolean
policy_decisions
required
boolean
receipts
required
boolean
reason_enforcement
required

Whether MCP tools/call requires a verified Reason authorization envelope.

boolean
limits
required

The server-side bounds a client must respect, from the same constants the handlers enforce.

object
analytics_max_range_days
required
integer
invocations_max_limit
required
integer
policy_decision_max_limit
required
integer
agent_event_max_range_days
required
integer
transact_max_body_bytes
required
integer format: int64
captured_body_max_bytes
required
integer format: int64
model_header_max_bytes
required
integer
posture
required

How this deployment is running. Modes only — never a DSN, a key, or an address.

object
store
required

memory is the non-durable dev-only store: everything registered is lost on restart.

string
Allowed values: postgres memory
kms_key_configured
required

False when ZERKER_KMS_KEY was unset and an ephemeral key was generated at boot — every credential stored under it stops decrypting at the next restart.

boolean
receipts_enabled
required

Whether a Treeship emitter is attached to this deployment.

boolean
receipt_actor
required

The actor URI receipts are signed as; empty when receipts are off.

string
settlement_orchestration
required

Whether settle-then-forward is wired. A tenant with a facilitator configured still cannot settle without it.

boolean
Example
{
  "posture": {
    "store": "postgres"
  }
}

401

Section titled “401”

Missing or invalid bearer token, or the token’s tenant/user claims are absent. No body.