Get started
How-to guides
Reference
Concepts
Self-host gallery
Appendixdocs/feature-catalog.md.
The tables below are generated from the route registrations in internal/api/routes*.go. After adding or changing a route, run go run ./scripts/gen-api-reference (fast and idempotent) and commit the result; TestAPIReferenceCoversEveryRoute fails if a registered route is missing. New routes land in the group with the closest path prefix, or in Other.
System
System endpoints for:- Status checks and diagnostics
- Admin operations
- Configuration retrieval and management
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /healthz | Public | handleHealthz |
| GET | /readyz | Public | handleReadyz |
| GET | /api/v1/brand | Public | handleBrand |
| GET | /api/v1/dev-mode | Public | handleDevMode |
| GET | /api/v1/system/status | AbilityRead | handleSystemStatus |
| GET | /api/v1/system/doctor | AbilityRead | handleSystemDoctor |
| GET | /api/v1/system/containers | AbilityRead | handleListContainers |
| POST | /api/v1/system/prune | AbilityRoot | handleSystemPrune |
| POST | /api/v1/system/backups | AbilityRoot | handleCreateControlPlaneBackup |
| GET | /api/v1/system/backups | AbilityRoot | handleListControlPlaneBackups |
| GET | /api/v1/system/backups//download | AbilityRoot | handleDownloadControlPlaneBackup |
| POST | /api/v1/system/backups//verify | AbilityRoot | handleVerifyControlPlaneBackup |
| DELETE | /api/v1/system/backups/ | AbilityRoot | handleDeleteControlPlaneBackup |
| GET | /api/v1/system/volumes/orphaned | AbilityRead | handleListOrphanedVolumes |
| POST | /api/v1/system/volumes/orphaned/cleanup | AbilityRoot | handleCleanupOrphanedVolumes |
| POST | /api/v1/system/master-key/rotate | AbilityRoot | handleRotateMasterKey |
| GET | /api/v1/onboarding | AbilityRead | handleGetOnboardingState |
| POST | /api/v1/onboarding/complete | AbilityWrite | handleCompleteOnboarding |
| PUT | /api/v1/onboarding/progress | AbilityRoot | handleUpdateOnboardingProgress |
| GET | /api/v1/updates | AbilityRead | handleGetUpdates |
| GET | /api/v1/system/secrets/binding | AbilityRead | handleGetSecretBinding |
| POST | /api/v1/system/secrets/rebind | AbilityRoot | handleRebindSecrets |
| GET | /api/v1/system/control-plane-dr | AbilityRead | handleGetControlPlaneDR |
| PUT | /api/v1/system/control-plane-dr/settings | AbilityWriteSensitive | handleUpdateControlPlaneDR |
| GET | /api/v1/system/control-plane-dr/backups | AbilityRead | handleListControlPlaneDRBackups |
| POST | /api/v1/system/control-plane-dr/run | AbilityWriteSensitive | handleRunControlPlaneDRBackup |
| POST | /api/v1/system/control-plane-dr/drill | AbilityWriteSensitive | handleRunControlPlaneDRDrill |
| POST | /api/v1/system/control-plane-dr/escrow | AbilityRoot | handleControlPlaneDREscrow |
| POST | /api/v1/system/control-plane-dr/escrow/ack | AbilityWriteSensitive | handleAckControlPlaneDREscrow |
| GET | /api/v1/updates/preflight | AbilityRead | handleUpdatePreflight |
| POST | /api/v1/system/containers//stop | AbilityRoot | handleStopOrphanedContainer |
| POST | /api/v1/system/containers//remove | AbilityRoot | handleRemoveOrphanedContainer |
| POST | /api/v1/system/containers//claim | AbilityWrite | handleClaimOrphanedContainer |
| GET | /api/v1/updates/settings | AbilityRoot | handleGetUpdateSettings |
| PUT | /api/v1/updates/settings | AbilityRoot | handleUpdateSettings |
| GET | /api/v1/system/orphans | AbilityRead | handleListOrphans |
| POST | /api/v1/system/orphans/reap | AbilityRoot | handleReapOrphans |
| GET | /api/v1/updates/releases | AbilityRead | handleReleaseHistory |
| GET | /api/v1/updates/rollback-plan | AbilityRoot | handleRollbackPlan |
| GET | /api/v1/updates/history | AbilityRead | handleUpgradeHistory |
| POST | /api/v1/updates/history//ack | AbilityWrite | handleAckUpgrade |
| GET | /api/v1/system/reverse-proxy | AbilityRead | handleReverseProxyGuide |
| GET | /api/v1/system/docker-guard | AbilityRead | handleGetDockerGuard |
| PUT | /api/v1/system/docker-guard | AbilityRoot | handleUpdateDockerGuard |
| GET | /api/v1/system/geoip | AbilityRead | handleGeoIPLookup |
| GET | /api/v1/system/proxy-integration | AbilityRead | handleGetProxyIntegration |
| POST | /api/v1/system/proxy-integration/setup | AbilityRoot | handleSetupProxyIntegration |
| POST | /api/v1/system/proxy-integration/apply | AbilityRoot | handleApplyProxyIntegration |
| POST | /api/v1/system/proxy-integration/verify | AbilityRoot | handleVerifyProxyIntegration |
| GET | /api/v1/system/readiness | AbilityRead | handleServerReadiness |
| GET | /api/v1/updates/self-upgrade/plan | AbilityRead | handleSelfUpgradePlan |
| GET | /api/v1/updates/self-upgrade/attempts | AbilityRead | handleSelfUpgradeAttempts |
| POST | /api/v1/updates/self-upgrade | AbilityRoot | handleSelfUpgradeStart |
| GET | /api/v1/updates/schedule | AbilityRead | handleGetUpgradeSchedule |
| POST | /api/v1/updates/schedule | AbilityRoot | handleCreateUpgradeSchedule |
| DELETE | /api/v1/updates/schedule | AbilityRoot | handleCancelUpgradeSchedule |
| GET | /api/v1/updates/auto | AbilityRoot | handleGetUpgradePolicy |
| PUT | /api/v1/updates/auto | AbilityRoot | handleUpdateUpgradePolicy |
| POST | /api/v1/updates/backup-now | AbilityRoot | handleUpgradeBackupNow |
| GET | /api/v1/system/server-address | AbilityRead | handleGetServerAddress |
| PUT | /api/v1/system/server-address | AbilityRoot | handleSetServerAddress |
| GET | /api/v1/system/restart | AbilityRead | handleGetSystemRestart |
| POST | /api/v1/system/restart | AbilityRoot | handleSystemRestart |
| GET | /api/v1/system/cli-console/commands | AbilityRoot | handleCLIConsoleCommands |
| GET | /api/v1/system/cli-console/session | AbilityRoot | handleCLIConsoleSession |
Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth
123 endpoints for authentication, two-factor auth, user management, IAM, device login, and OAuth integration
123 endpoints for authentication, two-factor auth, user management, IAM, device login, and OAuth integration
Endpoints for:
- Authentication and session management
- Two-factor authentication setup and verification
- User and role management
- IAM policies and attachment
- Device login flows
- OAuth provider configuration
| Method | Path | Ability | Handler |
|---|---|---|---|
| POST | /api/v1/auth/login | Public | handleLogin |
| POST | /api/v1/auth/register | Public (setup token) | handleRegister |
| GET | /api/v1/auth/setup-status | Public | handleSetupStatus |
| POST | /api/v1/auth/logout | Session | handleLogout |
| PUT | /api/v1/auth/password | Session | handleChangePassword |
| GET | /api/v1/auth/session | Session | handleGetSession |
| POST | /api/v1/auth/sessions/revoke-others | Session | handleRevokeOtherSessions |
| POST | /api/v1/auth/users | AbilityRoot | handleCreateUser |
| GET | /api/v1/users | AbilityRead | handleListUsers |
| DELETE | /api/v1/users/ | AbilityRoot | handleDeleteUser |
| PUT | /api/v1/users//abilities | AbilityRoot | handleUpdateUserAbilities |
| GET | /api/v1/roles | AbilityRead | handleListRoles |
| POST | /api/v1/invites | AbilityWrite | handleCreateInvite |
| GET | /api/v1/invites | AbilityRead | handleListInvites |
| DELETE | /api/v1/invites/ | AbilityWrite | handleRevokeInvite |
| POST | /api/v1/invites/accept | Public | handleAcceptInvite |
| POST | /api/v1/iam/policies | AbilityRoot | handleCreatePolicy |
| GET | /api/v1/iam/policies | AbilityRead | handleListPolicies |
| GET | /api/v1/iam/policies/ | AbilityRead | handleGetPolicy |
| PUT | /api/v1/iam/policies/ | AbilityRoot | handleUpdatePolicy |
| DELETE | /api/v1/iam/policies/ | AbilityRoot | handleDeletePolicy |
| GET | /api/v1/iam/policies//attachments | AbilityRead | handleListPolicyAttachments |
| POST | /api/v1/iam/policies//attachments | AbilityRoot | handleAttachPolicy |
| DELETE | /api/v1/iam/policies//attachments// | AbilityRoot | handleDetachPolicy |
| POST | /api/v1/auth/device/start | Public | handleDeviceAuthStart |
| POST | /api/v1/auth/device/token | Public | handleDeviceAuthToken |
| GET | /api/v1/auth/device/requests | Session | handleListDeviceAuthRequests |
| POST | /api/v1/auth/device//approve | Session | handleApproveDeviceAuthRequest |
| POST | /api/v1/auth/device//deny | Session | handleDenyDeviceAuthRequest |
| GET | /api/v1/auth/oauth/providers | Public | handleListPublicOAuthProviders |
| GET | /api/v1/auth/oauth//start | Public | handleOAuthStart |
| GET | /api/v1/auth/oauth//callback | Public | handleOAuthCallback |
| GET | /api/v1/auth/oauth//link/start | Session | handleOAuthLinkStart |
| GET | /api/v1/settings/oauth | AbilityRead | handleListOAuthSettings |
| PUT | /api/v1/settings/oauth/ | AbilityRoot | handleUpdateOAuthProviderSettings |
| POST | /api/v1/auth/forgot-password | Public | handleForgotPassword |
| POST | /api/v1/auth/reset-password | Public | handleResetPassword |
| POST | /api/v1/auth/tokens | Session | handleCreateToken |
| GET | /api/v1/auth/tokens | Session | handleListTokens |
| DELETE | /api/v1/auth/tokens/ | Session | handleRevokeToken |
| GET | /api/v1/settings/ai-assistant | AbilityRead | handleGetAIAssistantSettings |
| PUT | /api/v1/settings/ai-assistant | AbilityRoot | handleUpdateAIAssistantSettings |
| DELETE | /api/v1/settings/ai-assistant | AbilityRoot | handleDeleteAIAssistantSettings |
| GET | /api/v1/settings/deploy-freeze | AbilityRead | handleGetGlobalDeployFreeze |
| PUT | /api/v1/settings/deploy-freeze | AbilityRoot | handlePutGlobalDeployFreeze |
| GET | /api/v1/settings/push-subscriptions/vapid-public-key | Session | handleGetPushVAPIDPublicKey |
| GET | /api/v1/settings/push-subscriptions | Session | handleListPushSubscriptions |
| POST | /api/v1/settings/push-subscriptions | Session | handleCreatePushSubscription |
