> ## Documentation Index
> Fetch the complete documentation index at: https://www.composer.id/llms.txt
> Use this file to discover all available pages before exploring further.

# API reference

> The two composerID APIs side by side: the Intent API that publishes a decision reference and the Manuscript API that serves the evidence behind it.

composerID has two APIs and one identifier that joins them. This page says which is which, how each authenticates and how their references are generated. Read it before the endpoint pages.

## The two APIs

|                | Intent API                                                                                                                                                                                          | Manuscript API                                                                                                                      |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| What it is     | composerID's publishing surface: mint an intent, plan, preflight, publish, reconcile                                                                                                                | Deployed's production backend (WorkAuthor): the scored assessments, documents, surveys, workflows and signed PDFs behind a decision |
| Who calls it   | Triage, and any platform that publishes a decision through composerID                                                                                                                               | The programme's MSP and its reporting suites, service to service                                                                    |
| Base URL       | `https://sandbox.composer.id/v1` (the hosted reference sandbox, answering today); `https://api.composer.id/v1` (production, in build); `http://127.0.0.1:8787/v1` when you run the sandbox yourself | `https://deployed.workauthor.com/api/v1`                                                                                            |
| Authentication | OAuth 2.0 client credentials at `POST /v1/oauth/token` for hour-long scoped tokens; personal sandbox keys for a first call, minted by `POST /v1/sandbox/keys`                                       | Per-customer API keys, issued per programme                                                                                         |
| Webhooks       | Outbound events signed with `X-Signature-HMAC-SHA256-{n}` over the raw body; inbound destination deliveries verified the same way                                                                   | Signed deliveries, `X-Signature-HMAC-SHA256-{n}` over the raw body                                                                  |
| Status         | Documented contract, implemented in the reference sandbox and held to it by a conformance pack in CI                                                                                                | In production at Deployed                                                                                                           |

## Which path does data take

A destination system receives only the Intent ID and a valid request. The evidence behind the decision takes a separate path to the people entitled to it.

```mermaid theme={"system"}
flowchart LR
  T["Triage decision"] --> C["composerID Intent API"]
  T --> M["Manuscript API"]
  C -->|"Path 1: valid request + Intent ID"| D["Destination system"]
  M -->|"Path 2: full evidence"| R["MSP and reporting suites"]
  C -.->|"Intent ID in externalId"| M
```

* **Path 1, destinations.** Beeline, SAP Fieldglass, Coupa, ServiceNow and the rest receive the Intent ID and a valid request. No answers, no scores, no timings ever reach a destination. The Intent API carries this path.
* **Path 2, the manuscript.** The MSP needs the full diagnostic evidence for reporting. The Manuscript API and its webhooks serve it, never a destination.

The Intent ID (`itn_...`, up to 64 characters) is written into the manuscript's `externalId` at creation and into the destination record at publish, so one identifier finds both halves in either direction, with no lookup table. [Score and manuscript](/concepts/two-paths) explains the boundary in full.

## How these references are generated

Both references are generated from OpenAPI documents in the repository, so the pages cannot drift from the contract.

* The **Intent API** document (`api-reference/openapi.json`, OpenAPI 3.1.0) is generated from the same registry that drives the destination pages, with every [published JSON Schema](/concepts/schemas) embedded. The reference sandbox implements it exactly, and the conformance pack (`python3 -m service.conformance`) runs the documented claims against any base URL, in CI and on demand.
* The **Manuscript API** document (`api-reference/manuscript/openapi.json`) is the vendor's own, with operation names and summaries added for navigation.

<Info>
  The Intent API is served today by the reference sandbox, hosted at `https://sandbox.composer.id/v1`. The playground on each endpoint page calls it for real, so a request you try here reaches mock destination tenants rather than a live system. The production service behind `api.composer.id` is in build.
</Info>

## Next steps

<Columns cols={3}>
  <Card title="Lifecycle" icon="workflow" href="/guides/lifecycle">
    Mint, plan, preflight, publish and reconcile, one call at a time.
  </Card>

  <Card title="Manuscript API" icon="file-text" href="/api-reference/manuscript/overview">
    Assessments, documents, surveys, workflows and signed webhooks.
  </Card>

  <Card title="Authentication" icon="key-round" href="/authentication">
    Credentials, scopes, token lifetime and errors.
  </Card>
</Columns>