EPS Data, API, Calendar, and Standards Reference

API profile

All routes are mounted below /api/planning, require dashboard authentication except the Worker scheduler, return camelCase JSON, and enforce partner/project access. Collection writes are bounded and audited. Versioned records use expectedVersion; canonical change application uses expected timestamps and idempotency keys.

Method and path	Purpose
GET/POST /projects	list or create planning projects
GET/PATCH /projects/:projectId	load workspace or versioned project update
POST /projects/:projectId/link-event	one-time canonical event link
GET /projects/:projectId/event-catalog	live canonical EMS event, tiers, inclusions, add-ons, and shop
POST/PATCH /projects/:projectId/:collection[/resourceId]	departments, calendars, work, requirements, meetings, risks, gates, reminders
POST/DELETE /projects/:projectId/dependencies	dependency graph changes with cycle protection
POST/DELETE /projects/:projectId/resource-links	planning overlay to canonical EMS resource link
GET/POST /projects/:projectId/change-sets	list or create reviewed EMS proposals
POST .../review and POST .../apply	approve/reject and atomically apply proposals
POST .../canonical-command	authorized direct canonical command
GET /projects/:projectId/meetings/:meetingId	meeting, ordered agenda, and minutes revisions
POST .../agenda and POST .../minutes	add agenda items and immutable minutes revisions
GET /projects/:projectId/calendar.ics	authenticated iCalendar publish/download profile
GET /planning/openapi.json	machine-readable OpenAPI 3.1 inventory using JSON Schema 2020-12
POST /projects/:projectId/artifacts	Sanity-only mediated upload
GET /artifacts/:artifactId/content	authorized proxy/decrypt stream; never redirects to Sanity
POST .../artifacts/:artifactId/review	authorized clean/quarantine decision
POST .../destinations and POST .../test	write-only destination setup and test
GET /projects/:projectId/my-reminder-channels	current user’s mandatory-email baseline plus masked Telegram DM, Discord DM, and verified/consented SMS readiness
POST .../my-reminder-channels/:channel/:action	current-user Telegram/Discord link, verify, test and unlink; SMS start/resend/verify/test/opt-out/unlink
GET /projects/:projectId/delivery-history	bounded permission-checked channel attempts and safe delivery dispositions
POST .../notification-outbox/:outboxId/retry or /reconcile	authorized attempt recovery without creating another logical reminder
POST /projects/:projectId/sms-gateway/devices/:deviceId/native-token	issue, rotate, or revoke a digest-stored online Android device credential
GET/POST /sms-gateway/devices/:deviceId/...	token-authenticated preflight, heartbeat, job lease, immediate recheck, and native receipt routes
POST /projects/:projectId/imports	preview or atomically apply 1–500 versioned JSON records with digest and idempotency receipt
GET /my-work	cross-project tasks, requirements, reviews, and meetings

Common errors are 400 invalid input/application failure, 401 unauthenticated, 403 capability denied, 404 out-of-scope record, and 409 duplicate, cycle, state, or optimistic-version conflict.

Personal reminder routes also return stable safe codes for provider identity mismatch/ambiguity, bot chat or DM unavailable, SMS verification or consent required, country/segment/cost policy blocked, no eligible online device/SIM, lease or challenge expiry, rate limiting, provider failure, and retry exhaustion. Responses and audit payloads mask targets and exclude locator ciphertext, raw provider IDs, access/refresh/bot/native tokens, webhook secrets, full phone numbers, verification codes, and unsafe provider response text.

Import apply requires the exact previewDigest returned for the normalized records plus a UUID idempotencyKey. A stale/missing digest returns IMPORT_PREVIEW_REQUIRED; row validation returns field-specific errors without writes. Import payloads reject Sanity locators, and file evidence is never accepted by the JSON import route.

Key statuses

Record	Main states
Project	concept, active, readiness, handed_off, paused, cancelled, archived
Requirement	draft, assigned, in_progress, submitted, revision_requested, accepted, waived, expired, cancelled
Meeting	draft, scheduled, in_progress, completed, cancelled
Minutes	draft, review, published, superseded
Change set	draft, submitted, approved, rejected, applied, conflicted, cancelled
Artifact scan	pending, clean, quarantined, failed
Personal channel readiness	unlinked, pending, ready, blocked, revoked, error
SMS verification	unverified, pending, verified, expired, revoked, blocked
SMS consent	not_granted, granted, withdrawn
SMS gateway job	pending, blocked_device_required, blocked_policy, leased, sent, delivered, sent_unconfirmed, retry_wait, failed, cancelled, suppressed, expired

Reminder records and isolation

Mandatory email is the canonical schedule source. A database fan-out derives separate telegram_dm, discord_dm, and sms reminder rows only for a current ready binding and explicit project preference. Each personal logical key includes the linked identity version. Relink, unlink, opt-out, revocation, terminal work state, or deadline replacement cancels stale scheduled/outbox/SMS work and keeps prior attempts immutable.

Service-owned personal contact, SMS verification, gateway job, and attempt tables have RLS enabled, revoke ordinary anon and authenticated Data API access, and grant service-role access explicitly. Privileged synchronization functions use fixed search paths and service-role-only execution. The API derives partner, project, actor, recipient, destination, and device scope; callers cannot supply a different user’s personal destination.

Phone numbers and direct-message locators are encrypted with purpose-specific API-owned keys. General planning payloads use only masked destinations and safe content. SMS jobs carry an encrypted phone and message only inside the dedicated service-owned queue, plus a payload digest, identity version, cancellation revision, expiry, segment/encoding data, country allowlist, cost ceilings, and pacing policy. Native tokens and challenge codes are stored as digests rather than recoverable secrets.

The Android lease remains online-only and same-partner. Device/SIM selection requires current permission and heartbeat state, a verified active non-roaming SIM, allowed country, segment and cost headroom, unexpired job, and current cancellation/payload values. A native receipt updates channel evidence only; it cannot mutate the associated planning record.

Calendar profile

The authenticated export follows RFC 5545 iCalendar syntax for a bounded publish profile: VCALENDAR, meetings as VEVENT, due work as VTODO, stable UID, SEQUENCE, UTC timestamps, escaped text, status, URL, and line folding. It does not claim CalDAV (RFC 4791), CalDAV Scheduling (RFC 6638), or JSCalendar (RFC 8984) round-trip compatibility yet.

Standards mapping

Standard or guidance	EPS use	Claim level
ISO 21502 / ISO 21511	lifecycle, work breakdown, dependencies, schedule and change records	design guidance
ISO 20121:2024	sustainable event objectives, interested parties, controls, improvement	design guidance
ISO 31000 / IEC 31010	risk context, assessment, treatment and review	design guidance
ISO 22301	continuity, exercise, response and recovery evidence	design guidance
ISO 45001	work-related hazard and control prompts	design guidance
ISO 15489-1	record identity, versions, retention, disposal and audit	design guidance
ISO/IEC 27001	access, cryptography, logging, incident and supplier controls	design guidance
WCAG 2.2	keyboard forms, non-drag alternatives, target sizing, accessible schedule table	target AA; not independently certified
OpenAPI 3.1 / JSON Schema 2020-12	machine-readable EPS route inventory and versioned import envelope	implemented in Preview at /api/planning/openapi.json

Feature presence is not ISO certification, legal compliance, or independent conformance. Jurisdictional obligations, including Philippine privacy and accessibility requirements, need qualified review and an effective-dated obligation register.

Completion check

API consumers know the auth, version, idempotency, bounds, error, publication, and Sanity-leak contracts, and standards claims are described as guidance or tested profiles rather than certification.