| DELETE | /api/v1/settings/push-subscriptions/ | Session | handleDeletePushSubscription |
| GET | /api/v1/settings/observability | AbilityRead | handleGetObservabilitySettings |
| PUT | /api/v1/settings/observability | AbilityRoot | handleUpdateObservabilitySettings |
| POST | /api/v1/auth/session-links | AbilityRoot | handleMintSessionLink |
| GET | /api/v1/auth/session-links//consume | Public | handleConsumeSessionLinkGET |
| GET | /api/v1/auth/whoami | Public | handleWhoami |
| POST | /api/v1/roles | AbilityRoot | handleCreateRole |
| PUT | /api/v1/roles/ | AbilityRoot | handleUpdateRole |
| DELETE | /api/v1/roles/ | AbilityRoot | handleDeleteRole |
| PUT | /api/v1/users//role | AbilityRoot | handleSetUserRole |
| GET | /api/v1/users//environment-grants | AbilityRoot | handleGetEnvironmentGrants |
| PUT | /api/v1/users//environment-grants | AbilityRoot | handlePutEnvironmentGrants |
| GET | /api/v1/iam/policy-templates | AbilityRead | handleListPolicyTemplates |
| POST | /api/v1/iam/policy-templates//apply | AbilityRoot | handleApplyPolicyTemplate |
| GET | /api/v1/settings/ai-control | AbilityRead | handleGetAIControl |
| PUT | /api/v1/settings/ai-control | AbilityRoot | handleUpdateAIControl |
| POST | /api/v1/settings/ai-control/revoke-agent-tokens | AbilityRoot | handleRevokeAgentTokens |
| GET | /api/v1/auth/device/pending-summary | AbilityRead | handleDevicePendingSummary |
| GET | /api/v1/auth/device/activity | AbilityRead | handleDeviceActivity |
| GET | /api/v1/iam/catalog | AbilityRead | handleIAMCatalog |
| GET | /api/v1/iam/resources | AbilityRead | handleIAMResources |
| POST | /api/v1/iam/resources/match | AbilityRead | handleIAMMatch |
| GET | /api/v1/iam/principals | AbilityRead | handleIAMPrincipals |
| GET | /api/v1/iam/principals///effective | AbilityRead | handleIAMEffective |
| GET | /api/v1/iam/simulate | AbilityRead | handleIAMSimulate |
| GET | /api/v1/iam/analyze | AbilityRead | handleIAMAnalyze |
| POST | /api/v1/iam/policies/validate | AbilityRead | handleValidatePolicy |
| POST | /api/v1/iam/preview | AbilityRead | handleIAMPreview |
| GET | /api/v1/iam/policies//versions | AbilityRead | handleListPolicyVersions |
| POST | /api/v1/iam/policy-templates//render | AbilityRead | handleRenderPolicyTemplate |
| GET | /api/v1/auth/login-options | Public | handleLoginOptions |
| POST | /api/v1/auth/login-code/request | Public | handleRequestLoginCode |
| POST | /api/v1/auth/login-code/redeem | Public | handleRedeemLoginCode |
| POST | /api/v1/auth/login-approval/poll | Public | handlePollLoginApproval |
| GET | /api/v1/auth/sign-in-requests | Public | handleListSignInRequests |
| POST | /api/v1/auth/sign-in-requests/codes//reveal | Public | handleRevealLoginCode |
| POST | /api/v1/auth/login-approvals//approve | Public | handleApproveLoginApproval |
| POST | /api/v1/auth/login-approvals//deny | Public | handleDenyLoginApproval |
| GET | /api/v1/auth/trusted-devices | Public | handleListTrustedDevices |
| DELETE | /api/v1/auth/trusted-devices/ | Public | handleRevokeTrustedDevice |
| GET | /api/v1/settings/auth/code-login | AbilityRead | handleGetCodeLoginSettings |
| PUT | /api/v1/settings/auth/code-login | AbilityRoot | handlePutCodeLoginSettings |
| POST | /api/v1/auth/sign-in-alert/disown | Public | handleDisownSignIn |
| GET | /api/v1/security/posture | AbilityRead | handleSecurityPosture |
| GET | /api/v1/security/policy | AbilityRead | handleGetSecurityPolicy |
| PUT | /api/v1/security/policy | AbilityRoot | handlePutSecurityPolicy |
| GET | /api/v1/security/sessions | Public | handleListSecuritySessions |
| DELETE | /api/v1/security/sessions/ | Public | handleRevokeSecuritySession |
| POST | /api/v1/security/sessions/revoke-others | Public | handleRevokeOtherSecuritySessions |
| GET | /api/v1/security/account | Public | handleGetAccountSecurity |
| PUT | /api/v1/security/account | Public | handlePutAccountSecurity |
| GET | /api/v1/settings/database-upgrades | AbilityRead | handleGetPlatformUpgradePolicy |
| PUT | /api/v1/settings/database-upgrades | AbilityRoot | handlePutPlatformUpgradePolicy |
| GET | /api/v1/settings/domain-automation | AbilityRead | handleGetDomainAutomation |
| PUT | /api/v1/settings/domain-automation | AbilityRoot | handleUpdateDomainAutomation |
| PUT | /api/v1/settings/proxy-integration | AbilityRoot | handleUpdateProxyIntegrationSettings |
| GET | /api/v1/auth/step-up | Public | handleStepUpOptions |
| POST | /api/v1/auth/step-up | Public | handleStepUp |
| POST | /api/v1/auth/step-up/passkey/begin | Public | handleStepUpPasskeyBegin |
| POST | /api/v1/auth/step-up/passkey/finish | Public | handleStepUpPasskeyFinish |
| GET | /api/v1/settings/beta-features | AbilityRead | handleListBetaFeatures |
| PUT | /api/v1/settings/beta-features/ | AbilityRoot | handleSetBetaFeature |
| POST | /api/v1/auth/session-links/consume | Public | handleConsumeSessionLink |
| GET | /api/v1/auth/2fa | Session | |
| POST | /api/v1/auth/2fa/setup | Session | |
| POST | /api/v1/auth/2fa/confirm | Session | |
| POST | /api/v1/auth/2fa/disable | Session | |
| POST | /api/v1/auth/2fa/recovery-codes/regenerate | Session | |
| POST | /api/v1/auth/2fa/verify | Public | |
| GET | /api/v1/auth/passkeys | Session | |
| POST | /api/v1/auth/passkeys/register/begin | Session | |
| POST | /api/v1/auth/passkeys/register/finish | Session | |
| DELETE | /api/v1/auth/passkeys/ | Session | |
| PATCH | /api/v1/auth/passkeys/ | Session | |
| POST | /api/v1/auth/passkey-login/begin | Public | |
| POST | /api/v1/auth/passkey-login/finish | Public |
Apps CRUD / Lifecycle / Deploy
171 endpoints for app management, deployment, lifecycle control, and diagnostics
171 endpoints for app management, deployment, lifecycle control, and diagnostics
Endpoints for:
- Application creation, retrieval, update, and deletion
- Deployment triggers and history
- Application control (restart, stop, start)
- Logs, metrics, and diagnostics
- Build operations and deployment comparisons
- Image and network information
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/apps | AbilityRead | handleListApps |
| POST | /api/v1/apps | AbilityWrite | handleCreateApp |
| GET | /api/v1/apps/ | AbilityRead | handleGetApp |
| PUT | /api/v1/apps/ | AbilityWrite | handleUpdateApp |
| DELETE | /api/v1/apps/ | AbilityWrite | handleDeleteApp |
| GET | /api/v1/apps//health | AbilityRead | handleGetAppHealth |
| PUT | /api/v1/apps//health | AbilityWrite | handleSetAppHealth |
| DELETE | /api/v1/apps//health | AbilityWrite | handleClearAppHealth |
| GET | /api/v1/apps//group | AbilityRead | handleGetAppGroup |
| GET | /api/v1/apps//hook-runs | AbilityRead | handleGetAppHookRuns |
| POST | /api/v1/apps//compose | AbilityDeploy | handleDeployCompose |
| GET | /api/v1/service-templates | AbilityRead | handleListServiceTemplates |
| GET | /api/v1/service-templates/ | AbilityRead | handleGetServiceTemplate |
| POST | /api/v1/apps//clone | AbilityWrite | handleCloneApp |
| PUT | /api/v1/apps//node | AbilityRoot | handleSetAppNode |
| POST | /api/v1/apps//deploys | AbilityDeploy | handleTriggerDeploy |
| GET | /api/v1/apps//deploys | AbilityRead | handleDeployHistory |
| POST | /api/v1/apps//restart | AbilityDeploy | handleRestartApp |
| POST | /api/v1/apps//stop | AbilityDeploy | handleStopApp |
| POST | /api/v1/apps//start | AbilityDeploy | handleStartApp |
| POST | /api/v1/apps//exec | AbilityRoot | handleExecApp |
| GET | /api/v1/apps//terminal | AbilityRoot | handleAppTerminal |
| GET | /api/v1/apps//deploy-attempts | AbilityRead | handleListDeployAttempts |
| GET | /api/v1/deploys/failed | AbilityRead | handleListFailedDeploys |
| GET | /api/v1/apps//deploys/compare | AbilityRead | handleCompareDeploys |
| GET | /api/v1/apps//promote/preview | AbilityRead | handlePromotePreview |
| POST | /api/v1/apps//promote | AbilityDeploy | handlePromoteApp |
| GET | /api/v1/apps//deploys//logs | AbilityRead | handleDeployLogStream |
| GET | /api/v1/apps//deploys//logs/download | AbilityRead | handleDownloadDeployLog |
| GET | /api/v1/apps//diagnose | AbilityRead | handleDiagnoseApp |
| GET | /api/v1/apps//resource-recommendation | AbilityRead | handleAppResourceRecommendation |
| POST | /api/v1/apps//builds | AbilityDeploy | handleTriggerBuild |
| POST | /api/v1/apps//deploy-spec | AbilityDeploy | handleDeploySpec |
| POST | /api/v1/git/branches | AbilityDeploy | handleListGitBranches |
| GET | /api/v1/apps//images | AbilityRead | handleListImages |
| GET | /api/v1/apps//network | AbilityRead | handleGetAppNetwork |
| POST | /api/v1/apps//move-with-volumes | AbilityRoot | handleMoveAppWithVolumes |
| GET | /api/v1/apps//moves | AbilityRead | handleListAppVolumeMoves |
| GET | /api/v1/apps//moves/ | AbilityRead | handleGetAppVolumeMove |
| GET | /api/v1/apps//auto-rollback | AbilityRead | handleGetAutoRollback |
| PUT | /api/v1/apps//auto-rollback | AbilityDeploy | handleSetAutoRollback |
| GET | /api/v1/apps//auto-rollback-slo-burn | AbilityRead | handleGetAutoRollbackSLOBurn |
| PUT | /api/v1/apps//auto-rollback-slo-burn | AbilityDeploy | handleSetAutoRollbackSLOBurn |
| GET | /api/v1/apps//exec-access | AbilityRead | handleGetExecAccess |
| PUT | /api/v1/apps//exec-access | AbilityRoot | handleSetExecAccess |
| GET | /api/v1/apps//deploys//steps | AbilityRead | handleDeployStepStream |
| GET | /api/v1/apps//tags | AbilityRead | handleListAppTags |
| POST | /api/v1/apps//tags | AbilityWrite | handleAttachAppTag |
| DELETE | /api/v1/apps//tags/ | AbilityWrite | handleDetachAppTag |
| GET | /api/v1/apps//integrations | AbilityRead | handleListAppIntegrations |
| POST | /api/v1/apps//integrations | AbilityWriteSensitive | handleAttachAppIntegration |
