> ## Documentation Index > Fetch the complete documentation index at: https://docs.vainona.ai/llms.txt > Use this file to discover all available pages before exploring further. # Change the published groups, bands or keys > A change rewrites every tenant document at the next run, which re-judges each of them, so without `confirm: true` it returns that estimate and changes nothing. With it, the change applies from the next run and runs unattended. ## OpenAPI ````yaml /api-reference/openapi.yaml patch /namespaces/{ns}/tenant_summary openapi: 3.1.0 info: title: Vainona API version: '1' license: name: Proprietary identifier: LicenseRef-Proprietary description: | The `/v1` contract. It is locked: changes within `/v1` are additive only, and anything breaking is `/v2`. - **Base URL.** `https://api.vainona.ai/v1`. - **Evolution.** Response objects may gain fields and enums may gain values. Clients must ignore what they do not know. Request objects reject unknown fields. - **Path segments.** Namespace names (`{ns}`) and document ids (`{id}`) may contain `/`. Send it percent-encoded as `%2F`, so that `acme/prod/tenant_123` is `acme%2Fprod%2Ftenant_123`. - **Templates.** The judgment routes also take a namespace prefix ending in `/*`, such as `acme%2Fprod%2F*`. A judgment created there is a template: every namespace under the prefix inherits it, including ones created later. The most specific matching prefix wins. - **Thresholds are settings.** Named thresholds belong to the judgment, not to a version. They are evaluated at read time against the raw fields, so a change applies at once to every answer, with no recompute and no new version. - **Entity judgments.** A judgment can read the documents that point at the judged one, through `context.related`, and apply only to documents matching `applies_to`. Its answers carry a `watermark`, and creating one that runs `on_change` returns a replay estimate of its monthly cost until you confirm. - **Referenced documents.** A relation can also read the one document the judged document points at, through `join: {theirs: "id", mine: "attributes."}`. A change to what the relation renders of that document re-judges the judged documents that point at it and are inside `freshness.fanout.scope`: a fan-out. - **Relations.** A relation can read plain judgments' answers (banded or cut, never summed), or be a blocking relation over the documents that share a key, which a `choice` can choose among with `options.from`. A recipe can read the document as the judgment last saw it (`context.previous`). A judgment that can fan out confirms its rolling limits once, at create; past them, work is deferred, reads `stale` with an event, and catches up on its own. Nothing waits for a confirm at runtime. Groups keep aggregates per key value for reporting. - **Idempotency.** Every write operation is idempotent by construction: a retried append adds nothing while its values are still in the array, and a retried upsert or patch sets the same content again. `Idempotency-Key` is accepted on the mutating routes that declare it and, while the service still has the original response, returns it verbatim. Marking or unmarking a non-production prefix, and starting this month's recipe-tuning run, change nothing when repeated, so they take none. - **Errors.** Every error is the `Error` envelope; the HTTP status follows the code (see each response). - **Rate limits.** Every response carries `X-RateLimit-Limit` and `X-RateLimit-Remaining`; a `rate_limited` response adds `Retry-After`, except a daily allowance that is used up, which says when it renews in `details.resets_at` instead. - **Usage.** Every response that bills carries `usage`. Judging is billed per judgment, engine-neutral, by size class: one judgment answered counts by the tokens of its compiled context and its question together, 1 if standard (up to 2,000 tokens), 4 if large (up to 8,000) and 16 if extra-large (up to 32,000, the engine maximum). No response ever carries an engine's price. servers: - url: https://api.vainona.ai/v1 security: - apiKey: [] tags: - name: Namespaces description: Namespaces, their settings and cache warming. - name: Documents description: Writes, point reads and queries. - name: Judgments description: >- Judgment definitions, versions, settings, activation, backfill and template detach. - name: Outcomes and calibration description: | Post what actually happened to judged documents, and read how well answers match it: the calibration report, calibrated answers and threshold recommendations. See [calibration](/concepts/calibration). - name: Groups description: > Groups keep aggregates per value of a key attribute, a group-by you declare for reporting; a template's tenant summary publishes each tenant's groups, banded, as a document the platform can judge. - name: Jobs description: >- Backfill, shadow, periodic, deletion, reference index, evaluation export, resync, group build, discovery and simulation jobs. - name: Engines description: The engine registry. - name: Organization description: | Settings of the whole organization: prefixes marked non-production, which