API reference

The Combined REST API exposes 20 public operations across Accounts, Catalogue, Query, Sources, Activity, and Access. The exact contract is generated from the same Zod/oRPC definitions used by the server and is available at platform.trycombined.com/openapi.json.

Start here

1. Read Authentication for credentials and grants.
2. Read Conventions for envelopes, cursors, idempotency, and retries.
3. Use Endpoints for operation-specific parameters, schemas, status codes, and examples.
4. Handle failures according to Errors.

The normal data workflow is GET /v1/accounts, GET /v1/catalog, then POST /v1/sql. Source operators also use Source lifecycle and schema review operations; access administrators use grants; audit consumers use Activity and query receipts.

curl -fsS "$COMBINED_API_URL/v1/catalog?accountId=$COMBINED_ACCOUNT_ID" \
  -H "Authorization: Bearer $COMBINED_TOKEN" \
  -H "Accept: application/json"

Contract guarantees

• Only documented /v1 operations are public API. Browser actions, job routes, Desktop enrollment internals, storage paths, and service-role procedures are not public contracts.
• Authentication never substitutes for Source grants or Account authorization.
• SQL is a bounded read path over logical catalogue relations; physical lake and control-plane storage are not exposed.
• Responses include a correlation ID and are not cacheable.
• Mutations use idempotency and asynchronous operations report acceptance separately from completion.
• Query receipts and Activity retain content-free operational evidence, not returned result rows.

Generated endpoint pages are grouped by resource and regenerated before development and production builds. If copied examples disagree with the live OpenAPI specification, the live specification is authoritative.