| DELETE | /api/v1/apps//integrations/ | AbilityWriteSensitive | handleDetachAppIntegration |
| GET | /api/v1/apps//egress-policy | AbilityRead | handleGetAppEgressPolicy |
| PUT | /api/v1/apps//egress-policy | AbilityWriteSensitive | handleSetAppEgressPolicy |
| DELETE | /api/v1/apps//egress-policy | AbilityWriteSensitive | handleClearAppEgressPolicy |
| GET | /api/v1/apps//pipelines | AbilityRead | handleListPipelines |
| POST | /api/v1/apps//pipelines | AbilityWrite | handleCreatePipeline |
| GET | /api/v1/apps//pipelines/ | AbilityRead | handleGetPipeline |
| PUT | /api/v1/apps//pipelines/ | AbilityWrite | handleUpdatePipeline |
| DELETE | /api/v1/apps//pipelines/ | AbilityWrite | handleDeletePipeline |
| POST | /api/v1/apps//pipelines//runs | AbilityDeploy | handleStartPipelineRun |
| GET | /api/v1/apps//pipeline-runs | AbilityRead | handleListPipelineRuns |
| GET | /api/v1/apps//pipeline-runs/ | AbilityRead | handleGetPipelineRun |
| GET | /api/v1/apps//pipeline-runs//logs | AbilityRead | handleListPipelineRunLogs |
| GET | /api/v1/apps//pipeline-runs//logs/stream | AbilityRead | handleStreamPipelineRunLogs |
| POST | /api/v1/apps//pipeline-runs//cancel | AbilityDeploy | handleCancelPipelineRun |
| POST | /api/v1/apps//pipeline-runs//rerun | AbilityDeploy | handleRerunPipelineRun |
| POST | /api/v1/apps//pipeline-runs//approvals/ | AbilityDeploy | handleDecidePipelineApproval |
| GET | /api/v1/apps//loadbalancer | AbilityRead | handleGetLoadBalancer |
| PUT | /api/v1/apps//loadbalancer | AbilityWrite | handleSetLoadBalancer |
| DELETE | /api/v1/apps//loadbalancer | AbilityWrite | handleDeleteLoadBalancer |
| POST | /api/v1/apps//loadbalancer/import | AbilityWrite | handleImportLoadBalancer |
| GET | /api/v1/apps//loadbalancer/status | AbilityRead | handleLoadBalancerStatus |
| GET | /api/v1/apps//loadbalancer/export | AbilityRead | handleExportLoadBalancer |
| POST | /api/v1/apps//pipeline-runs//hold | AbilityDeploy | handleDecidePipelineRunHold |
| GET | /api/v1/apps//pipeline-triggers | AbilityRead | handleListPipelineTriggers |
| GET | /api/v1/apps//pipeline-sync | AbilityRead | handleGetPipelineSync |
| PUT | /api/v1/apps//pipeline-sync | AbilityWrite | handleSetPipelineSync |
| POST | /api/v1/apps//pipeline-sync | AbilityWrite | handleRunPipelineSync |
| GET | /api/v1/apps//alert-history | AbilityRead | handleListAppAlertHistory |
| POST | /api/v1/apps/bulk | AbilityWrite | handleBulkApps |
| GET | /api/v1/apps//clone/preview | AbilityRead | handleClonePreview |
| GET | /api/v1/apps//deploy-freeze | AbilityRead | handleGetAppDeployFreeze |
| PUT | /api/v1/apps//deploy-freeze | AbilityDeploy | handlePutAppDeployFreeze |
| POST | /api/v1/apps//preflight | AbilityRead | handlePreflightApp |
| GET | /api/v1/apps//requests | AbilityRead | handleQueryRequests |
| GET | /api/v1/apps//loadbalancer/history | AbilityRead | handleLoadBalancerHistory |
| POST | /api/v1/apps//loadbalancer/check | AbilityWrite | handleLoadBalancerCheck |
| PUT | /api/v1/apps//loadbalancer/upstreams/ | AbilityWrite | handleSetLoadBalancerUpstream |
| GET | /api/v1/apps//timeline | AbilityRead | handleAppTimeline |
| GET | /api/v1/apps//pending-changes | AbilityRead | handlePendingChanges |
| POST | /api/v1/apps//apply-pending | AbilityDeploy | handleApplyPending |
| GET | /api/v1/apps//preview | AbilityRead | handleGetPreview |
| PUT | /api/v1/apps//preview | AbilityWrite | handlePutPreview |
| POST | /api/v1/apps//preview/capture | AbilityWrite | handleCapturePreview |
| POST | /api/v1/apps//preview/prune | AbilityWrite | handlePrunePreview |
| GET | /api/v1/apps//preview/history | AbilityRead | handleListPreviews |
| GET | /api/v1/apps//deployments//preview | AbilityRead | handleGetPreviewImage |
| GET | /api/v1/apps//changes | AbilityRead | handleAppChanges |
| GET | /api/v1/apps//slo-preview | AbilityRead | handleSLOPreview |
| GET | /api/v1/apps//supply-chain | AbilityRead | handleGetSupplyChain |
| PUT | /api/v1/apps//supply-chain | AbilityWrite | handlePutSupplyChain |
| POST | /api/v1/apps//supply-chain/override | AbilityWrite | handleSupplyChainOverride |
| GET | /api/v1/apps//deployments//sbom | AbilityRead | handleGetSBOM |
| GET | /api/v1/apps//deployments//vulnerabilities | AbilityRead | handleGetVulnerabilities |
| POST | /api/v1/apps//deployments//scan | AbilityWrite | handleScanDeployment |
| POST | /api/v1/apps//deploys//cancel | AbilityDeploy | handleCancelDeploy |
| POST | /api/v1/apps//deploys//rollback | AbilityDeploy | handleRollbackToDeploy |
| GET | /api/v1/apps//cancel-superseded | AbilityRead | handleGetCancelSuperseded |
| PUT | /api/v1/apps//cancel-superseded | AbilityDeploy | handleSetCancelSuperseded |
| GET | /api/v1/apps//preview-policy | AbilityRead | handleGetPreviewPolicy |
| PUT | /api/v1/apps//preview-policy | AbilityWriteSensitive | handleSetPreviewPolicy |
| GET | /api/v1/apps//deploys/ | AbilityRead | handleGetDeploy |
| GET | /api/v1/apps//schedule | AbilityRead | handleGetAppSchedule |
| PUT | /api/v1/apps//schedule | AbilityWriteSensitive | handleSetAppSchedule |
| GET | /api/v1/apps//schedule/history | AbilityRead | handleListAppScheduleHistory |
| POST | /api/v1/service-templates//deploy | AbilityDeploy | handleDeployServiceTemplateNow |
| GET | /api/v1/apps//connections | AbilityRead | handleListAppConnections |
| POST | /api/v1/apps//connections | AbilityWrite | handleCreateAppConnection |
| DELETE | /api/v1/apps//connections/ | AbilityWrite | handleDeleteAppConnection |
| GET | /api/v1/apps//connectable-databases | AbilityRead | handleListConnectableDatabases |
| POST | /api/v1/apps//validate-spec | AbilityRead | handleValidateSpec |
| GET | /api/v1/apps//health-score | AbilityRead | handleGetAppHealthScore |
| POST | /api/v1/apps//save-as-template | AbilityWrite | handleSaveAppAsTemplate |
| GET | /api/v1/apps//cost-estimate | AbilityRead | handleAppCostEstimate |
| GET | /api/v1/apps//badge | AbilityRead | handleGetBadgeSettings |
| PUT | /api/v1/apps//badge | AbilityRoot | handleSetBadgeSettings |
| GET | /api/v1/apps//badge.svg | Public | handlePublicAppBadge |
| GET | /api/v1/apps//deploys//probes | AbilityRead | handleListProbeAttempts |
| POST | /api/v1/apps//health/discover | AbilityRead | handleDiscoverAppHealth |
| GET | /api/v1/apps//streams | AbilityRead | handleListAppStreams |
| POST | /api/v1/apps//streams | AbilityWriteSensitive | handleCreateAppStream |
| DELETE | /api/v1/apps//streams/ | AbilityWriteSensitive | handleDeleteAppStream |
| GET | /api/v1/apps/git-sources | AbilityRead | handleListGitSources |
| GET | /api/v1/apps//auto-update | AbilityRead | handleGetImageAutoUpdate |
| PUT | /api/v1/apps//auto-update | AbilityDeploy | handleSetImageAutoUpdate |
| POST | /api/v1/apps//auto-update/check | AbilityDeploy | handleCheckImageAutoUpdate |
| POST | /api/v1/apps//auto-update/webhook | AbilityWriteSensitive | handleRotateImageUpdateWebhook |
| GET | /api/v1/apps//canary | AbilityRead | handleGetCanary |
| POST | /api/v1/apps//canary | AbilityDeploy | handleStartCanary |
| PUT | /api/v1/apps//canary | AbilityDeploy | handleSetCanaryWeight |
| DELETE | /api/v1/apps//canary | AbilityDeploy | handleAbortCanary |
| POST | /api/v1/apps//canary/promote | AbilityDeploy | handlePromoteCanary |
| GET | /api/v1/apps//sleep | AbilityRead | handleGetAppSleep |
| PUT | /api/v1/apps//sleep | AbilityDeploy | handleSetAppSleep |
| POST | /api/v1/apps//sleep/wake | AbilityDeploy | handleWakeApp |
| GET | /api/v1/apps//environment-domains | AbilityRead | handleGetAppEnvironmentDomains |
| GET | /api/v1/apps//listening-ports | AbilityRead | handleAppListeningPorts |
| GET | /api/v1/apps//compose | AbilityRead | handleGetComposeStack |
| GET | /api/v1/apps//compose/revisions | AbilityRead | handleListComposeRevisions |
| GET | /api/v1/apps//compose/revisions/ | AbilityRead | handleGetComposeRevision |
| POST | /api/v1/apps//compose/rollback | AbilityDeploy | handleRollbackCompose |
| POST | /api/v1/apps//compose/redeploy | AbilityDeploy | handleRedeployCompose |
| POST | /api/v1/service-templates//install | AbilityDeploy | handleInstallServiceTemplate |
| DELETE | /api/v1/apps//compose | AbilityWrite | handleComposeDown |
| POST | /api/v1/apps//move | AbilityRoot | handleStartMove |
| GET | /api/v1/apps//placement | AbilityRead | handleGetPlacement |
| PUT | /api/v1/apps//placement | AbilityRoot | handleSetPlacement |
| GET | /api/v1/apps//investigate | AbilityRead | handleInvestigate |
| GET | /api/v1/apps//failure-context | AbilityRead | handleFailureContext |
| GET | /api/v1/apps//deploys//gate | AbilityRead | handleGetDeployGate |
| GET | /api/v1/apps//deploy-safety | AbilityRead | handleGetDeploySafety |
| PUT | /api/v1/apps//deploy-safety | AbilityDeploy | handlePutDeploySafety |
| GET | /api/v1/apps//rollback-targets | AbilityRead | handleListRollbackTargets |
| GET | /api/v1/apps//job-runs | AbilityRead | handleListScheduledTaskRuns |
| POST | /api/v1/apps//env/reveal | AbilityReadSensitive | handleRevealEnv |
| POST | /api/v1/apps//env/export | AbilityReadSensitive | handleExportEnvRevealed |
| GET | /api/v1/apps//env/export | AbilityRead | handleExportEnvRedacted |
| GET | /api/v1/apps//env/settings | AbilityRead | handleGetEnvSettings |
| PUT | /api/v1/apps//env/settings | AbilityWriteSensitive | handlePutEnvSettings |
| POST | /api/v1/apps//env//convert-to-secret | AbilityWriteSensitive | handleConvertEnvToSecret |
PUT /api/v1/apps/{name}/health replaces only the app’s health config (the body is a ServiceHealth: readiness, liveness, ready_timeout), leaving every other field alone; an empty body clears it. Probe fields and validation match the app spec, with durations in nanoseconds.
