# QMind Genomics API Base URL: https://genomics-api.qmindlabs.ai OpenAPI: /api/openapi.json Interactive reference: /docs Full machine-readable guide: /llms-full.txt Use Authorization: Bearer . Keep keys in an environment variable or secret manager. Never put keys in URLs, prompts, committed files, or logs. A Math key cannot access this workspace. Roles: REVIEWER can read and work on assigned topics; OWNER can manage Genomics topics, clients, reviews and sync; ADMIN additionally manages existing memberships and worker controls. Scopes restrict a key further: read, write, files:read, files:write, paths:read, keys:manage. Membership and key revocation are rechecked inside writes. All data routes require authentication; documentation is public. A key cannot grant a role its user does not have. Start with GET /api/v1/session then GET /api/v1/tasks?limit=50. IDs are strings (PostgreSQL bigint safe). Task pagination uses the returned next.batch and next.topic as afterBatch and afterTopic. Other list endpoints use before=next. Topic IDs use batch-NNN:topic, e.g. batch-094:4674. Follow pagination to completion; do not assume a single page contains the workspace. Task decision and disposition are effective business state. A verdict from an older campaign returns PENDING with previous_decision and requires_re_review; a timed-out attempt returns TIMED_OUT unless a verified completion supersedes it. GET /tasks and /topics support disposition=TIMED_OUT. GET /assignments returns materialized current-campaign assignments; use history=true to include previous assignments. History is retained. Scientific counts and export item_count are JSON numbers; record IDs remain strings. Reviewer file access covers assigned reports, full revision ZIPs and original source client packages for the assigned campaign. Manual client revision ZIPs, manual publications, salvage evidence and generic internal artifacts require OWNER or ADMIN. Paths and revision feeds apply the same restrictions. Every POST/PUT needs a unique Idempotency-Key of 16–128 ASCII letters, digits or ._:-. Retry the same operation with the same key and identical body. A changed body returns 409. Mutations also check current assignment, campaign and version. Do not suppress conflicts; refetch and review the new state. API-key creation returns its secret exactly once; retrying returns 409, so revoke/recreate if the first response was lost. Report sync: POST /api/v1/sync with {"source":"reports"} to scan changed AWS Batch and Vast result markers. Add sourceKey:"runs/.../result.json" for a specific marker. The response is 202 with jobId; poll GET /api/v1/jobs/{jobId}. Report import atomically queues its baseline measurements and publication. GET /api/v1/operations/imports exposes MEASUREMENTS_PENDING, COMPLETE or NEEDS_ATTENTION. An import is not complete merely because its PDF is visible. Astra and other model reruns: POST /api/v1/sync with {"source":"reruns"}, or add sourceKey:"minos-evals-pass-runs/.../SUMMARY.json". The verifier checks summary, collection, attempt outcomes, model identity, immutable package and full archive checksums. Original report measurements and public-package reruns are separate scientific scopes. 0/10 is a measured 0%, while missing evidence remains UNAVAILABLE with a reason. Never fabricate or copy a model's rate to another model. Topics: POST /api/v1/topics creates a brief/task; POST /api/v1/sync with {"source":"topics"} discovers pipeline briefs. These operations do not launch compute jobs. POST /api/v1/sync with {"source":"measurements"} reconciles missing report measurements. Failed jobs are visible under /api/v1/operations/jobs and /api/v1/operations/issues; POST /api/v1/jobs/{jobId}/retry creates a new attempt chain without deleting history. Scheduled discovery runs every 5 minutes for reports/reruns, 30 minutes for topics; reconciliation every 15 minutes. Schedules only run while workers are explicitly enabled. ZIP revisions: begin a revision, reserve FULL_SUBMISSION or CLIENT_PACKAGE with filename, bytes and SHA-256, then PUT raw application/zip to its artifact URL. Upload only changed deliverables. Download/read-back verification is required before availability. Wait for client publication, then finalize with expectedSelectionRevision from topic details. Unchanged deliverables are inherited. Use the repair/salvage endpoints only for forward-only recovery of a source campaign; they preserve evidence and require OWNER. Files: download by database record ID, never arbitrary storage URLs. /api/v1/topics/{topicUid}/paths requires paths:read; downloads require files:read. Downloads validate bytes and SHA-256 before returning data. Package size limit is 100 MiB. At most two heavy file operations per API process; excess returns 429. API keys allow 600 requests/minute; honor Retry-After. Central dashboard login/invitations remain with the identity service. Existing Genomics memberships can be administered through this API. Fleet machine lists are imported observations, not proof of current AWS Batch status. Compute launch/terminate, collector ingestion and legacy dashboard contract compatibility are separate integration work; do not infer those operations exist from read endpoints. 503 means maintenance or an unavailable dependency; do not retry writes aggressively. /healthz is process liveness; /readyz is writable authority readiness. During migration, maintenance remains until the database, permissions, storage and dashboard compatibility are qualified. AI agents should ask their operator before destructive or externally consequential workflow changes. There is no MCP server in this release; use these REST functions and OpenAPI.