ProjexCloud

ProjexCloud — API QA Test Plan

Dependency-ordered execution plan for the full API surface. Each wave lists its prerequisites, the SDKs it covers and the expected-output contract QA asserts. Per-API request/response examples live in the API Reference.

681 APIs · 691 test cases · 9 waves

▶ Start testing here: sdk-identity (POST /api/auth/register → login). It is the dependency root — 49 downstream APIs consume the principal token / tenant id it mints ({{cache:...}} references). Run it, cache the token, then proceed wave by wave. A wave only begins once the prior wave is green.

Test environment setup

Bring up the full stack, then exercise the layers in order. The api-gateway auto-runs every SDK migration on first boot — no manual SQL. Only the analytics path (Kafka + ClickHouse) needs --full; the SDK-discovery embedding model runs in-process (no container).

# 1. Full stack up (Postgres + Redis + Kafka + ClickHouse) + seed
./scripts/setup/dev-setup.sh --full --seed        # Windows: ./scripts/setup/dev-setup.ps1 -Full -Seed

# 2. Run all services (gateway, projectors, collectors, discovery, apps)
pnpm dev

# 3. Unit / integration suites (separate terminal) — 97 vitest packages
pnpm test

# 4. API contract tests (gateway must be up) — 691 tests/api_definitions/*.json
#    driven by the ProjexLight runner, wave by wave (W0 -> W8):
#    projexlight_start_api_tests / projexlight_run_api_tests / projexlight_get_api_test_status

# 5. Smoke: every service health endpoint
curl http://localhost:3500/health      # api-gateway
curl http://localhost:3600/healthz     # registry-mcp (discovery)
curl http://localhost:8081/health      # lineage-projector
curl http://localhost:8082/health      # semantic-service
curl http://localhost:8083/health      # pool-federation-runtime

Testing layers: (1) unit/integration pnpm test · (2) service smoke/health · (3) API contract tests over the 691 api_definitions in the wave order below · (4) path checks — discovery, and usage event → ClickHouse rollup + Postgres ledger (needs --full) · (5) deploy artifacts helm lint/template, terraform fmt.

Expected-output contract (all APIs)

Every endpoint returns the standard envelope. QA asserts on this shape plus the HTTP status documented per API:

Success:  { "success": true,  "data": { ... } | [ ... ] }
Error:    { "success": false, "error": "<human-readable reason>" }
MethodStatusdata shape
POST (create)201created resource: {<resource>_id, …payload, status, created_at, updated_at}
POST (action)200action outcome: {status:"completed", …}
GET (one)200single resource object
GET (list)200data:[ … ] (often with total)
PUT/PATCH200updated resource
DELETE200/204{success:true}
async202{status:"accepted", job_id}

Wave order at a glance

#WaveSDKsAPIsTest cases
0Foundation Spine (auth, tenant, routing, events)59797
1Secrets, Audit & Telemetry (cross-cutting infra)62424
2Identity Triad (MDM + ABAC + Consent)63636
3Canonical Entities + Privacy63333
4Operational Core + Billing22727
5Engagement (Domain Layer)19225225
6Knowledge, Semantic & Agent Runtime29201211
7Field, Evidence & Hyperscale (P7)102828
8Governance & Authorization (P10)21010
0Foundation Spine (auth, tenant, routing, events)5 SDKs · 97 APIs · 97 cases

Stand up the spine first — nothing else can be exercised without a tenant, an authenticated principal and the pool router. Start here: sdk-identity (auth/register); 49 downstream APIs cache its token/ids. Gate the whole suite on W0 going green.

Prerequisites: none — this is the root wave.

SDK / serviceAPIsCasesAuth-gatedDetail
api-gateway57572open ↗
pool-federation-runtime331open ↗
sdk-identity222211open ↗
sdk-tenant10109open ↗
sdk-tenant-lifecycle555open ↗
1Secrets, Audit & Telemetry (cross-cutting infra)6 SDKs · 24 APIs · 24 cases

Cross-cutting infrastructure every later wave emits into: secret storage, audit log, metering and telemetry/trace. Verify writes are persisted and readable before relying on them as assertions in later waves.

Prerequisites (must be green): sdk-device sdk-identity sdk-persona sdk-tenant semantic-service

SDK / serviceAPIsCasesAuth-gatedDetail
hdk-diagnostic222open ↗
sdk-audit333open ↗
sdk-diagnostic-telemetry664open ↗
sdk-secrets333open ↗
sdk-trace443open ↗
sdk-vault665open ↗
2Identity Triad (MDM + ABAC + Consent)6 SDKs · 36 APIs · 36 cases

The identity triad — master-data / ABAC policy / consent — plus API keys, MFA and federation (SAML/SCIM). These gate authorization decisions used from W3 onward.