Secrets / Git Source / Webhooks / Preview Environments
Endpoints for:- Encrypted secrets management and locking
- Git repository connections and configuration
- Webhook delivery history and replay
- Preview environment configuration and lifecycle
| Method | Path | Ability | Handler |
|---|---|---|---|
| PUT | /api/v1/apps//secrets/ | AbilityWriteSensitive | handleSetSecret |
| GET | /api/v1/apps//secrets | AbilityRead | handleListSecrets |
| POST | /api/v1/apps//secrets//lock | AbilityWriteSensitive | handleSetSecretLock |
| GET | /api/v1/apps//git-source | AbilityRead | handleGetGitSource |
| PUT | /api/v1/apps//git-source | AbilityWriteSensitive | handleSetGitSource |
| DELETE | /api/v1/apps//git-source | AbilityWriteSensitive | handleDeleteGitSource |
| POST | /api/v1/webhooks/github/ | Public | handleGitPushWebhook |
| GET | /api/v1/apps//webhook-deliveries | AbilityRead | handleListWebhookDeliveries |
| POST | /api/v1/apps//webhook-deliveries//replay | AbilityDeploy | handleReplayWebhookDelivery |
| PUT | /api/v1/apps//preview-settings | AbilityWriteSensitive | handleSetPreviewEnabled |
| GET | /api/v1/apps//previews | AbilityRead | handleListPreviewEnvironments |
| POST | /api/v1/apps//previews//teardown | AbilityDeploy | handleTeardownPreviewEnvironment |
| POST | /api/v1/previews/sweep | AbilityDeploy | handleSweepPreviewEnvironments |
| DELETE | /api/v1/apps//secrets/ | AbilityWriteSensitive | handleDeleteSecret |
| PUT | /api/v1/apps//git-source/deploy-settings | AbilityWriteSensitive | handleSetGitDeploySettings |
| GET | /api/v1/previews | AbilityRead | handleListAllPreviews |
| POST | /api/v1/apps//previews//approve | AbilityWriteSensitive | handleApprovePreviewEnvironment |
| POST | /api/v1/apps//git-source/rotate-webhook-secret | AbilityWriteSensitive | handleRotateGitSourceWebhookSecret |
| POST | /api/v1/webhooks/slack/interactions | Public | handleSlackInteraction |
| POST | /api/v1/webhooks/discord/interactions | Public | handleDiscordInteraction |
| PUT | /api/v1/apps//git-source/build | AbilityWriteSensitive | handleSetGitSourceBuild |
| POST | /api/v1/apps//git-source/detect | AbilityDeploy | handleDetectGitSourceBuild |
| POST | /api/v1/apps//previews//extend | AbilityDeploy | handleExtendPreviewEnvironment |
| GET | /api/v1/apps//git-source/commits | AbilityDeploy | handleListGitSourceCommits |
| POST | /api/v1/apps//secrets//reveal | AbilityReadSensitive | handleRevealSecret |
Telemetry
Endpoints for:- Metrics queries with filtering and aggregation
- Log retrieval, search, and live streaming
- Resource usage ranking and monitoring
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/apps//metrics | AbilityRead | handleQueryMetrics |
| GET | /api/v1/apps//logs | AbilityRead | handleQueryLogs |
| GET | /api/v1/apps/resource-usage | AbilityRead | handleAppResourceUsage |
| GET | /api/v1/apps//logs/stream | AbilityRead | handleLiveLogStream |
| GET | /api/v1/apps//logs/download | AbilityRead | handleDownloadLogs |
| GET | /api/v1/apps//logs/signatures | AbilityRead | handleLogSignatures |
Alerts / Scheduled Tasks / Feature Flags / Notification Channels
Endpoints for:- Alert rule creation and management
- Scheduled task configuration and execution
- Feature flag configuration and evaluation
- Notification channel management and delivery tracking
| Method | Path | Ability | Handler |
|---|---|---|---|
| POST | /api/v1/apps//alerts | AbilityWrite | handleCreateAlertRule |
| GET | /api/v1/apps//alerts | AbilityRead | handleListAlertRules |
| PUT | /api/v1/apps//alerts/ | AbilityWrite | handleUpdateAlertRule |
| DELETE | /api/v1/apps//alerts/ | AbilityWrite | handleDeleteAlertRule |
| POST | /api/v1/apps//flags | AbilityWrite | handleCreateFeatureFlag |
| GET | /api/v1/apps//flags | AbilityRead | handleListFeatureFlags |
| GET | /api/v1/apps//flags/ | AbilityRead | handleGetFeatureFlag |
| PUT | /api/v1/apps//flags/ | AbilityWrite | handleUpdateFeatureFlag |
| DELETE | /api/v1/apps//flags/ | AbilityWrite | handleDeleteFeatureFlag |
| GET | /api/v1/flags/evaluate/ | AbilityRead | handleEvaluateFeatureFlag |
| POST | /api/v1/apps//deploy-notify-targets | AbilityWrite | handleCreateDeployNotifyTarget |
| GET | /api/v1/apps//deploy-notify-targets | AbilityRead | handleListDeployNotifyTargets |
| DELETE | /api/v1/apps//deploy-notify-targets/ | AbilityWrite | handleDeleteDeployNotifyTarget |
| GET | /api/v1/notification-channels | AbilityRead | handleListNotificationChannels |
| POST | /api/v1/notification-channels | AbilityWrite | handleCreateNotificationChannel |
| PUT | /api/v1/notification-channels/ | AbilityWrite | handleUpdateNotificationChannel |
| DELETE | /api/v1/notification-channels/ | AbilityWrite | handleDeleteNotificationChannel |
| POST | /api/v1/notification-channels/test | AbilityWrite | handleTestNotificationChannel |
| POST | /api/v1/notification-channels//test | AbilityWrite | handleTestExistingNotificationChannel |
| GET | /api/v1/notification-channels//deliveries | AbilityRead | handleListNotificationDeliveries |
| POST | /api/v1/prometheus/read | AbilityRead | handlePrometheusRead |
| POST | /api/v1/apps//alerts//silence | AbilityWrite | handleSilenceAlertRule |
Databases CRUD / Engines / Resources
Endpoints for:- Database creation, retrieval, and deletion
- Engine registry and telemetry
- Resource recommendations and node placement
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/database-engines | AbilityRead | handleListDatabaseEngines |
| GET | /api/v1/databases | AbilityRead | handleListDatabases |
| POST | /api/v1/databases | AbilityWrite | handleCreateDatabase |
| GET | /api/v1/databases/ | AbilityRead | handleGetDatabase |
| DELETE | /api/v1/databases/ | AbilityWrite | handleDeleteDatabase |
| GET | /api/v1/databases//status | AbilityRead | handleDatabaseStatus |
| GET | /api/v1/databases//metrics | AbilityRead | handleQueryDatabaseMetrics |
| GET | /api/v1/databases//logs | AbilityRead | handleQueryDatabaseLogs |
| GET | /api/v1/databases//logs/stream | AbilityRead | handleLiveDatabaseLogStream |
| GET | /api/v1/databases//resource-recommendation | AbilityRead | handleDatabaseResourceRecommendation |
| PUT | /api/v1/databases//node | AbilityRoot | handleSetDatabaseNode |
| GET | /api/v1/databases//slow-queries | AbilityRead | handleQueryDatabaseSlowQueries |
| POST | /api/v1/databases//pitr | AbilityWriteSensitive | handleEnablePITR |
| DELETE | /api/v1/databases//pitr | AbilityWriteSensitive | handleDisablePITR |
| GET | /api/v1/databases//pitr | AbilityRead | handleGetPITRStatus |
| POST | /api/v1/databases//base-backups | AbilityWriteSensitive | handleTriggerBaseBackup |
| GET | /api/v1/databases//base-backups | AbilityRead | handleListBaseBackupHistory |
| POST | /api/v1/databases//pitr-restore | AbilityRoot | handleTriggerPITRRestore |
| GET | /api/v1/databases//pitr-restores | AbilityRead | handleListPITRRestoreHistory |
| PUT | /api/v1/databases//version | AbilityWriteSensitive | handleSetDatabaseVersion |
| POST | /api/v1/databases//major-upgrade | AbilityRoot | handleMajorUpgrade |
| GET | /api/v1/databases//major-upgrades | AbilityRead | handleListMajorUpgrades |
| POST | /api/v1/databases//major-upgrades//rollback | AbilityRoot | handleRollbackMajorUpgrade |
| DELETE | /api/v1/databases//major-upgrades//snapshot | AbilityRoot | handleDiscardMajorUpgradeSnapshot |
| PUT | /api/v1/databases//environment | AbilityWrite | handleSetDatabaseEnvironment |
| GET | /api/v1/databases//schema | AbilityReadSensitive | handleGetDatabaseSchema |
| GET | /api/v1/databases//tables///rows | AbilityReadSensitive | handleGetDatabaseTableRows |
| POST | /api/v1/databases//query | AbilityReadSensitive | handleDatabaseQuery |
| POST | /api/v1/databases//query/write | AbilityRoot | handleDatabaseQueryWrite |
| POST | /api/v1/databases//explain | AbilityReadSensitive | handleDatabaseExplain |
| GET | /api/v1/databases//keys | AbilityReadSensitive | handleScanDatabaseKeys |
| GET | /api/v1/databases//key | AbilityReadSensitive | handleGetDatabaseKey |
| GET | /api/v1/databases//query-history | AbilityReadSensitive | handleListDatabaseQueryHistory |
| DELETE | /api/v1/databases//query-history | AbilityReadSensitive | handleClearDatabaseQueryHistory |
| GET | /api/v1/databases//saved-queries | AbilityReadSensitive | handleListDatabaseSavedQueries |
| POST | /api/v1/databases//saved-queries | AbilityReadSensitive | handleSaveDatabaseQuery |
| DELETE | /api/v1/databases//saved-queries/ | AbilityReadSensitive | handleDeleteDatabaseSavedQuery |
| GET | /api/v1/databases//users | AbilityReadSensitive | handleListDatabaseUsers |
| POST | /api/v1/databases//users | AbilityRoot | handleCreateDatabaseUser |
| POST | /api/v1/databases//users//rotate | AbilityRoot | handleRotateDatabaseUser |
| POST | /api/v1/databases//users//disable | AbilityRoot | handleDisableDatabaseUser |
| POST | /api/v1/databases//users//enable | AbilityRoot | handleEnableDatabaseUser |
| DELETE | /api/v1/databases//users/ | AbilityRoot | handleDeleteDatabaseUser |
| GET | /api/v1/databases//access/temp | AbilityReadSensitive | handleListDatabaseTempCredentials |
| POST | /api/v1/databases//access/temp | AbilityRoot | handleIssueDatabaseTempCredential |
| DELETE | /api/v1/databases//access/temp/ | AbilityRoot | handleRevokeDatabaseTempCredential |
| GET | /api/v1/databases//access/principals | AbilityReadSensitive | handleDatabaseWhoCanAccess |
| POST | /api/v1/databases//access/grants | AbilityRoot | handleGrantDatabaseAccess |
| DELETE | /api/v1/databases//access/grants/// | AbilityRoot | handleRevokeDatabaseGrant |
| GET | /api/v1/databases//network | AbilityRead | handleGetDatabaseNetwork |
| POST | /api/v1/databases//network/rules/preview | AbilityRoot | handlePreviewDatabaseRules |
| PUT | /api/v1/databases//network/rules | AbilityRoot | handleApplyDatabaseRules |
| DELETE | /api/v1/databases//network/rules | AbilityRoot | handleRemoveDatabaseRules |
| POST | /api/v1/databases//network/make-private | AbilityRoot | handleMakeDatabasePrivate |
| PUT | /api/v1/databases//network/scope | AbilityRoot | handleSetDatabaseScope |
| PUT | /api/v1/databases//network/tls | AbilityRoot | handleSetDatabaseTLS |
| GET | /api/v1/databases//tables///structure | AbilityReadSensitive | handleGetDatabaseTableStructure |
| GET | /api/v1/databases/upgrade-summary | AbilityRead | handleDatabaseUpgradeSummary |
| GET | /api/v1/databases//upgrades | AbilityRead | handleGetDatabaseUpgrades |
| PUT | /api/v1/databases//upgrade-policy | AbilityWriteSensitive | handlePutDatabaseUpgradePolicy |
| POST | /api/v1/databases//upgrade-now | AbilityWriteSensitive | handleDatabaseUpgradeNow |
| POST | /api/v1/databases//move | AbilityRoot | handleStartMove |
| GET | /api/v1/databases//placement | AbilityRead | handleGetPlacement |
| PUT | /api/v1/databases//placement | AbilityRoot | handleSetPlacement |
Projects / Organizations / Environments
Endpoints for:- Project and organization management
- Environment definitions and configuration
- Environment variable and configuration inheritance
- Bulk lifecycle operations (restart, stop, start)
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/projects | AbilityRead | handleListProjects |
| POST | /api/v1/projects | AbilityWrite | handleCreateProject |
| GET | /api/v1/projects/ | AbilityRead | handleGetProject |
| DELETE | /api/v1/projects/ | AbilityWrite | handleDeleteProject |
| POST | /api/v1/projects//restart | AbilityDeploy | handleRestartProject |
| POST | /api/v1/projects//stop | AbilityDeploy | handleStopProject |
| POST | /api/v1/projects//start | AbilityDeploy | handleStartProject |
| GET | /api/v1/organizations | AbilityRead | handleListOrganizations |
| POST | /api/v1/organizations | AbilityWrite | handleCreateOrganization |
| GET | /api/v1/organizations/ | AbilityRead | handleGetOrganization |
| DELETE | /api/v1/organizations/ | AbilityWrite | handleDeleteOrganization |
| PUT | /api/v1/projects//organization | AbilityWrite | handleSetProjectOrganization |
| GET | /api/v1/organizations//env | AbilityRead | handleGetOrganizationEnv |
| PUT | /api/v1/organizations//env | AbilityWrite | handleSetOrganizationEnv |
| GET | /api/v1/projects//environments | AbilityRead | handleListEnvironments |