the tenant fee and template calibration pools leave out. - name: Subscriptions description: | Saved queries that send an event when a document starts or stops matching: the query's filter grammar, on a namespace or a template prefix, with the fields each event carries. - name: Webhooks description: | Webhook endpoints, the events feed, the delivery log, redelivery and recovery. Every event type and its body is under `webhooks`. Events are delivered at least once, signed as Standard Webhooks, and kept for 30 days. Webhooks are on every plan, and deliveries are not billed; plans set how many endpoints an organization has. paths: /namespaces/{ns}/tenant_summary: parameters: - $ref: '#/components/parameters/Template' patch: tags: - Groups summary: Change the published groups, bands or keys description: | A change rewrites every tenant document at the next run, which re-judges each of them, so without `confirm: true` it returns that estimate and changes nothing. With it, the change applies from the next run and runs unattended. operationId: updateTenantSummary parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateTenantSummaryRequest' responses: '200': description: >- The tenant summary with the change, or the estimate when it needs `confirm`. headers: X-RateLimit-Limit: $ref: '#/components/headers/RateLimitLimit' X-RateLimit-Remaining: $ref: '#/components/headers/RateLimitRemaining' content: application/json: schema: oneOf: - $ref: '#/components/schemas/TenantSummary' - $ref: '#/components/schemas/DownstreamEstimate' '400': $ref: '#/components/responses/InvalidRequest' '401': $ref: '#/components/responses/Unauthorized' '402': $ref: '#/components/responses/BudgetExceeded' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '413': $ref: '#/components/responses/TooLarge' '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/Internal' components: parameters: Template: name: ns in: path required: true description: >- A template prefix ending in `/*`, with every `/` sent as `%2F`, such as `acme%2Fprod%2F*`. schema: $ref: '#/components/schemas/TemplateName' IdempotencyKey: name: Idempotency-Key in: header description: >- Returns the original response verbatim while the service still has it. Correctness never depends on it. schema: type: string minLength: 1 schemas: UpdateTenantSummaryRequest: type: object description: >- At least one of `groups`, `bands` and `keys`, each replacing the setting whole. additionalProperties: false minProperties: 1 properties: groups: type: array minItems: 1 maxItems: 8 uniqueItems: true items: $ref: '#/components/schemas/Name' bands: $ref: '#/components/schemas/TenantSummaryBands' keys: $ref: '#/components/schemas/TenantSummaryKeys' confirm: type: boolean default: false description: >- Required, because the change re-judges every tenant document; without it, the response is the estimate. TenantSummary: type: object description: A template's tenant summary and a page of its tenants. required: - template - groups - bands - keys - created_at - warnings - tenants - next_cursor properties: template: $ref: '#/components/schemas/TemplateName' groups: type: array items: $ref: '#/components/schemas/Name' bands: $ref: '#/components/schemas/TenantSummaryBands' keys: $ref: '#/components/schemas/TenantSummaryKeys' created_at: $ref: '#/components/schemas/Timestamp' warnings: type: array description: >- `tenant_summary_failed`: the template's namespace refused the last run's writes, such as over its limits with `on_exceeded: reject`; the events feed has `namespace.tenant_summary_failed`. items: type: string enum: - tenant_summary_failed last_run_at: description: When the last run finished; null before the first. oneOf: - $ref: '#/components/schemas/Timestamp' - type: 'null' tenants: type: array items: $ref: '#/components/schemas/TenantSummaryTenant' next_cursor: type: - string - 'null' DownstreamEstimate: type: object description: | A change that moves what other judgments read, sent without `confirm`: a threshold readers' relations name, or a tenant summary's groups or bands. Nothing changed. Send it again with `confirm: true`. required: - downstream not: description: >- An applied change is `JudgmentSettingsApplied`, even with `downstream`. required: - judgment properties: downstream: type: array items: $ref: '#/components/schemas/DownstreamLine' TemplateName: type: string description: >- A template prefix, a namespace path ending in `/*`, such as `acme/prod/*`. Up to 256 bytes. pattern: ^[A-Za-z0-9._:/-]+/\*$ minLength: 3 maxLength: 256 Name: type: string description: >- A judgment, attribute or threshold name. Names are path segments in field references, so they never contain `.`. pattern: ^[A-Za-z0-9_-]+$ minLength: 1 maxLength: 128 TenantSummaryBands: type: object description: | Bands for published aggregates, keyed `.` as a judgment names them, such as `abuse_by_day.count` or `by_plan.avg(state.mrr)`. A tenant document shows each as its band's label only; the value itself is never published. An aggregate without bands does not appear. minProperties: 1 propertyNames: type: string pattern: >- ^[A-Za-z0-9_-]+\.