List the surface registry
Every surface this deployment knows about, as descriptors. Not store-scoped:
which surfaces exist is a property of the deployment, not of a merchant. What a
particular store has done about them is GET /stores/{store_id}/surfaces.
/surfacesAuthorizationBearer token (JWT) · headerrequiredJWT issued by the external IdP via the OAuth 2.0 authorization-code flow (Kinde in
production; a simulator in test). The client obtains it and sends it as a Bearer token on
every authenticated call. Sarvex's services verify it — issuer, audience, signature
(IdP JWKS), expiry — and read identity and tenant from its claims. Sarvex does not issue
or revoke these tokens. merchant_id/store_id are read from the verified claims (and the
merchant→store mapping), never from the URL. The operator scope is required for
/operator/*. Operators acting on a specific merchant pass the X-Operate-As header,
which is recorded in the audit log.
Registered surface descriptors.
datasurface_descriptor[]requiredShow propertiesHide properties
surface_descriptorsurface_idstringrequireddisplay_name_keystringrequireddescription_keystringprotocolsurface_protocolrequiredThe wire protocol an agent surface speaks. Data on the descriptor, never a branch in code.
ucpacprequired_connectorsconnector_type[]required_capabilitiesstring[]Canonical UCP capability identifiers only. A free-form value is rejected at registry construction.
prerequisite_checksstring[]Named checks, in the order the merchant sees them. Each resolves to an adapter at registration.
artifactsstring[]Sarvex-generated, surface-scoped artifacts. Generated only for stores enrolling in this surface.
config_schemasurface_config_field[]The merchant-editable configuration this surface takes. The console renders a
form from it with no per-surface code. Empty means free-form (or no) config.
When non-empty, PUT .../config rejects unknown keys and ill-typed values
with a validation error.
Show propertiesHide properties
surface_config_fieldkeystringrequiredtypestringrequiredtext; bool ("true"/"false"); string_list (newline-separated); json
(a JSON document). Values are always strings on the wire.
textboolstring_listjsonlabel_keystringrequiredvue-i18n key.
help_keystringvue-i18n key for help text.
requiredbooleanrequiredAdvisory — a missing required value is a failing prerequisite, not a rejected request.
external_stepssurface_external_step[]Show propertiesHide properties
surface_external_stepstep_idstringrequiredlabel_keystringrequiredvue-i18n key. The descriptor owns identity, the console owns copy.
urlstring<uri>ownerstringrequiredWho the step waits on, so a client renders waiting states without surface-specific knowledge.
merchantsurfaceverification_signalstringNames what proves enrollment succeeded.
auto_enrollbooleanTrue for a surface that enrolls itself when the store reaches active.
direct_agent is the only such surface: it represents the plain fact that
any agent discovering the profile can transact, and exists so that "active
with no distribution partner" is explicit rather than implied.
pagepagerequiredShow propertiesHide properties
cursorstring | nullrequiredhas_morebooleanrequired