| POST | /api/v1/projects//environments | AbilityWrite | handleCreateEnvironment |
| PATCH | /api/v1/environments/ | AbilityWrite | handleUpdateEnvironment |
| DELETE | /api/v1/environments/ | AbilityWrite | handleDeleteEnvironment |
| PUT | /api/v1/apps//environment | AbilityWrite | handleSetAppEnvironment |
| GET | /api/v1/environments//clone/preview | AbilityRead | handleEnvironmentClonePreview |
| POST | /api/v1/environments//clone | AbilityDeploy | handleEnvironmentClone |
| GET | /api/v1/environments//env | AbilityRead | handleGetEnvironmentEnv |
| PUT | /api/v1/environments//env | AbilityWrite | handleSetEnvironmentEnv |
| GET | /api/v1/projects//env | AbilityRead | handleGetProjectEnv |
| PUT | /api/v1/projects//env | AbilityWrite | handleSetProjectEnv |
| PUT | /api/v1/apps//project | AbilityWrite | handleSetAppProject |
| PUT | /api/v1/databases//project | AbilityWrite | handleSetDatabaseProject |
| PUT | /api/v1/databases//resources | AbilityWrite | handleSetDatabaseResources |
| GET | /api/v1/organizations//env/all | AbilityRead | handleListOrganizationEnvAll |
| GET | /api/v1/organizations//env/secrets | AbilityRead | handleListOrganizationEnvSecretKeys |
| PUT | /api/v1/organizations//env/secrets/ | AbilityWrite | handleSetOrganizationEnvSecret |
| DELETE | /api/v1/organizations//env/secrets/ | AbilityWrite | handleDeleteOrganizationEnvSecret |
| GET | /api/v1/environments//env/all | AbilityRead | handleListEnvironmentEnvAll |
| GET | /api/v1/environments//env/secrets | AbilityRead | handleListEnvironmentEnvSecretKeys |
| PUT | /api/v1/environments//env/secrets/ | AbilityWrite | handleSetEnvironmentEnvSecret |
| DELETE | /api/v1/environments//env/secrets/ | AbilityWrite | handleDeleteEnvironmentEnvSecret |
| GET | /api/v1/projects//env/all | AbilityRead | handleListProjectEnvAll |
| GET | /api/v1/projects//env/secrets | AbilityRead | handleListProjectEnvSecretKeys |
| PUT | /api/v1/projects//env/secrets/ | AbilityWrite | handleSetProjectEnvSecret |
| DELETE | /api/v1/projects//env/secrets/ | AbilityWrite | handleDeleteProjectEnvSecret |
| GET | /api/v1/projects//environments/compare | AbilityRead | handleCompareEnvironmentEnv |
| GET | /api/v1/projects//topology | AbilityRead | handleGetProjectTopology |
| GET | /api/v1/environments | AbilityRead | handleListAllEnvironments |
| POST | /api/v1/environments | AbilityWrite | handleCreateGlobalEnvironment |
Nodes
Endpoints for:- Physical infrastructure management and monitoring
- Node health and status
- Workload assignment and placement
- Cordon, drain, and lifecycle operations
- Node-level metrics and patch status
- Agent certificate re-enrollment and revocation
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/nodes | AbilityRoot | handleListNodes |
| GET | /api/v1/nodes/ | AbilityRoot | handleGetNode |
| DELETE | /api/v1/nodes/ | AbilityRoot | handleDeleteNode |
| PUT | /api/v1/nodes//workloads | AbilityRoot | handleSetNodeWorkloads |
| POST | /api/v1/nodes/join-tokens | AbilityRoot | handleCreateNodeJoinToken |
| GET | /api/v1/nodes//health | AbilityRoot | handleGetNodeHealth |
| POST | /api/v1/nodes//cordon | AbilityRoot | handleCordonNode |
| POST | /api/v1/nodes//uncordon | AbilityRoot | handleUncordonNode |
| POST | /api/v1/nodes//drain | AbilityRoot | handleDrainNode |
| GET | /api/v1/nodes//metrics | AbilityRoot | handleQueryNodeMetrics |
| GET | /api/v1/nodes//patch-status | AbilityRoot | handleGetNodePatchStatus |
| GET | /api/v1/nodes//events | AbilityRoot | handleListNodeEvents |
| GET | /api/v1/nodes//capacity-forecast | AbilityRoot | handleNodeCapacityForecast |
| POST | /api/v1/nodes//reenroll-token | AbilityRoot | handleCreateNodeReenrollToken |
| POST | /api/v1/nodes//revoke-cert | AbilityRoot | handleRevokeNodeCert |
| POST | /api/v1/nodes//mesh/rotate-key | AbilityRoot | handleRotateNodeMeshKey |
| GET | /api/v1/nodes/resource-usage | AbilityRoot | handleFleetResourceUsage |
| POST | /api/v1/nodes/provision | AbilityRoot | handleCreateNodeProvision |
| PUT | /api/v1/nodes//region | AbilityRoot | handleSetNodeRegion |
| POST | /api/v1/nodes/ssh-provision | AbilityRoot | handleCreateSSHNodeProvision |
| POST | /api/v1/nodes//mesh/rejoin | AbilityRoot | handleRejoinNodeMesh |
| GET | /api/v1/nodes//drains | AbilityRoot | handleListNodeDrains |
| GET | /api/v1/nodes//labels | AbilityRoot | handleGetNodeLabels |
| PUT | /api/v1/nodes//labels | AbilityRoot | handleSetNodeLabels |
| POST | /api/v1/nodes/ssh-provision/preflight | AbilityRoot | handleSSHProvisionPreflight |
Ingress / Certificates / Domains / Email / Cloudflare
91 endpoints for TLS, domains, ingress control, and DNS/Vault integrations
91 endpoints for TLS, domains, ingress control, and DNS/Vault integrations
Endpoints for:
- TLS certificate lifecycle and management
- ACME configuration and certificate validation
- Domain routing and DNS configuration
- Domain-level controls (basic auth, maintenance mode, redirects, custom error pages, WAF)
- Email configuration for notifications
- Cloudflare, Route 53, and Vault integrations
- External secret management
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/certificates | AbilityRead | handleListCertificates |
| GET | /api/v1/settings/ingress | AbilityRead | handleGetIngressSettings |
| PUT | /api/v1/settings/ingress | AbilityRoot | handleUpdateIngressSettings |
| GET | /api/v1/settings/ingress/check | AbilityRoot | handleCheckIngressDomain |
| GET | /api/v1/settings/dashboard-url | AbilityRead | handleGetDashboardURL |
| PUT | /api/v1/settings/dashboard-url | AbilityRoot | handleUpdateDashboardURL |
| GET | /api/v1/apps//domains//check | AbilityRead | handleCheckDomain |
| GET | /api/v1/apps//domains//auth | AbilityRead | handleGetDomainBasicAuth |
| PUT | /api/v1/apps//domains//auth | AbilityRoot | handleSetDomainBasicAuth |
| DELETE | /api/v1/apps//domains//auth | AbilityRoot | handleClearDomainBasicAuth |
| GET | /api/v1/apps//domains//maintenance | AbilityRead | handleGetDomainMaintenance |
| PUT | /api/v1/apps//domains//maintenance | AbilityDeploy | handleSetDomainMaintenance |
| DELETE | /api/v1/apps//domains//maintenance | AbilityDeploy | handleClearDomainMaintenance |
| GET | /api/v1/apps//domains//redirect | AbilityRead | handleGetDomainRedirect |
| PUT | /api/v1/apps//domains//redirect | AbilityDeploy | handleSetDomainRedirect |
| DELETE | /api/v1/apps//domains//redirect | AbilityDeploy | handleClearDomainRedirect |
| GET | /api/v1/apps//domains//tls-cert | AbilityRead | handleGetDomainTLSCert |
| PUT | /api/v1/apps//domains//tls-cert | AbilityRoot | handleSetDomainTLSCert |
| DELETE | /api/v1/apps//domains//tls-cert | AbilityRoot | handleClearDomainTLSCert |
| GET | /api/v1/apps//domains//waf | AbilityRead | handleGetDomainWAF |
| PUT | /api/v1/apps//domains//waf | AbilityDeploy | handleSetDomainWAF |
| DELETE | /api/v1/apps//domains//waf | AbilityDeploy | handleClearDomainWAF |
| GET | /api/v1/apps//domains//error-pages | AbilityRead | handleGetDomainErrorPages |
| PUT | /api/v1/apps//domains//error-pages | AbilityDeploy | handleSetDomainErrorPage |
| DELETE | /api/v1/apps//domains//error-pages | AbilityDeploy | handleClearDomainErrorPages |
| GET | /api/v1/settings/email | AbilityRead | handleGetEmailSettings |
| PUT | /api/v1/settings/email | AbilityRoot | handleUpdateEmailSettings |
| GET | /api/v1/settings/cloudflare-tunnel | AbilityRead | handleGetCloudflareTunnelSettings |
| PUT | /api/v1/settings/cloudflare-tunnel | AbilityRoot | handleUpdateCloudflareTunnelSettings |
| DELETE | /api/v1/settings/cloudflare-tunnel | AbilityRoot | handleDisconnectCloudflareTunnel |
| GET | /api/v1/settings/cloudflare-dns | AbilityRead | handleGetCloudflareDNSSettings |
| PUT | /api/v1/settings/cloudflare-dns | AbilityRoot | handleUpdateCloudflareDNSSettings |
| DELETE | /api/v1/settings/cloudflare-dns | AbilityRoot | handleDisconnectCloudflareDNS |
| GET | /api/v1/settings/route53-dns | AbilityRead | handleGetRoute53DNSSettings |
| PUT | /api/v1/settings/route53-dns | AbilityRoot | handleUpdateRoute53DNSSettings |
| DELETE | /api/v1/settings/route53-dns | AbilityRoot | handleDisconnectRoute53DNS |
| GET | /api/v1/settings/vault | AbilityRead | handleGetVaultSettings |
| PUT | /api/v1/settings/vault | AbilityRoot | handleUpdateVaultSettings |
| DELETE | /api/v1/settings/vault | AbilityRoot | handleDisconnectVault |
| PUT | /api/v1/apps//vault-env/ | AbilityWrite | handleSetAppVaultEnv |
| DELETE | /api/v1/apps//vault-env/ | AbilityWrite | handleClearAppVaultEnv |
| PUT | /api/v1/apps//preview-env/ | AbilityWrite | handleSetAppPreviewEnvOverride |
| DELETE | /api/v1/apps//preview-env/ | AbilityWrite | handleClearAppPreviewEnvOverride |
| GET | /api/v1/apps//branch-env | AbilityRead | handleListAppBranchEnv |
| POST | /api/v1/apps//branch-env | AbilityWriteSensitive | handleSetAppBranchEnv |
| DELETE | /api/v1/apps//branch-env/ | AbilityWrite | handleDeleteAppBranchEnv |
| PATCH | /api/v1/apps//domains | AbilityWrite | handleEditAppDomains |
| POST | /api/v1/apps//domains//cert/renew | AbilityRoot | handleRenewDomainCertificate |
| GET | /api/v1/apps//domains//dns-records | AbilityRead | handleListDNSRecords |
| POST | /api/v1/apps//domains//dns-records | AbilityRoot | handleCreateDNSRecord |
| PUT | /api/v1/apps//domains//dns-records | AbilityRoot | handleUpdateDNSRecord |
| DELETE | /api/v1/apps//domains//dns-records | AbilityRoot | handleDeleteDNSRecord |
| POST | /api/v1/settings/email/test | AbilityWrite | handleTestEmail |
| GET | /api/v1/settings/ingress/https | AbilityRead | handleGetHTTPSStatus |
| POST | /api/v1/settings/ingress/https | AbilityRoot | handleEnableHTTPS |
| GET | /api/v1/apps//domains//search-visibility | AbilityRead | handleGetDomainSearchVisibility |
| PUT | /api/v1/apps//domains//search-visibility | AbilityDeploy | handleSetDomainSearchVisibility |
| GET | /api/v1/apps//domains//headers | AbilityRead | handleGetDomainPolicy |
| PUT | /api/v1/apps//domains//headers | AbilityDeploy | handleSetDomainPolicy |
| DELETE | /api/v1/apps//domains//headers | AbilityDeploy | handleDeleteDomainPolicy |
| GET | /api/v1/apps//domains//forwarders | AbilityRead | handleGetDomainPolicy |
| PUT | /api/v1/apps//domains//forwarders | AbilityDeploy | handleSetDomainPolicy |
| DELETE | /api/v1/apps//domains//forwarders | AbilityDeploy | handleDeleteDomainPolicy |
| GET | /api/v1/apps//domains//geo | AbilityRead | handleGetDomainPolicy |
| PUT | /api/v1/apps//domains//geo | AbilityDeploy | handleSetDomainPolicy |
| DELETE | /api/v1/apps//domains//geo | AbilityDeploy | handleDeleteDomainPolicy |
| GET | /api/v1/apps//domains//cache | AbilityRead | handleGetDomainPolicy |
| PUT | /api/v1/apps//domains//cache | AbilityDeploy | handleSetDomainPolicy |
| DELETE | /api/v1/apps//domains//cache | AbilityDeploy | handleDeleteDomainPolicy |
| POST | /api/v1/apps//domains//cache/purge | AbilityDeploy | handlePurgeDomainCache |
| GET | /api/v1/apps//domains//cache/stats | AbilityRead | handleGetDomainCacheStats |
| GET | /api/v1/apps//domains//policies | AbilityRead | handleGetDomainPolicies |
| POST | /api/v1/apps//domains//policies/preview | AbilityRead | handlePreviewDomainPolicies |
| GET | /api/v1/apps//domains//redirects | AbilityRead | handleGetDomainRedirects |
| PUT | /api/v1/apps//domains//redirects | AbilityDeploy | handleSetDomainRedirectSettings |
| DELETE | /api/v1/apps//domains//redirects | AbilityDeploy | handleDeleteDomainRedirectSettings |
| POST | /api/v1/apps//domains//redirects/canonical | AbilityDeploy | handleSetDomainCanonical |
| PUT | /api/v1/apps//domains//redirects/aliases | AbilityDeploy | handleSetDomainAliases |
| GET | /api/v1/apps//domains//ports | AbilityRead | handleGetDomainPorts |
| PUT | /api/v1/apps//domains//ports//restrict | AbilityWriteSensitive | handleRestrictDomainPort |
| DELETE | /api/v1/apps//domains//ports//restrict | AbilityWriteSensitive | handleUnrestrictDomainPort |
| GET | /api/v1/apps//domains//go-live | AbilityRead | handleGoLiveStatus |
| POST | /api/v1/apps//domains//go-live | AbilityRoot | handleGoLiveRun |
| POST | /api/v1/apps//domains/go-live/plan | AbilityWrite | handleGoLivePlan |
| POST | /api/v1/settings/ingress/apps-base-domain/backfill | AbilityRoot | handleBackfillBaseDomain |
| POST | /api/v1/apps//domains//doctor | AbilityRead | handleDomainDoctor |
