# API Documentation

## Overview

Mnexium provides fine-grained access control, data lifecycle management, and privacy-conscious design to help you build enterprise-ready AI applications.

## PII Guidelines

Best practices for handling personally identifiable information:

- **Do not store secrets in memory text**  
  Never put passwords, API keys, or tokens in memory `text` fields. These are searchable and may be included in LLM context.

- **Use metadata for identifiers**  
  Store user IDs, order numbers, and references in `metadata`. Keep memory `text` for semantic meaning.

- **Scope data by subject_id**  
  Always use `subject_id` to isolate user data. Memories are never shared across subjects unless explicitly marked `visibility: "shared"`.

## Audit Trail

Every API call is logged with full context. View your activity log at [/activity-log](/content/activity-log/index.html).

### API Action Structure

- `action`
  - **Type:** string  
    API action performed (e.g., `memory.create`, `chat.completion`)

- `subject_id`
  - **Type:** string  
    User the action was performed for

- `status`
  - **Type:** string  
    Result: `success` or `failure`

- `timestamp`
  - **Type:** datetime  
    When the action occurred

- `metadata`
  - **Type:** object  
    Additional context (model, tokens, etc.)