Point it at archives already sitting on disk, S3 or IPFS. The gateway loads their metadata into an isolated semantic graph and serves it through the official iiRDS query API — no uploads, no vendor lock-in.
Archives end up scattered across object storage, local disk and content-addressed networks. Every consumer needs a different slice, exposed safely, with the guarantee they only see what they are authorized for. Bespoke interfaces don't interoperate, and rolling your own semantic layer per project doesn't scale.
This service is a standards-compliant gateway that turns those scattered archives into a single, secure query surface — without moving a byte you didn't ask it to.
Call POST /api/ingest with a resource URI. The gateway fetches its metadata.rdf in the background. Nothing is uploaded through the API.
Triples are merged with the iiRDS core schema and loaded into a named graph keyed by that resource URI. Poll /api/ingest/status for readiness.
Run SPARQL against /api/sparql, or use the native iiRDS JSON query language. Every result is scoped to the URIs you are authorized to see.
A plain Request API assumes one store, one identity, one deployment. Real documentation estates aren't like that. Five extensions turn the standard into something you can actually operate.
scheme://source/path routes to the right backend automatically.memory → local → Oxigraph → remote — same queries, horizontal scale.Query with the iiRDS JSON query language or raw SPARQL 1.1 over the merged core schema.
Fetch archives from local disk, S3/MinIO or IPFS — pre-configured sources prevent SSRF and credential leaks.
Every archive loads into its own named graph; requests are automatically restricted to the caller's grants.
Self-signed DID-JWT proofs verified without server-side keys, with optional OAuth2/Keycloak alongside.
A stateless app tier plus a shared Oxigraph backend means you add replicas behind a load balancer.
Helmet hardening, global rate limiting, health & readiness probes, Sentry and structured Winston logging.
Click through the flow. Every request is a copy-paste curl against a running server. Auth is a single Bearer header the whole way.
Self-sovereign identity for federated clients and machine identities. Register a did:jwk with an admin or trusted-domain invite, then sign a fresh proof JWT per request. The public key is derived from the DID — nothing is stored server-side.
Existing users and service accounts reach the API with tokens from your OIDC provider — validated locally against the issuer's JWKS. No client secret is stored, and both schemes run on the same Bearer header.
One shared token scoped to every known resource URI, for trusted service-to-service automation. Present it as a Bearer header — meant for internal jobs, not public clients.
The service is AGPLv3 open source — clone it and self-host on Docker or Kubernetes. Prefer a managed setup? We offer it as a SaaS or a fully on-premise deployment.
A production Docker image plus a Helm chart (stateless app, bundled Oxigraph). Point at a shared graph store and scale to as many replicas as you need.
yarn build # -> dist/iirds docker build -t iirds . helm install iirds charts/iirds
Skip the ops. We host, monitor and update the gateway for you.
Clone the repository and run the full local stack — app, Postgres, MinIO and Oxigraph — with a single command.
git clone gitlab.com/enduradocs/applications/services/iirds