| GET | /api/v1/apps//domains//auth-gate | AbilityRead | handleGetDomainAuthGate |
| PUT | /api/v1/apps//domains//auth-gate | AbilityRoot | handleSetDomainAuthGate |
| DELETE | /api/v1/apps//domains//auth-gate | AbilityRoot | handleClearDomainAuthGate |
| GET | /api/v1/apps//domains//auth-gate/events | AbilityReadSensitive | handleListAuthGateEvents |
| DELETE | /api/v1/apps//domains//auth-gate/sessions | AbilityRoot | handleRevokeAuthGateSessions |
Static Sites / Backup Targets / Registry Credentials
Endpoints for:- Static site configuration and visibility
- S3-compatible backup target management and testing
- External registry credentials for image pull authentication
- Domain enumeration
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/static-sites | AbilityRead | handleListStaticSites |
| GET | /api/v1/backup-targets | AbilityRead | handleListBackupTargets |
| POST | /api/v1/backup-targets | AbilityWriteSensitive | handleCreateBackupTarget |
| GET | /api/v1/backup-targets/ | AbilityRead | handleGetBackupTarget |
| PUT | /api/v1/backup-targets/ | AbilityWriteSensitive | handleUpdateBackupTarget |
| DELETE | /api/v1/backup-targets/ | AbilityWriteSensitive | handleDeleteBackupTarget |
| POST | /api/v1/backup-targets//test | AbilityWriteSensitive | handleTestBackupTarget |
| GET | /api/v1/registry-credentials | AbilityRead | handleListRegistryCredentials |
| POST | /api/v1/registry-credentials | AbilityWriteSensitive | handleCreateRegistryCredential |
| GET | /api/v1/registry-credentials/ | AbilityRead | handleGetRegistryCredential |
| PUT | /api/v1/registry-credentials/ | AbilityWriteSensitive | handleUpdateRegistryCredential |
| DELETE | /api/v1/registry-credentials/ | AbilityWriteSensitive | handleDeleteRegistryCredential |
| POST | /api/v1/registry-credentials//test | AbilityWriteSensitive | handleTestRegistryCredential |
| GET | /api/v1/registry-credentials//repositories | AbilityReadSensitive | handleListRegistryCredentialRepositories |
| GET | /api/v1/registry-credentials//tags | AbilityReadSensitive | handleListRegistryCredentialTags |
| GET | /api/v1/domains | AbilityRead | handleListDomains |
| GET | /api/v1/domains/automation/runs | AbilityRead | handleListAutomationRuns |
| POST | /api/v1/domains/automation/runs//undo | AbilityRoot | handleUndoAutomationRun |
| GET | /api/v1/domains//activity | AbilityRead | handleDomainActivity |
| GET | /api/v1/domains/standalone | AbilityRead | handleListStandaloneDomains |
| POST | /api/v1/domains/standalone | AbilityWriteSensitive | handleCreateStandaloneDomain |
| POST | /api/v1/domains/standalone/validate | AbilityWriteSensitive | handleValidateStandaloneDomain |
| GET | /api/v1/domains/standalone/candidates | AbilityWriteSensitive | handleStandaloneCandidates |
| PUT | /api/v1/domains/standalone/ | AbilityWriteSensitive | handleUpdateStandaloneDomain |
| DELETE | /api/v1/domains/standalone/ | AbilityWriteSensitive | handleDeleteStandaloneDomain |
Built-in Container Registry
Endpoints for:- Registry configuration and management
- Image repository and tag browsing
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/settings/registry | AbilityRead | handleGetRegistrySettings |
| PUT | /api/v1/settings/registry | AbilityRoot | handleUpdateRegistrySettings |
| DELETE | /api/v1/settings/registry | AbilityRoot | handleDisableRegistry |
| GET | /api/v1/registry/repositories | AbilityRead | handleListRegistryRepositories |
| GET | /api/v1/registry/tags | AbilityRead | handleListRegistryTags |
| GET | /api/v1/dockerhub/search | AbilityRead | handleDockerHubSearch |
| GET | /api/v1/dockerhub/repositories///tags | AbilityRead | handleDockerHubTags |
Git Provider Apps
Endpoints for:- GitHub App integration and repository browsing
- GitLab App integration and project browsing
- Bitbucket App integration and repository browsing
- OAuth flow management and provider status
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/git-providers | AbilityReadSensitive | handleListGitProviders |
| GET | /api/v1/github-app | AbilityRoot | handleGetGitHubAppStatus |
| DELETE | /api/v1/github-app | AbilityRoot | handleDisconnectGitHubApp |
| PUT | /api/v1/github-app/manual | AbilityRoot | handleConnectGitHubAppManually |
| GET | /api/v1/github-app/register/preview | AbilityRoot | handleGetGitHubAppManifestPreview |
| GET | /api/v1/github-app/register/start | AbilityRoot | handleStartGitHubAppRegistration |
| GET | /api/v1/github-app/callback | AbilityRoot | handleGitHubAppCallback |
| GET | /api/v1/github-app/installed | AbilityRoot | handleGitHubAppInstalled |
| GET | /api/v1/github-app/repos | AbilityReadSensitive | handleListGitHubAppRepos |
| GET | /api/v1/github-app/repos///branches | AbilityReadSensitive | handleListGitHubAppBranches |
| POST | /api/v1/github-app/repos///use-as-source | AbilityWriteSensitive | handleUseGitHubRepoAsSource |
| GET | /api/v1/gitlab-app | AbilityRoot | handleGetGitLabAppStatus |
| PUT | /api/v1/gitlab-app | AbilityRoot | handleConnectGitLabApp |
| DELETE | /api/v1/gitlab-app | AbilityRoot | handleDisconnectGitLabApp |
| GET | /api/v1/gitlab-app/connect | AbilityRoot | handleStartGitLabAppConnect |
| GET | /api/v1/gitlab-app/callback | AbilityRoot | handleGitLabAppCallback |
| GET | /api/v1/gitlab-app/projects | AbilityReadSensitive | handleListGitLabAppProjects |
| GET | /api/v1/gitlab-app/projects//branches | AbilityReadSensitive | handleListGitLabAppBranches |
| POST | /api/v1/gitlab-app/projects//use-as-source | AbilityWriteSensitive | handleUseGitLabProjectAsSource |
| GET | /api/v1/bitbucket-app | AbilityRoot | handleGetBitbucketAppStatus |
| PUT | /api/v1/bitbucket-app | AbilityRoot | handleConnectBitbucketApp |
| DELETE | /api/v1/bitbucket-app | AbilityRoot | handleDisconnectBitbucketApp |
| GET | /api/v1/bitbucket-app/connect | AbilityRoot | handleStartBitbucketAppConnect |
| GET | /api/v1/bitbucket-app/callback | AbilityRoot | handleBitbucketAppCallback |
| GET | /api/v1/bitbucket-app/repos | AbilityReadSensitive | handleListBitbucketAppRepos |
| GET | /api/v1/bitbucket-app/repos///branches | AbilityReadSensitive | handleListBitbucketAppBranches |
| POST | /api/v1/bitbucket-app/repos///use-as-source | AbilityWriteSensitive | handleUseBitbucketRepoAsSource |
| GET | /api/v1/github-app/installations | AbilityRoot | handleListGitHubAppInstallations |
| DELETE | /api/v1/github-app/installations/ | AbilityRoot | handleDeleteGitHubAppInstallation |
Database Backups / Restore / Clone Restore
Endpoints for:- Backup history and manual triggers
- Backup verification and scheduled retention
- Database control (stop, start, public access)
- Restore and clone-restore operations
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/backups | AbilityRead | handleListAllBackups |
| POST | /api/v1/databases//backups | AbilityWriteSensitive | handleTriggerBackup |
| GET | /api/v1/databases//backups | AbilityRead | handleListBackupHistory |
| GET | /api/v1/databases//backups//download | AbilityReadSensitive | handleDownloadBackup |
| POST | /api/v1/databases//backups//verify | AbilityWriteSensitive | handleVerifyBackup |
| GET | /api/v1/databases//backups//verifications | AbilityRead | handleListBackupVerifications |
| PUT | /api/v1/databases//backup-schedule | AbilityWriteSensitive | handleSetBackupSchedule |
| DELETE | /api/v1/databases//backup-schedule | AbilityWriteSensitive | handleClearBackupSchedule |
| PUT | /api/v1/databases//public-access | AbilityWriteSensitive | handleSetDatabasePublicAccess |
| DELETE | /api/v1/databases//public-access | AbilityWriteSensitive | handleClearDatabasePublicAccess |
| POST | /api/v1/databases//stop | AbilityWriteSensitive | handleStopDatabase |
| POST | /api/v1/databases//start | AbilityWriteSensitive | handleStartDatabase |
| POST | /api/v1/databases//restore | AbilityRoot | handleTriggerRestore |
| GET | /api/v1/databases//restores | AbilityRead | handleListRestoreHistory |
| POST | /api/v1/databases//restore-as-new | AbilityWriteSensitive | handleCloneRestore |
| GET | /api/v1/databases//clone-restores | AbilityRead | handleListCloneRestores |
| DELETE | /api/v1/databases//backups/ | AbilityWriteSensitive | handleDeleteBackup |
| GET | /api/v1/backups/health | AbilityRead | handleBackupHealth |
| GET | /api/v1/backups/drills | AbilityRead | handleListBackupDrills |
| GET | /api/v1/backups/drills/ | AbilityRead | handleGetBackupDrill |
| POST | /api/v1/backups/drills | AbilityWriteSensitive | handleStartBackupDrill |
| POST | /api/v1/backups/protection/refresh | AbilityWriteSensitive | handleRefreshBackupProtection |
| GET | /api/v1/backups/coverage | AbilityRead | handleBackupCoverage |
| POST | /api/v1/backups/protect-all | AbilityWriteSensitive | handleProtectAll |
| POST | /api/v1/backups/encryption-key/ack | AbilityWriteSensitive | handleAckBackupEncryptionKey |
App Volume Backups / Restore
Endpoints for:- Named volume backup history and scheduling
- Backup verification and retention management
- Volume restore operations (in-place and non-destructive clone)
| Method | Path | Ability | Handler |
|---|---|---|---|
| POST | /api/v1/apps//volumes//backups | AbilityWriteSensitive | handleTriggerVolumeBackup |
| GET | /api/v1/apps//volumes//backups | AbilityRead | handleListVolumeBackupHistory |
| GET | /api/v1/apps//volumes//backups//download | AbilityReadSensitive | handleDownloadVolumeBackup |
| POST | /api/v1/apps//volumes//backups//verify | AbilityWriteSensitive | handleVerifyVolumeBackup |
| GET | /api/v1/apps//volumes//backups//verifications | AbilityRead | handleListVolumeBackupVerifications |
| GET | /api/v1/apps//volumes//backup-schedule | AbilityRead | handleGetVolumeBackupSchedule |
| PUT | /api/v1/apps//volumes//backup-schedule | AbilityWriteSensitive | handleSetVolumeBackupSchedule |
| DELETE | /api/v1/apps//volumes//backup-schedule | AbilityWriteSensitive | handleClearVolumeBackupSchedule |
| POST | /api/v1/apps//volumes//restore | AbilityRoot | handleTriggerVolumeRestore |
| GET | /api/v1/apps//volumes//restores | AbilityRead | handleListVolumeRestoreHistory |
| POST | /api/v1/apps//volumes//restore-as-new | AbilityWriteSensitive | handleVolumeCloneRestore |
| GET | /api/v1/apps//volumes//clone-restores | AbilityRead | handleListVolumeCloneRestores |
| DELETE | /api/v1/apps//volumes//backups/ | AbilityWriteSensitive | handleDeleteVolumeBackup |
| PUT | /api/v1/apps//volumes | AbilityWrite | handleSetAppVolumes |
| GET | /api/v1/apps//volumes//backup-policy | AbilityRead | handleGetVolumeBackupPolicy |
| PUT | /api/v1/apps//volumes//backup-policy | AbilityWriteSensitive | handleSetVolumeBackupPolicy |
| POST | /api/v1/apps//volumes//restore-to | AbilityWriteSensitive | handleVolumeRestoreTo |
App Storage / Database Attach
Endpoints for:- Object storage bucket attachment and configuration
- Database connectivity for applications
| Method | Path | Ability | Handler |
|---|---|---|---|
| PUT | /api/v1/apps//storage | AbilityWriteSensitive | handleSetAppStorage |
| DELETE | /api/v1/apps//storage | AbilityWriteSensitive | handleClearAppStorage |
| PUT | /api/v1/apps//database | AbilityWrite | handleSetAppDatabase |
| DELETE | /api/v1/apps//database | AbilityWrite | handleClearAppDatabase |
| GET | /api/v1/storage-env-keys | AbilityRead | handleListStorageEnvKeys |
Audit Log / Log Drain
Endpoints for:- Fleet-wide audit trail and log management
- External log sink configuration per application
| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/audit-log | AbilityRoot | handleListAuditLog |
| POST | /api/v1/audit-log/purge | AbilityRoot | handlePurgeAuditLog |
| GET | /api/v1/apps//log-drain | AbilityRead | handleGetAppLogDrain |
| PUT | /api/v1/apps//log-drain | AbilityWriteSensitive | handleSetAppLogDrain |
| DELETE | /api/v1/apps//log-drain | AbilityWriteSensitive | handleClearAppLogDrain |
| GET | /api/v1/audit-log/export | AbilityRoot | handleExportAuditLog |
GET /api/v1/audit-log accepts optional query params: limit, before (RFC3339 cursor), path, method, client_kind (exact match), q (case-insensitive substring across actor name, ability, method, path and remote address), status=failed (only status_code >= 400), and format=csv. All filters combine with AND and the CSV export honors them.
