API overview

Operations come only from the connected backend’s OpenAPI document. A connector policy independently controls execution and the destination origin; document server URLs cannot redirect your credential.

Telegraph’s source is https://telestorage.pages.dev/openapi.json on the default connection. Its Object API uses Bearer authentication; S3 requires separate SigV4 signing and is documentation-only here.

Requests run only when explicitly executed, without automatic retries. Non-read operations require acknowledgement. Cancelling cannot undo a mutation already accepted by the service.

Parameters and JSON syntax receive basic validation, not full JSON Schema validation. Schemas and authentication alternatives are shown for reference. Browser CORS rules still apply.

Credentials stay in memory. Examples, documents, responses and history are redacted, but may still contain business data. Do not enter credentials into paths or query parameters, or share exports without reviewing them.

OpenAPI document

Read-only, redacted document. Example/default values are omitted to avoid importing credentials. Local references are resolved in Explorer; external and circular references are not fetched.

The last 50 executed requests in memory only. Request/response credentials are redacted; binary bytes are excluded. Disconnecting, changing the connection or reloading the page clears this history. No automatic replay.

No executed requests this session.

Export documents

Explicit local download of business data. IDs, versions and timestamps are excluded for re-import as NEW documents; this is not a complete database backup. Review files before sharing.

CSV needs a scalar schema and consistently present, non-null fields. Spreadsheet formula-like text is prefixed with an apostrophe; JSON preserves exact text.

API request builder

Reuse the OpenAPI-powered request builder: declared operations, typed parameters, request bodies, mutation acknowledgement, response inspection and redacted cURL / JavaScript examples. No duplicate network client.

Media / file tools

Inspect a local file without uploading or executing its contents. SHA-256 is informational and is not a remote ETag or version precondition.

Use Files for connector-backed uploads, downloads, ranges, metadata, prefix navigation and confirmed deletion. Server-side copy, rename, presigned URLs and atomic object deletion preconditions are not invented.

Review changes before execution

Writes are independent, not a transaction. Cancel stops after the active request; completed writes cannot be rolled back here. Disconnecting clears results and retry keys, and cannot undo an in-flight write.

No automatic retries. Failed creates reuse the original idempotency key and body; updates/deletes reuse the original expected version. Conflicts and validation failures require a new reviewed plan. A 429 enforces a 60-second cooldown. After a long delay, verify creates in the backend before retrying (server idempotency retention is not guaranteed indefinitely).

3 · Validate and review proposal

At most 20 creates/selected edits. Transform and bulk drafts use explicit top-level replacement fields. Only known indexed equality filters and documented GET/HEAD API drafts are accepted. No deletion, executable scripts, tool calls, auth fields or model-controlled write targets/versions.

Record drafts require Tools’ existing exact-collection confirmation before execution. Filters and API inputs remain drafts until you explicitly apply or execute them. Backend validation, authentication, connector permissions and optimistic concurrency remain in force.