Ship your first import.

Two hostnames, one Worker. api.adaptivmapr.com/v1/… and adaptivmapr.com/api/v1/… both reach these handlers. A bare adaptivmapr.com/v1/… does not — it 404s, because the path rewrite is keyed on the API hostname.

The dashboard plane is separate. Routes under /api/v1/me/* authenticate with the Supabase session cookie rather than a bearer key, and are what the Workbench calls. They are not part of the public v1 contract and are not versioned with it.

Schema-only is the data-minimization mode: only headers plus ≤3 sample rows (≤80 characters each) ever leave your environment. The clamp is enforced at the HTTP edge on every route that accepts sample rows — clampForSchemaOnly() is the single chokepoint, so the API and the MCP tools cannot drift apart on it.

Full-data is gated on an active PHI entitlement. The cascade still runs in-process exactly as it does for schema-only; only the layer-5 LLM call leaves, and it goes to phi-cloud with X-PHI: true and an X-Region header so the gateway forces a PHI-eligible, in-region model. The call fails closed when the target host is not on the BAA-covered allow-list.

PHI routing is a third, orthogonal axis. phi_mode defaults to off — an unconfigured workspace runs standard, and every fail-soft path defaults to standard rather than silently upgrading unknown traffic. PHI routing costs +20% on the whole map charge and is locked until the workspace accepts the BAA/NDA in Settings → Security & Data; an explicit PHI ask without an acceptance returns 403 agreement_required with a pointer, never a silent downgrade. Unstructured input (documents, prose, audio, URLs) always routes as PHI, so asking for standard there returns 400 phi_required_for_full_data.

Retention. Uploads live in Cloudflare KV under a TTL your workspace sets — 24 hours by default, or 0, 168 or 720. The upload response carries the actual expires_at, which is the value to trust rather than any number on this page; 0 means the upload is destroyed on commit. Deleting the workspace destroys the tenant row and its cascade, purges KV and clears the caches in one operation. Data flow, sub-processors and controls are documented at /legal/security.

A 429 carries everything a client needs to back off exactly rather than guess: Retry-After in whole seconds, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds until the window resets). Honour Retry-After when it is present; an exponential backoff that ignores it just spends your budget faster.

Only one route returns an unbounded collection, and it is cursor-paginated rather than offset-paginated: GET /v1/audit walks the append-only trail newest-first. Pass limit (50 by default, 200 maximum), then follow next_cursor into after until it comes back null. A cursor is an opaque row id — do not construct one. Narrow the window with since / until (ISO-8601) and the set with kind, a comma-separated subset of upload.create, mapping.confirm, mapping.commit, billing.event, key.create, key.revoke and connector.sync. An unrecognised kind is dropped rather than rejected.

The catalogue routes (/v1/templates, /v1/packs) return the whole set in one response and are edge-cached; there is no page parameter because there is nothing to page.

AdaptivMapr ships an MCP server so an AI coding environment can call the cascade directly. Add the block below to your MCP config — ~/.cursor/mcp.json for Cursor, or the Claude Desktop config file — and restart the client. The ADAPTIVMAPR_API_KEY is optional: five tools run with no key at all.

POST /v1/reshape (bearer, commit scope) and POST /v1/me/reshape (dashboard session) take your sources plus a target — a schema, or an example workbook whose sheets become the shape to fill. Every fresh run opens with one understanding pass that restates the task from the inputs; that reading anchors the generated program and is returned on both routes, so you can see what the run thought it was doing before it did it. A verdict of mismatch with a question stops the run before any codegen and returns 422 needs_clarification — answer it, or re-run with skip_clarification.

Progress streams. POST /v1/me/reshape/stream emits Server-Sent phase frames and then the same terminal JSON the one-shot returns, including workbook_sheets — which sheets the run produced and which it preserved from your template.

Macros travel. output: "xlsm" is the round trip: template sheets, rewritten data, and the source workbook’s VBA project intact. The macro-enabled format is the consent — every other output value strips macros, and stripping is all four of dropping the part, dropping the relationship, demoting the content type and warning the caller. On the rows→file surfaces there is no source workbook to take macros from, so xlsm is refused there with xlsm_requires_template rather than shipping a file whose name disagrees with its contents.

Reuse. With Save transforms for reuse on (the default), a reshape’s transform is stored so the next import with the same layout replays it — no AI, just the flat per-map fee.

Beyond per-pair statistics, the whole confirmed mapping for an exact header row is cached as a layout, keyed by a sha256 fingerprint of the normalized header row. Commit records it automatically, and when the same header row arrives again POST /v1/layouts/lookup returns it so your importer can offer one-click “reuse last mapping”. A re-map that hits this cache uses no AI — you pay only the flat per-map fee. Layouts are workspace-scoped; there is no cross-tenant sharing.

Drift detection reuses the same fingerprint. POST /v1/layouts/drift compares an incoming field-set for a known (workspace, template) against the newest confirmed layout and returns status: drift (or stable / first_seen) with the added, removed and common headers nested under diff — not at the top level. added carries your header verbatim; removed and common come back normalized, because the baseline is stored normalized and matching on the raw spelling is exactly what the fingerprint exists to avoid. It is fully deterministic — no LLM call — and source-agnostic.

A schema (template) is the shape you map onto. 33 ship across 7 packs — Core, CRM, E-commerce, Healthcare, Finance & Payments (PCI), HR & People (PII), and Evidence. Each field carries multilingual hints (DE / FR / IT / EN / ES) and typed validators; there are 19 validator types in all, from regex and iban through loinc_code, icd10_code, cpt_code, npi and gln. Healthcare templates additionally carry a fhir_resource mapping.

A template id is a plain string — patient_demographics_v1, users_v1 — and it is what you pass as target_schema.schema_id. There is no opaque sch_ handle to look up first.

Every template declares a risk level (low / medium / high). The 13 non-low templates surface requires_hitl: true and hitl_status: "pending_review" on the mappings response so you can gate your own review before commit. The flag is derived from risk, so a new risky template is covered the day it ships. It is advisory by default — the commit goes through — but it is not inert: with MAPR_HITL_ENFORCE on, a commit of a non-low template without hitl_approved: true is refused with 428 hitl_required.

List them with GET /v1/templates, read one with GET /v1/templates/:id, or browse the catalogue. Register your own under /v1/schemas, or draft one from prose with POST /v1/schemas/from_text. For the FHIR emit path see FHIR mapping, and for the field-level checks see the validator reference.

Every commit and confirmation is hashed and written to an append-only audit trail with the mapping fingerprint and accepted/skipped counts, so you can reconstruct exactly which rows landed from which file and when. Each row carries a chain_seq, its own hash and the prev_hash it chains to, which is what makes a gap or an edit detectable rather than merely unlikely. Read it back with GET /v1/audit, or export it from the dashboard, which also renders a print-for-auditor view over the same trail.

Schema-only mode minimises exposure because raw records never leave your environment. Full-data PHI processing is covered by a BAA you accept in-app and by in-region routing; AdaptivMapr is HIPAA-ready — HIPAA is not a certification anyone can hold — and SOC 2 is in progress. Data flow, sub-processors and security controls are documented at /legal/security.