(count|count_where|(sum|avg|min|max)\((state|attributes)(\.[^.()]+)+\))$ additionalProperties: type: object additionalProperties: false required: - bands - labels properties: bands: type: array minItems: 1 maxItems: 9 items: type: number labels: type: array minItems: 2 maxItems: 10 items: type: string minLength: 1 maxLength: 64 TenantSummaryKeys: type: object description: | Key values a group publishes one by one, by group, such as `{"by_plan": ["free", "pro", "team"]}`. A key value comes from the tenant's attributes, so a tenant document names only the key values listed here, under the group's `keys`. Every group publishes its labels over all its key values together as `all`, listed or not. propertyNames: $ref: '#/components/schemas/Name' additionalProperties: type: array minItems: 1 maxItems: 1000 uniqueItems: true items: type: string minLength: 1 Timestamp: type: string format: date-time description: RFC 3339, UTC. TenantSummaryTenant: type: object required: - namespace - status - published_at - source_as_of properties: namespace: $ref: '#/components/schemas/NamespaceName' status: type: string description: >- `published`: the last run wrote its document. `unchanged`: its bands had not moved, so nothing was written. `skipped`: see `reason`. `pending`: no run has reached it yet. enum: - published - unchanged - skipped - pending reason: type: string description: >- Why it was skipped. `deleting` (its namespace is being deleted), `new_life` (its namespace was re-created since the run read it), or `no_groups` (it has none of the groups yet). enum: - deleting - new_life - no_groups published_at: description: When its document was last written; null before the first. oneOf: - $ref: '#/components/schemas/Timestamp' - type: 'null' source_as_of: description: >- The namespace position its published bands were exact at; null before the first. oneOf: - $ref: '#/components/schemas/Revision' - type: 'null' DownstreamLine: type: object description: > One reader's cost of a change to a judgment whose answers its relations read: the re-judgments the change would cause a month (for a one-off such as a backfill, in the month it runs), counted from the answer history's band and cut flips over the last 30 days, priced by the reader's size class at your tiers. required: - judgment - judgments_per_month - cost_usd properties: judgment: $ref: '#/components/schemas/Name' description: The reader, a judgment whose relation reads this one's answers. judgments_per_month: type: integer format: int64 minimum: 0 description: >- Evaluations of the reader the change would cause a month. It is exact except for a child that moved between parents in the window, which the history does not record. cost_usd: type: number minimum: 0 description: >- Those evaluations at the reader's size class and your organization's tiers, in US dollars. Error: type: object required: - error properties: error: type: object required: - code - message properties: code: $ref: '#/components/schemas/ErrorCode' message: type: string details: type: object description: >- Code-specific detail, such as the scan estimate on a refused query. Every `internal` error has `request_id`. properties: suggested_context: description: >- On a create without a context recipe, the recipe suggested from the namespace's documents, or null when there are none. oneOf: - $ref: '#/components/schemas/SuggestedContext' - type: 'null' NamespaceName: type: string description: >- Up to 256 bytes. `/` separates levels of the hierarchy, as in `acme/prod/tenant_123`. pattern: ^[A-Za-z0-9._:/-]+$ minLength: 1 maxLength: 256 Revision: type: integer format: int64 minimum: 0 ErrorCode: type: string description: | HTTP status by code: `invalid_request` 400, `unauthorized` 401, `budget_exceeded` 402, `plan_required` 402, `forbidden` 403, `not_found` 404, `conflict` 409, `too_large` 413, `engine_version_unavailable` 422, `insufficient_labels` 422, `rate_limited` 429, `internal` 500, `engine_unavailable` 503, `unavailable` 503. enum: - invalid_request - unauthorized - forbidden - not_found - conflict - too_large - rate_limited - budget_exceeded - plan_required - engine_unavailable - engine_version_unavailable - unavailable - insufficient_labels - internal SuggestedContext: type: object description: | The recipe suggested for a create without `context`, in the refusal's `details.suggested_context`. From a sample of the documents the definition applies to: it keeps short text, numbers, booleans and small attributes, and leaves out ids, timestamps, links, binary-looking and very long values, and rarely present fields; `excluded` says why for each. `max_tokens` is set to keep the context in the standard size class, at most 2,000. The same documents always give the same recipe. required: - recipe - cost_per_answer - whole_state_cost_per_answer - sampled_documents - excluded properties: recipe: $ref: '#/components/schemas/ContextRecipe' cost_per_answer: type: - number - 'null' minimum: 0 description: >- Mean judgments per answer, counted by size class, over the sample with this recipe and the definition's question. The suggested `max_tokens` is