AI Models / GPUs
AI model resources on GPU nodes and the GPU node snapshots they schedule against. Details: AI models.| Method | Path | Ability | Handler |
|---|---|---|---|
| GET | /api/v1/models | AbilityRead | handleListModels |
| POST | /api/v1/models | AbilityWriteSensitive | handleCreateModel |
| GET | /api/v1/models/ | AbilityRead | handleGetModel |
| DELETE | /api/v1/models/ | AbilityWrite | handleDeleteModel |
| POST | /api/v1/models//restart | AbilityWrite | handleRestartModel |
| POST | /api/v1/models//api-key | AbilityWriteSensitive | handleRotateModelAPIKey |
| PUT | /api/v1/models//hf-token | AbilityWriteSensitive | handleSetModelHFToken |
| GET | /api/v1/models//logs | AbilityRead | handleQueryModelLogs |
| GET | /api/v1/models//logs/stream | AbilityRead | handleLiveModelLogStream |
| GET | /api/v1/gpus | AbilityRead | handleListGPUNodes |
| GET | /api/v1/models//keys | AbilityRead | handleListModelKeys |
| POST | /api/v1/models//keys | AbilityWriteSensitive | handleCreateModelKey |
| DELETE | /api/v1/models//keys/ | AbilityWrite | handleRevokeModelKey |
| POST | /api/v1/models//keys//rotate | AbilityWriteSensitive | handleRotateModelKey |
| GET | /api/v1/models//usage | AbilityRead | handleModelUsage |
| POST | /api/v1/models/preflight | AbilityRead | handleModelPreflight |
| GET | /api/v1/models//engine-metrics | AbilityRead | handleModelEngineMetrics |
| GET | /api/v1/models//fit | AbilityRead | handleModelFit |
| POST | /api/v1/models/fit | AbilityRead | handleModelFitCheck |
| PUT | /api/v1/models//residency | AbilityWrite | handleSetModelResidency |
| POST | /api/v1/models//wake | AbilityWrite | handleWakeModel |
| POST | /api/v1/models//sleep | AbilityWrite | handleSleepModel |
| PUT | /api/v1/models//swap-group | AbilityWrite | handleSetModelSwapGroup |
Other
Routes that do not fit an existing group.| Method | Path | Ability | Handler |
|---|---|---|---|
| POST | /api/v1/build/detect | AbilityDeploy | handleDetectFramework |
| POST | /api/v1/pipelines/validate | AbilityRead | handleValidatePipeline |
| GET | /api/v1/pipelines/schema | AbilityRead | handlePipelineSchema |
| POST | /api/v1/tags | AbilityWrite | handleCreateTag |
| GET | /api/v1/tags | AbilityRead | handleListTags |
| DELETE | /api/v1/tags/ | AbilityWrite | handleDeleteTag |
| GET | /api/v1/tags//apps | AbilityRead | handleListAppsByTag |
| GET | /api/v1/integrations | AbilityRead | handleListIntegrationCatalog |
| GET | /api/v1/deploy-approvals | AbilityRead | handleListDeployApprovals |
| GET | /api/v1/deploy-approvals/ | AbilityRead | handleGetDeployApproval |
| POST | /api/v1/deploy-approvals//approve | AbilityDeploy | handleApproveDeployApproval |
| POST | /api/v1/deploy-approvals//reject | AbilityDeploy | handleRejectDeployApproval |
| GET | /api/v1/mesh | AbilityRoot | handleGetMeshStatus |
| GET | /api/v1/gitea-app | AbilityRoot | handleGetGiteaAppStatus |
| PUT | /api/v1/gitea-app | AbilityRoot | handleConnectGiteaApp |
| DELETE | /api/v1/gitea-app | AbilityRoot | handleDisconnectGiteaApp |
| GET | /api/v1/gitea-app/connect | AbilityRoot | handleStartGiteaAppConnect |
| GET | /api/v1/gitea-app/callback | AbilityRoot | handleGiteaAppCallback |
| GET | /api/v1/gitea-app/repos | AbilityReadSensitive | handleListGiteaAppRepos |
| GET | /api/v1/gitea-app/repos///branches | AbilityReadSensitive | handleListGiteaAppBranches |
| POST | /api/v1/gitea-app/repos///use-as-source | AbilityWriteSensitive | handleUseGiteaRepoAsSource |
| POST | /api/v1/ai/sessions | AbilityRoot | handleCreateAIChatSession |
| GET | /api/v1/ai/sessions | AbilityRoot | handleListAIChatSessions |
| GET | /api/v1/ai/sessions/ | AbilityRoot | handleGetAIChatSession |
| DELETE | /api/v1/ai/sessions/ | AbilityRoot | handleDeleteAIChatSession |
| POST | /api/v1/ai/sessions//messages | AbilityRoot | handleCreateAIChatMessage |
| POST | /api/v1/ai/sessions//confirmations/ | AbilityRoot | handleResolveAIChatConfirmation |
| GET | /api/v1/storage/providers | AbilityRead | handleListStorageProviders |
| GET | /api/v1/storage/destinations | AbilityRead | handleListStorageDestinations |
| POST | /api/v1/storage/destinations | AbilityWriteSensitive | handleCreateStorageDestination |
| GET | /api/v1/storage/destinations/ | AbilityRead | handleGetStorageDestination |
| PUT | /api/v1/storage/destinations/ | AbilityWriteSensitive | handleUpdateStorageDestination |
| DELETE | /api/v1/storage/destinations/ | AbilityWriteSensitive | handleDeleteStorageDestination |
| POST | /api/v1/storage/destinations//test | AbilityWriteSensitive | handleTestStorageDestination |
| GET | /api/v1/log-archive/policies | AbilityRead | handleListLogArchivePolicies |
| PUT | /api/v1/log-archive/policy | AbilityWrite | handleSetLogArchivePolicy |
| DELETE | /api/v1/log-archive/policy | AbilityWrite | handleDeleteLogArchivePolicy |
| POST | /api/v1/log-archive/dump | AbilityWrite | handleLogArchiveDump |
| GET | /api/v1/log-archive/runs | AbilityRead | handleListLogArchiveRuns |
| GET | /api/v1/log-archive/objects | AbilityRead | handleListLogArchiveObjects |
| GET | /api/v1/log-archive/objects/download | AbilityRead | handleDownloadLogArchiveObject |
| GET | /api/v1/build-cache | AbilityRead | handleListBuildCache |
| PUT | /api/v1/build-cache | AbilityWrite | handleSetBuildCache |
| DELETE | /api/v1/build-cache | AbilityWrite | handleDeleteBuildCache |
| GET | /api/v1/build-cache/stats | AbilityRead | handleBuildCacheStats |
| POST | /api/v1/build-cache/clear | AbilityWrite | handleClearBuildCache |
| GET | /api/v1/pipeline-runs | AbilityRead | handleListAllPipelineRuns |
| GET | /api/v1/pipelines/summary | AbilityRead | handleGetPipelineSummary |
| GET | /api/v1/loadbalancers | AbilityRead | handleListLoadBalancers |
| GET | /api/v1/alert-silences | AbilityRead | handleListAlertSilences |
| POST | /api/v1/alert-silences | AbilityWrite | handleCreateAlertSilence |
| DELETE | /api/v1/alert-silences/ | AbilityWrite | handleExpireAlertSilence |
| GET | /api/v1/alert-maintenance-windows | AbilityRead | handleListMaintenanceWindows |
| POST | /api/v1/alert-maintenance-windows | AbilityWrite | handleCreateMaintenanceWindow |
| PUT | /api/v1/alert-maintenance-windows/ | AbilityWrite | handleUpdateMaintenanceWindow |
| DELETE | /api/v1/alert-maintenance-windows/ | AbilityWrite | handleDeleteMaintenanceWindow |
| GET | /api/v1/alert-history | AbilityRead | handleListAlertHistory |
| GET | /public/status | Public | handlePublicStatusHTML |
| GET | /public/status.json | Public | handlePublicStatusJSON |
| GET | /public/status.rss | Public | handlePublicStatusRSS |
| GET | /api/v1/status-page | AbilityRead | handleGetStatusPage |
| PUT | /api/v1/status-page | AbilityWrite | handlePutStatusPage |
| GET | /api/v1/status-page/preview | AbilityRead | handleStatusPagePreview |
| GET | /api/v1/status-page/components | AbilityRead | handleListStatusComponents |
| POST | /api/v1/status-page/components | AbilityWrite | handleCreateStatusComponent |
| PUT | /api/v1/status-page/components/ | AbilityWrite | handleUpdateStatusComponent |
| DELETE | /api/v1/status-page/components/ | AbilityWrite | handleDeleteStatusComponent |
| GET | /api/v1/status-page/incidents | AbilityRead | handleListStatusIncidents |
| POST | /api/v1/status-page/incidents | AbilityWrite | handleCreateStatusIncident |
| POST | /api/v1/status-page/incidents//updates | AbilityWrite | handlePostStatusIncidentUpdate |
| DELETE | /api/v1/status-page/incidents/ | AbilityWrite | handleDeleteStatusIncident |
| GET | /api/v1/apps-summary | AbilityRead | handleAppsSummary |
| POST | /api/v1/preflight | AbilityWrite | handlePreflightNew |
| POST | /api/v1/imports/plan | AbilityWrite | handleImportPlan |
| POST | /api/v1/apply/plan | AbilityRead | handleIaCPlan |
| POST | /api/v1/apply | AbilityWrite | handleIaCApply |
| GET | /api/v1/export | AbilityRead | handleIaCExport |
| GET | /api/v1/apply/schema | AbilityRead | handleIaCSchema |
| POST | /api/v1/imports/platform/discover | AbilityWriteSensitive | handleDiscoverPlatformImport |
| POST | /api/v1/imports/platform/apply | AbilityWriteSensitive | handleApplyPlatformImport |
| GET | /api/v1/deployments | AbilityRead | handleListDeployments |
| GET | /api/v1/deployments/summary | AbilityRead | handleDeploymentsSummary |
| GET | /api/v1/deployments/stream | AbilityRead | handleDeploymentsStream |
| GET | /api/v1/model-cache | AbilityRead | handleListModelCache |
| POST | /api/v1/model-cache/prune | AbilityRoot | handlePruneModelCache |
| POST | /api/v1/pipelines/filters | AbilityRead | handlePipelineFilters |
| GET | /api/v1/apps-metrics | AbilityRead | handleBatchAppMetrics |
| GET | /api/v1/node-providers | AbilityRoot | handleListNodeProviders |
| POST | /api/v1/node-providers | AbilityRoot | handleSetNodeProviderCredential |
| GET | /api/v1/node-providers//regions | AbilityRoot | handleListNodeProviderRegions |
| GET | /api/v1/node-providers//sizes | AbilityRoot | handleListNodeProviderSizes |
| GET | /api/v1/node-provisions | AbilityRoot | handleListNodeProvisions |
| GET | /api/v1/node-provisions/ | AbilityRoot | handleGetNodeProvision |
| GET | /.well-known/jwks.json | Public | handleOIDCJWKS |
| GET | /api/v1/pipelines/oidc | AbilityRead | handleGetPipelineOIDCInfo |
| POST | /api/v1/pipelines/oidc/rotate-key | AbilityRoot | handleRotatePipelineOIDCKey |
| GET | /api/v1/network/topology | AbilityRead | handleGetNetworkTopology |
| GET | /api/v1/ssh-node-provisions | AbilityRoot | handleListSSHNodeProvisions |
| GET | /api/v1/ssh-node-provisions/ | AbilityRoot | handleGetSSHNodeProvision |
| GET | /api/v1/network-shares | AbilityRead | handleListNetworkShares |
| POST | /api/v1/network-shares | AbilityWriteSensitive | handleCreateNetworkShare |
| GET | /api/v1/network-shares/ | AbilityRead | handleGetNetworkShare |
| PUT | /api/v1/network-shares/ | AbilityWriteSensitive | handleUpdateNetworkShare |
| DELETE | /api/v1/network-shares/ | AbilityWriteSensitive | handleDeleteNetworkShare |
| POST | /api/v1/network-shares//test | AbilityRead | handleTestNetworkShare |
| GET | /api/v1/firewall-rules | AbilityRead | handleListFirewallRules |
| POST | /api/v1/firewall-rules | AbilityWriteSensitive | handleCreateFirewallRule |
| DELETE | /api/v1/firewall-rules/ | AbilityWriteSensitive | handleDeleteFirewallRule |
