Production control API

scribase-control-api serve runs the authenticated HTTP/1.1 management API over the durable PostgreSQL executor. It defaults to 127.0.0.1:8080; terminate TLS at a trusted ingress or same-host sidecar. A non-loopback bind is rejected unless SCRIBASE_TRUST_PROXY_TLS=1 explicitly acknowledges that deployment boundary.

Required configuration:

Variable	Purpose
SCRIBASE_API_DATABASE_URL	TLS URL using the least-privilege scribase_api role
SCRIBASE_AUTH_MODE	oidc (default; the five values below are then required) or builtin (the control plane's own password sign-in, no IdP; see DEPLOY.md "Operator sign-in")
SCRIBASE_OIDC_INTROSPECTION_ENDPOINT	HTTPS RFC 7662 token-introspection endpoint
SCRIBASE_OIDC_ISSUER	Exact trusted iss claim, including any trailing slash
SCRIBASE_OIDC_AUDIENCE	Required API audience in the aud claim
SCRIBASE_OIDC_CLIENT_ID	Confidential introspection client identifier
SCRIBASE_OIDC_CLIENT_SECRET	Confidential introspection client secret

The database URL must contain sslmode=require. PostgreSQL 16+ psql, curl, and jq must be installed. The introspection request and its Basic client credential are streamed to curl over stdin and never appear in arguments, debug output, or error messages. A token is accepted only when introspection reports it active with the exact configured issuer and audience, a future numeric expiry, an optional valid not-before time, and a bounded subject. Organization roles are then loaded from current forced-RLS membership state; token metadata is not used for authorization. The API process is never given the scribase_operator or schema-migrator database credential.

Optional configuration:

Variable	Default
SCRIBASE_HTTP_BIND	127.0.0.1:8080
SCRIBASE_TRUST_PROXY_TLS	unset; required as 1 for non-loopback binding
SCRIBASE_MAX_ENVIRONMENTS	10 for newly bootstrapped organizations
SCRIBASE_DATABASE_MAX_CONNECTIONS	10
SCRIBASE_HTTP_READ_TIMEOUT_SECONDS	15
SCRIBASE_HTTP_WRITE_TIMEOUT_SECONDS	15
SCRIBASE_HTTP_MAXIMUM_HEADER_BYTES	32768
SCRIBASE_HTTP_MAXIMUM_BODY_BYTES	1048576
SCRIBASE_HTTP_WORKER_THREADS	4
SCRIBASE_HTTP_MAXIMUM_QUEUED_CONNECTIONS	64
SCRIBASE_PSQL_BINARY	psql
SCRIBASE_CURL_BINARY	curl
SCRIBASE_JQ_BINARY	jq

The adapter rejects transfer encoding, duplicate headers, request pipelining, unknown JSON fields, oversized input, percent-encoded management paths, and unsupported content types. Responses disable caching and MIME sniffing. The operation lookup endpoint requires X-Scribase-Organization-ID so membership is resolved before accessing an operation identifier.