> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # List the key catalog > Lists every registered Systemplane key with its kind, tenant scope, runtime class, redaction policy, description, and a detail URL. This discovery surface is opt-in per application and is served before the namespace routes, so `/system/-/catalog` is a reserved metadata path, not a real namespace. When authentication is enabled, it requires read permission for at least one Systemplane namespace. ## OpenAPI ````yaml en/openapi/v3-current/systemplane.yaml get /system/-/catalog openapi: 3.1.0 info: title: Lerian Systemplane Admin API version: v1.0.0 contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio license: name: Lerian Studio General License description: >- The Systemplane admin API is the shared runtime-configuration control plane that Lerian applications expose so you can inspect and change operational settings on a running service — without a restart. In regulated financial environments, taking a service down to apply a configuration change is both a compliance risk and an operational disruption; Systemplane lets you adjust the values a service safely supports while it keeps serving traffic. This surface is not a standalone service. Each application mounts the same route set onto its own HTTP host and port under an application-specific path prefix — there is no dedicated Systemplane host or port. The canonical prefix documented here is `/system`, but it varies per application (for example, Lender mounts it under `/api/v1/systemplane` and the SFN rails under `/v1/system`). Substitute the host, port, and prefix of the application whose configuration you are managing. Because the routes are registered programmatically rather than emitted by a code generator, they do not appear in each product's generated API reference — this specification documents the surface by hand. Configuration is organized into **namespaces**, each holding flat string-keyed entries. Rails and plugins use three canonical namespaces — `runtime_config` (operational knobs such as rate limits and worker intervals), `tenant_policy` (tenant-scoped policy objects), and `operational_registry` (operational lookup data). Some applications register a single application-named namespace instead. Each entry's value is untyped at the transport layer: every registered key accepts its own JSON scalar, object, or array, validated by that key's server-side validator. Authorization is **deny-all by default**. When authentication is enabled, an application enforces per-namespace role-based access control: reads require the namespace's read permission (`system_runtime_config:read`, `system_tenant_policy:read`, or `system_operational_registry:read`) and writes require the matching write permission (`system_runtime_config:write`, `system_tenant_policy:write`, or `system_operational_registry:write`). The exact permission strings can vary per application. The whole surface is gated by the `SYSTEMPLANE_ENABLED` setting, which is off by default; when it is disabled the application runs in environment-variable-only mode and these routes are not served. An optional catalog surface under the reserved `/-/catalog` path lets you discover which keys an application registers, along with each key's write contract (kind, tenant scope, redaction policy, validation rules, and examples). Errors use a flat `{"code": , "title": "", "message": ""}` envelope. Mutating operations return `204 No Content` on success. servers: - url: https://{host} description: >- The Systemplane admin API is served by each Lerian application on its own host and port under an application-specific prefix (default `/system`). Substitute the host of the application whose runtime configuration you are managing. variables: host: default: your-lerian-app.example.com description: >- The host (and port) of the application that mounts the Systemplane admin API. security: - BearerAuth: [] tags: - name: Entries description: >- List, read, write, and delete the runtime-managed configuration entries in a namespace. - name: Catalog description: >- Discover the keys an application registers and each key's expected write contract. Opt-in per application. paths: /system/-/catalog: get: tags: - Catalog summary: List the key catalog description: >- Lists every registered Systemplane key with its kind, tenant scope, runtime class, redaction policy, description, and a detail URL. This discovery surface is opt-in per application and is served before the namespace routes, so `/system/-/catalog` is a reserved metadata path, not a real namespace. When authentication is enabled, it requires read permission for at least one Systemplane namespace. operationId: listSystemplaneCatalog responses: '200': description: The registered-key catalog. content: application/json: schema: $ref: '#/components/schemas/CatalogListResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '500': $ref: '#/components/responses/InternalError' '503': $ref: '#/components/responses/ServiceUnavailable' security: - BearerAuth: [] components: schemas: CatalogListResponse: type: object additionalProperties: false description: The catalog of every key the application registers. properties: catalogVersion: type: string description: The catalog schema version. examples: - systemplane.catalog.v1 service: type: string description: The application that serves this catalog. examples: - matcher namespaces: type: array description: The namespaces the application registers keys in. items: type: string examples: - - runtime_config - tenant_policy keys: type: array description: One summary per registered key. items: $ref: '#/components/schemas/CatalogKeySummary' required: - catalogVersion - service - namespaces - keys CatalogKeySummary: type: object additionalProperties: false description: A single key's summary in the catalog listing. properties: namespace: type: string description: The namespace the key belongs to. examples: - tenant_policy key: type: string description: The registered key. examples: - tenancy.ispb_organization_bindings kind: type: string description: >- The value kind the key accepts (for example, `object`, `string`, `int`, `bool`, `array`). examples: - object tenantScoped: type: boolean description: Whether the key's value is resolved per tenant. examples: - false runtimeClass: type: string description: >- When a change takes effect — for example, `read_live` (next request) or a bootstrap class that requires a restart. examples: - read_live redaction: type: string description: >- The redaction policy applied to the value on read (for example, `none`, `mask`). examples: - mask hasValidator: type: boolean description: Whether the key has a server-side write validator. examples: - true description: type: string description: A human-readable description of the key. examples: - Tenant-scoped JSON object keyed by ISPB detailUrl: type: string description: The relative URL of the key's write-contract detail. examples: - /system/-/catalog/tenant_policy/tenancy.ispb_organization_bindings required: - namespace - key - kind - tenantScoped - runtimeClass - redaction - hasValidator - description - detailUrl ErrorResponse: type: object additionalProperties: false description: >- The flat error envelope returned across the Systemplane admin surface. It carries a machine-readable HTTP status code, a short title, and a human-readable message; it never returns secret material. properties: code: type: integer description: The HTTP status code. examples: - 403 title: type: string description: A short, machine-readable title for the error class. examples: - forbidden message: type: string description: A human-readable description of what went wrong. examples: - 'systemplane admin: insufficient permissions: permission denied' required: - code - title - message responses: Unauthorized: description: >- Authentication failed, or there is no trusted platform identity on the request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- The authorizer denied the request — the identity lacks the namespace permission required for this action, or the surface is deny-all because no authorizer is configured. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: An internal fault. Detail is logged, not returned. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServiceUnavailable: description: >- The Systemplane store is not started or has been closed — the application is not currently able to serve the request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- A bearer JWT issued by the platform's Access Manager (plugin-auth / lib-auth). Authorization is deny-all by default: the application must be configured with an authorizer, and when authentication is enabled it enforces per-namespace role-based access control on top of a valid, platform-scoped (non-tenant) identity. Machine callers obtain a token via the Access Manager client-credentials flow. ````