at most 2,000, the standard ceiling, which keeps the context standard; the question counts too, so a long one can make an answer large. whole_state_cost_per_answer: type: - number - 'null' minimum: 0 description: The same with the whole `state`. sampled_documents: type: integer minimum: 1 excluded: type: array description: >- Each path left out, and why, so you can put back what the question needs. items: type: object required: - path - reason properties: path: type: string reason: type: string enum: - id - timestamp - url - binary - long - rare - too_many ContextRecipe: type: object description: | What the engine sees. A create without it is refused with a suggested recipe, unless `use_context` asks for the suggestion or the whole `state`; a version with no recipe sends the whole `state`, subject to the engine limit. additionalProperties: false properties: fields: type: array description: Paths included verbatim, in order. items: type: string pattern: ^(state|attributes)(\.[^.]+)+$ last_n: type: object description: Per array path, keep the last n elements. additionalProperties: type: integer minimum: 1 window: type: object description: >- Per array path whose elements have a timestamp field `at`, keep elements within the window. additionalProperties: $ref: '#/components/schemas/Duration' max_tokens: type: integer minimum: 1 description: Hard cap; the compiler truncates from the end of the last field. related: type: object description: > Up to 4 relations, by name: documents in the same namespace that point at the judged one, or the one document it points at. Each renders as a `related.` entry after `fields`, and a write that changes what it renders makes the judged document's answer `pending` until it is judged again (for a referenced document, only inside the re-judge scope; outside it, the answer is `stale` with `stale_reason` `referenced_changed`). minProperties: 1 maxProperties: 4 propertyNames: $ref: '#/components/schemas/Name' additionalProperties: $ref: '#/components/schemas/Relation' previous: $ref: '#/components/schemas/PreviousRecipe' Duration: type: string description: A whole number and a unit (`s`, `m`, `h` or `d`), such as `7d` or `1h`. pattern: ^[1-9][0-9]*[smhd]$ Relation: type: object description: | Documents that point at the judged document. They are ordered newest `created_at` first: `window` keeps those created within the window, then `last_n` keeps the newest n. At least one of `last_n` and `window` is required, and at least one of `fields` and `aggregate`. A relation reads at most the newest 1,000 documents. With `join: {theirs: "id", mine: "attributes."}` the relation reads the one document the judged document points at, its referenced document, and takes neither `last_n` nor `window`. With `join: {theirs: "attributes.", mine: "attributes."}` it is a blocking relation over the documents that share the judged document's key value. It needs `window`, takes `last_n` up to 254 (up to the `options.from` candidate limit when a `choice` chooses among it with `options.from`), and a change to its block re-judges the block's judged documents. `fields`, `aggregate` and `match` may read plain judgments' answers (`answers..`), banded or cut. additionalProperties: false required: - match - join allOf: - description: A relation renders fields or aggregates. if: not: required: - fields then: required: - aggregate - description: >- A relation over the documents that point at the judged one is bounded by `last_n` or `window`. if: properties: join: type: object properties: mine: const: id then: anyOf: - required: - last_n - required: - window - description: >- A relation that reads the referenced document takes neither `last_n` nor `window`. if: properties: join: type: object properties: theirs: const: id then: not: anyOf: - required: - last_n - required: - window - description: A blocking relation needs `window`, and reads at most 254 documents. if: properties: join: $ref: '#/components/schemas/BlockingJoin' then: required: - window properties: last_n: type: integer maximum: 254 properties: match: $ref: '#/components/schemas/RelationMatch' description: Which documents the relation reads. join: $ref: '#/components/schemas/RelationJoin' last_n: type: integer minimum: 1 maximum: 1000 description: >- Keep the newest n. Not on a relation that reads a referenced document; at most 254 on a blocking relation, and at most the `options.from` candidate limit (see Limits) when `options.from` chooses among it. window: $ref: '#/components/schemas/Duration' description: >- Keep documents created within this long before the later of the judged document's newest write and its newest related creation, at the answer's watermark. An edit to an old related document never moves the window. Not on a relation that reads a referenced document. fields: type: array description: >- Paths to include from each document, rendered under `records`, newest first. An entry may be a `BandedField`, which renders a number as its band. An entry may also be a plain judgment's `answers..value` and `answers..thresholds.` as they are, and its `.p`, `.score` and `.dist.