Assemble a contract folder into a manifest
Merge a contract folder (files map keyed by relative path, order preserved) into one self-contained manifest — the single source of truth for the assembly rules shared by the portal import wizard and the contract-json skill’s self-check.
Slot files: dataapp.json / input_schema.json / output_schema.json /
runtime.json / pricing.json / examples.json / README.md (name match
is case-insensitive; the dotted input.schema.json spelling is also
accepted and normalized in picked). pricing/examples may instead
live flattened inside dataapp.json. The merged manifest then goes
through the full authoring check (same verdict as POST
/data-apps/validate); issues must be empty before the folder counts
as deliverable. Recoverable oddities (missing files, duplicate names
across levels, ignored non-contract files, folder-name mismatch, …)
come back as structured warnings (code + params, localized by
consuming display layers), not errors.
Hard failures (400): a slot file is not valid JSON / has the wrong shape (examples.json must be an array, other slots objects) / exceeds 1MB, no contract file is found at all, or the total size exceeds the 12MB channel limit. The contract channel covers api kind only: runtime.kind=code yields an issue.
Optional 8th file i18n.json ({source, locales}, up to 4MB): it
is not merged into the manifest — it comes back parsed as
translations for the caller to save via the translations
endpoints. source is required (400 contract-file-invalid when
missing); invalid locales are 400 locale-invalid; a locale equal to
source is skipped with i18n-locale-is-source; path-level
problems surface as i18n-* warnings.
Encoding: the files map is JSON text, so byte-level encoding is the
client’s concern (browsers decode as UTF-8 before upload); the
server only strips a leading UTF-8 BOM. The fixed contract path
segment reserves that username (like batch): a user named
contract cannot address apps named assemble/split here.
Anonymous access (like GET /data-apps/manifest-schema and the skill zip): assembly is a pure function over the request body — nothing is read from or written to the platform, so there is no data to protect, and requiring a key only forced contract authors to obtain a token before they could self-check. The per-file / total size guards remain the only admission control.
Authorizations
DataHub API Key
Body
POST contract/assemble request body: a contract folder as a files map.
Keys are the relative paths as picked/dragged (kept in order): the "duplicate name across levels" preference (shallower wins, later wins at equal depth) and folder-name derivation depend on them.
Response
Successful Response
Assembly result: the merged manifest plus the full authoring check (same verdict as POST /data-apps/validate) and structured soft warnings.