List the key catalog
Lists every registered Systemplane key with its kind, tenant scope, runtime class, redaction policy, description, and a detail URL. This discovery surface is opt-in per application and is served before the namespace routes, so /system/-/catalog is a reserved metadata path, not a real namespace. When authentication is enabled, it requires read permission for at least one Systemplane namespace.
Authorizations
A bearer JWT issued by the platform's Access Manager (plugin-auth / lib-auth). Authorization is deny-all by default: the application must be configured with an authorizer, and when authentication is enabled it enforces per-namespace role-based access control on top of a valid, platform-scoped (non-tenant) identity. Machine callers obtain a token via the Access Manager client-credentials flow.
Response
The registered-key catalog.
The catalog of every key the application registers.
The catalog schema version.
"systemplane.catalog.v1"
The application that serves this catalog.
"matcher"
The namespaces the application registers keys in.
One summary per registered key.

