[BasilZafar11]

Summary

Fixes #44

Add explicit OpenAPI summaries and descriptions to four integration entry points: health, ingest campaign open, event/artifact batch upload, and completion. Descriptions explain public health access, conditional bearer auth, redaction/schema requirements, retry/conflict behavior, and that Hosted does not execute customer adapters or open uploaded paths.

Route handlers, models, status codes, and authentication behavior are unchanged.

Type of change

• Docs / community / DX only
• Hosted API / UI (secondary surface)

Checklist

• Read contribution and repository policies
• Linked related issue
• Core unchanged
• Documentation matches implementation
• One concern per PR
• Authorized local checks only

Test plan

• Inspected actual /openapi.json via TestClient: all four summaries/descriptions appear, each states the customer execution boundary, and health explicitly states no bearer token is required.
• uv run --locked pytest tests/integration/test_api_hosted_ingest.py tests/integration/test_api.py -q --tb=short: 66 passed.
• uv run --locked ruff check: passed.
• git diff --check: passed.

Full backend/reliability, CLI smoke, web build, and isolated artifact checks are left to CI for this description-only change. Branch starts at current upstream main 5ae4b0e, matching fork main.

[vercel]

@BasilZafar11 is attempting to deploy a commit to the priyanshu's projects Team on Vercel.

A member of the Team first needs to authorize it.

[CodewithJha]

I checked the new OpenAPI text against the handlers and ran the ingest paths.

• The change is metadata only (summary and description on four routes in app.py), so there is no behavior change.
• The contract statements are accurate. I confirmed schema_version=1 and redaction.applied=true are required, attestation=true plus project_id or local_project_key are required at open, a repeated identical open is idempotent, and conflicting config returns 409. Size limits return 413, a bearer token is needed only when MUTINY_API_TOKEN is set, and /api/health stays public.
• The text keeps the observe-only point in front of API readers: Hosted stores evidence as data, never executes customer adapters and never opens uploaded paths.
• CI is green.

This satisfies #44. Merging.

[CodewithJha]

Merged. Thanks for the contribution.

You handled this well. The four route descriptions state the real contract rather than generic text: required schema_version and redaction.applied, attestation and project identity, idempotency with 409 on conflict, the 413 limits, and when a bearer token is needed. They keep the observe-only boundary visible to anyone reading /docs. It is also a metadata-only change, so the risk is nil.

This closes #44.

If you'd like to continue working on Mutiny, these would be good related areas to look at:

• cli: honor Hosted 429 Retry-After during ingest sync #43: honor Hosted 429 Retry-After during CLI ingest sync. It builds on the ingest contract you just documented.
• docs: document Hosted rate-limit env vars and Retry-After behavior #37: document the Hosted rate-limit env vars and Retry-After behavior.
• db: add project_id column to regressions (+ migration) #19: add a project_id column to regressions, with a migration.

No pressure on any of them.