Prerequisites (must be green): sdk-identity sdk-persona

SDK / serviceAPIsCasesAuth-gatedDetail
sdk-api-keys131312open ↗
sdk-consent888open ↗
sdk-policy333open ↗
sdk-principal-token111open ↗
sdk-rebac888open ↗
sdk-resource-registry333open ↗
3Canonical Entities + Privacy6 SDKs · 33 APIs · 33 cases

Canonical business entities (persons, personas, profiles, memberships, devices) and privacy/data-rights. Depend on W0 auth + W2 policy/consent.

Prerequisites (must be green): sdk-identity

SDK / serviceAPIsCasesAuth-gatedDetail
hdk-idp333open ↗
hdk-permissions222open ↗
hdk-sync888open ↗
sdk-parsing333open ↗
sdk-projection444open ↗
sdk-source-record131313open ↗
4Operational Core + Billing2 SDKs · 27 APIs · 27 cases

Operational core: billing, payments, approvals, connectors, media, notifications, search, webhooks, workflows. Depend on entities from W3.

Prerequisites (must be green): sdk-identity sdk-persona

SDK / serviceAPIsCasesAuth-gatedDetail
sdk-data-credits131313open ↗
sdk-import141414open ↗
5Engagement (Domain Layer)19 SDKs · 225 APIs · 225 cases

Engagement domain layer (CRM, campaigns, lead-scoring, content, service-requests). Depends on canonical entities + operational core.

Prerequisites (must be green): sdk-feature-flags sdk-identity sdk-persona sdk-vault

SDK / serviceAPIsCasesAuth-gatedDetail
connector-twilio-voice886open ↗
sdk-approval111111open ↗
sdk-campaign666open ↗
sdk-content777open ↗
sdk-conversation555open ↗
sdk-coverage111111open ↗
sdk-crm282828open ↗
sdk-deliverability171716open ↗
sdk-engagement101010open ↗
sdk-event665open ↗
sdk-handoff999open ↗
sdk-incident888open ↗
sdk-lead-scoring999open ↗
sdk-offer-catalog101010open ↗
sdk-scheduling303025open ↗
sdk-sequence111111open ↗
sdk-service-request555open ↗
sdk-sla303030open ↗
sdk-social443open ↗
6Knowledge, Semantic & Agent Runtime29 SDKs · 201 APIs · 211 cases

Knowledge & semantic layer, agent runtime, AI gateway, MCP bridge, taxonomy/ingest. Depends on identity, policy and the connector/operational layers.

Prerequisites (must be green): api-gateway sdk-identity sdk-rebac sdk-tenant

SDK / serviceAPIsCasesAuth-gatedDetail
registry-mcp111open ↗
sdk-agent-runtime121212open ↗
sdk-ai-gateway10136open ↗
sdk-analytics666open ↗
sdk-asset555open ↗
sdk-assignment141414open ↗
sdk-billing444open ↗
sdk-command554open ↗
sdk-config666open ↗
sdk-connectors222218open ↗
sdk-data-rights999open ↗
sdk-device666open ↗
sdk-dispatch221open ↗
sdk-feature-flags666open ↗
sdk-geo666open ↗
sdk-ingest344open ↗
sdk-mcp-bridge665open ↗
sdk-meter221open ↗
sdk-notification202016open ↗
sdk-payment555open ↗
sdk-persona161616open ↗
sdk-pool-router111open ↗
sdk-profile666open ↗
sdk-search555open ↗
sdk-storm130open ↗
sdk-taxonomy465open ↗
sdk-workflow444open ↗
semantic-service131515open ↗
telemetry110open ↗
7Field, Evidence & Hyperscale (P7)10 SDKs · 28 APIs · 28 cases

Field + Evidence + Hyperscale (current P7 branch): evidence capture, HDK device surfaces, pool federation. Depends on media, identity and sync.

Prerequisites (must be green): sdk-consent sdk-device sdk-engagement sdk-identity sdk-persona

SDK / serviceAPIsCasesAuth-gatedDetail
hdk-camera222open ↗
hdk-image-editor111open ↗
hdk-map222open ↗
hdk-measure333open ↗
hdk-scanner111open ↗
hdk-video-editor111open ↗
hdk-watermark333open ↗
sdk-evidence333open ↗
sdk-media555open ↗
sdk-webhook777open ↗
8Governance & Authorization (P10)2 SDKs · 10 APIs · 10 cases

Governance & authorization (P10): obligation-based PDP, principal token enrichment, consent-gated access, EMPI, resource ownership. Exercised last — asserts the policy decisions woven through every earlier wave.

Prerequisites (must be green): sdk-approval sdk-identity

SDK / serviceAPIsCasesAuth-gatedDetail
contracts220open ↗
sdk-identity-resolver888open ↗

Regenerate: python scripts/qa-matrix/enrich_qa_apis.py && python scripts/qa-matrix/build_test_plan.py && python scripts/qa-matrix/build_api_docs.py