| GET | /api/v1/openapi.json | AbilityRead | handleOpenAPISpec |
| GET | /api/v1/changelog | AbilityRead | handleGetChangelog |
| GET | /api/v1/templates/custom | AbilityRead | handleListCustomTemplates |
| DELETE | /api/v1/templates/custom/ | AbilityWrite | handleDeleteCustomTemplate |
| GET | /api/v1/network/proxy | AbilityRead | handleGetNetworkProxy |
| GET | /api/v1/firewall/host | AbilityRead | handleHostFirewallStatus |
| POST | /api/v1/firewall/host/enable | AbilityRoot | handleEnableHostFirewall |
| POST | /api/v1/firewall/host/disable | AbilityRoot | handleDisableHostFirewall |
| POST | /api/v1/hooks/image-update// | Public | handleImageUpdateWebhook |
| GET | /api/v1/hooks/wake | Public | handleWakeHook |
| GET | /api/v1/imports/platform/databases | AbilityRead | handleListDatabaseDataCopies |
| GET | /api/v1/imports/platform/databases/ | AbilityRead | handleGetDatabaseDataCopy |
| POST | /api/v1/imports/platform/databases//copy | AbilityWriteSensitive | handleCopyDatabaseData |
| GET | /api/v1/migration/volumes | AbilityRead | handleVolumeGuide |
| GET | /api/v1/migration/cutover | AbilityRead | handleCutoverReport |
| GET | /api/v1/migration/cutover/verify | AbilityWriteSensitive | handleCutoverVerify |
| GET | /api/v1/ingress/connectivity | AbilityRead | handleIngressConnectivity |
| GET | /api/v1/firewall/exposure | AbilityRead | handleExposureReport |
| POST | /api/v1/firewall/exposure/preview | AbilityRoot | handleExposurePreview |
| PUT | /api/v1/firewall/exposure/restrictions// | AbilityRoot | handleExposureRestrict |
| DELETE | /api/v1/firewall/exposure/restrictions// | AbilityRoot | handleExposureUnrestrict |
| GET | /api/v1/attention/feed | AbilityRead | handleAttentionFeed |
| POST | /api/v1/attention/dismiss | Session | handleAttentionDismiss |
| GET | /api/v1/external-databases | AbilityRead | handleListExternalDatabases |
| POST | /api/v1/external-databases | AbilityRoot | handleCreateExternalDatabase |
| POST | /api/v1/external-databases/test | AbilityRoot | handleTestExternalDatabase |
| GET | /api/v1/external-databases/candidates | AbilityRoot | handleListExternalDatabaseCandidates |
| POST | /api/v1/external-databases/adopt | AbilityRoot | handleAdoptExternalDatabase |
| GET | /api/v1/external-databases/ | AbilityRead | handleGetExternalDatabase |
| PUT | /api/v1/external-databases/ | AbilityRoot | handleUpdateExternalDatabase |
| DELETE | /api/v1/external-databases/ | AbilityWrite | handleDeleteExternalDatabase |
| POST | /api/v1/external-databases//probe | AbilityWrite | handleProbeExternalDatabase |
| GET | /api/v1/external-databases//password | AbilityRoot | handleRevealExternalDatabasePassword |
| GET | /api/v1/usage/summary | AbilityRead | handleUsageSummary |
| GET | /api/v1/migration/hub/local-sources | AbilityRead | handleHubLocalSources |
| POST | /api/v1/migration/hub/sessions | AbilityWriteSensitive | handleCreateHubSession |
| GET | /api/v1/migration/hub/sessions | AbilityRead | handleListHubSessions |
| GET | /api/v1/migration/hub/sessions/ | AbilityRead | handleGetHubSession |
| DELETE | /api/v1/migration/hub/sessions/ | AbilityWriteSensitive | handleDeleteHubSession |
| PUT | /api/v1/migration/hub/sessions//selection | AbilityWriteSensitive | handlePutHubSelection |
| PUT | /api/v1/migration/hub/sessions//step | AbilityWriteSensitive | handlePutHubStep |
| POST | /api/v1/migration/hub/sessions//apply | AbilityWriteSensitive | handleApplyHubSession |
| GET | /api/v1/migration/hub/sessions//receipt | AbilityRead | handleHubReceipt |
| GET | /api/v1/migration/hub/sessions//items//connection | AbilityRead | handleHubConnection |
| POST | /api/v1/migration/hub/sessions//items//reveal | AbilityReadSensitive | handleHubReveal |
| POST | /api/v1/migration/apps/plan | AbilityWriteSensitive | handleAppImportPlan |
| POST | /api/v1/migration/apps/sessions | AbilityWriteSensitive | handleCreateAppImportSession |
| GET | /api/v1/migration/apps/sessions | AbilityRead | handleListAppImportSessions |
| GET | /api/v1/migration/apps/sessions/ | AbilityRead | handleGetAppImportSession |
| DELETE | /api/v1/migration/apps/sessions/ | AbilityWriteSensitive | handleDeleteAppImportSession |
| POST | /api/v1/migration/apps/sessions//connect | AbilityWriteSensitive | handleConnectAppImportSession |
| PUT | /api/v1/migration/apps/sessions//plan | AbilityWriteSensitive | handlePutAppImportPlan |
| POST | /api/v1/migration/apps/sessions//stage | AbilityWriteSensitive | handleStageAppImport |
| POST | /api/v1/migration/apps/sessions//verify | AbilityWriteSensitive | handleVerifyAppImport |
| POST | /api/v1/migration/apps/sessions//rollback | AbilityWriteSensitive | handleRollbackAppImport |
| GET | /api/v1/migration/apps/sessions//images | AbilityRead | handleAppImportImages |
| GET | /api/v1/migration/apps/sessions//images/status | AbilityRead | handleAppImportImagesStatus |
| POST | /api/v1/migration/apps/sessions//images/transfer | AbilityWriteSensitive | handleTransferAppImportImages |
| POST | /api/v1/migration/apps/sessions//images/cancel | AbilityWriteSensitive | handleCancelAppImportImages |
| GET | /api/v1/migration/apps/sessions//volumes | AbilityRead | handleAppImportVolumes |
| PUT | /api/v1/migration/apps/sessions//items//volumes/ | AbilityWriteSensitive | handleSetAppImportVolume |
| GET | /api/v1/migration/apps/sessions//cutover | AbilityRead | handleAppImportCutover |
| GET | /api/v1/migration/apps/sessions//cutover/verify | AbilityWriteSensitive | handleAppImportCutoverVerify |
| POST | /api/v1/migration/apps/sessions//items//route | AbilityWriteSensitive | handleRouteAppImport |
| GET | /api/v1/migration/apps/sessions//receipt | AbilityRead | handleAppImportReceipt |
| GET | /api/v1/dns/zones | AbilityRead | handleListDNSZones |
| POST | /api/v1/dns/zones | AbilityRoot | handleCreateDNSZone |
| GET | /api/v1/dns/zones/ | AbilityRead | handleGetDNSZone |
| DELETE | /api/v1/dns/zones/ | AbilityRoot | handleDeleteDNSZone |
| GET | /api/v1/dns/zones//nameservers | AbilityRead | handleDNSZoneNameServers |
| GET | /api/v1/dns/zones//delegation | AbilityRead | handleDNSZoneDelegation |
| GET | /api/v1/dns/zones//discover | AbilityRead | handleDiscoverDNSZoneRecords |
| GET | /api/v1/dns/zones//records | AbilityRead | handleListDNSZoneRecords |
| POST | /api/v1/dns/zones//records | AbilityRoot | handleCreateDNSZoneRecord |
| PUT | /api/v1/dns/zones//records | AbilityRoot | handleUpdateDNSZoneRecord |
| DELETE | /api/v1/dns/zones//records | AbilityRoot | handleDeleteDNSZoneRecord |
| POST | /api/v1/dns/zones//records/import | AbilityRoot | handleImportDNSZoneRecords |
| GET | /api/v1/dns/zones//records/export | AbilityRead | handleExportDNSZoneRecords |
| POST | /api/v1/dns/zones//templates/ | AbilityRoot | handleApplyDNSTemplate |
| GET | /api/v1/dns/templates | AbilityRead | handleListDNSTemplates |
| GET | /api/v1/dns/check | AbilityRead | handleDNSCheck |
| GET | /api/v1/dns/health-checks | AbilityRead | handleListDNSHealthChecks |
| POST | /api/v1/dns/health-checks | AbilityRoot | handleCreateDNSHealthCheck |
| DELETE | /api/v1/dns/health-checks/ | AbilityRoot | handleDeleteDNSHealthCheck |
| GET | /api/v1/dns/zone | AbilityRead | handleDNSZone |
| GET | /api/v1/traffic/summary | AbilityRead | handleTrafficSummary |
| GET | /api/v1/migration/apps/sessions//items//cutover/plan | AbilityRead | handleAppImportCutoverPlan |
| GET | /api/v1/migration/apps/sessions//items//cutover/runs | AbilityRead | handleListAppImportCutoverRuns |
| POST | /api/v1/migration/apps/sessions//items//cutover/runs | AbilityWriteSensitive | handleStartAppImportCutover |
| GET | /api/v1/migration/apps/sessions//items//cutover/runs/ | AbilityRead | handleGetAppImportCutoverRun |
| POST | /api/v1/migration/apps/sessions//items//cutover/runs//rollback | AbilityWriteSensitive | handleRollbackAppImportCutover |
| POST | /api/v1/migration/apps/sessions//items//cutover/runs//confirm-dns | AbilityWriteSensitive | handleConfirmAppImportCutoverDNS |
| GET | /api/v1/compose | AbilityRead | handleListComposeStacks |
| POST | /api/v1/compose/preview | AbilityDeploy | handlePreviewCompose |
| GET | /api/v1/node-moves | AbilityRoot | handleListNodeMoves |
| GET | /api/v1/node-moves/ | AbilityRoot | handleGetNodeMove |
| GET | /api/v1/node-drains/ | AbilityRoot | handleGetNodeDrain |
| GET | /api/v1/mesh/connectivity | AbilityRoot | handleMeshConnectivity |
| GET | /api/v1/teams | AbilityRead | handleListTeams |
| POST | /api/v1/teams | AbilityRoot | handleCreateTeam |
| GET | /api/v1/teams/roles | AbilityRead | handleListTeamRoles |
| GET | /api/v1/teams/ | AbilityRead | handleGetTeam |
| PATCH | /api/v1/teams/ | AbilityWrite | handleRenameTeam |
| DELETE | /api/v1/teams/ | AbilityWrite | handleDeleteTeam |
| GET | /api/v1/teams//members | AbilityRead | handleListTeamMembers |
| PUT | /api/v1/teams//members/ | AbilityWrite | handleSetTeamMemberRole |
| DELETE | /api/v1/teams//members/ | AbilityWrite | handleRemoveTeamMember |
| DELETE | /api/v1/teams//members/me | AbilityRead | handleLeaveTeam |
| POST | /api/v1/teams//transfer | AbilityWrite | handleTransferTeam |
| GET | /api/v1/teams//events | AbilityRead | handleListTeamEvents |
| GET | /api/v1/teams//invites | AbilityRead | handleListTeamInvites |
| POST | /api/v1/teams//invites | AbilityWrite | handleCreateTeamInvite |
| DELETE | /api/v1/teams//invites/ | AbilityWrite | handleRevokeTeamInvite |
| GET | /api/v1/team-invites/ | Session | handlePreviewTeamInvite |
| POST | /api/v1/team-invites/accept | Public | handleAcceptTeamInvite |
| GET | /metrics | AbilityRead | handleScrapeMetrics |
| GET | /api/v1/export/destinations | AbilityRoot | handleListExportDestinations |
| POST | /api/v1/export/destinations | AbilityRoot | handleCreateExportDestination |
| GET | /api/v1/export/destinations/ | AbilityRoot | handleGetExportDestination |
| PATCH | /api/v1/export/destinations/ | AbilityRoot | handleUpdateExportDestination |
| DELETE | /api/v1/export/destinations/ | AbilityRoot | handleDeleteExportDestination |
| POST | /api/v1/export/destinations//test | AbilityRoot | handleTestExportDestination |
| GET | /api/v1/mesh/settings | AbilityRead | handleGetMeshSettings |
| PUT | /api/v1/mesh/settings | AbilityRoot | handleUpdateMeshSettings |
| GET | /api/v1/resource-advisor/findings | AbilityRead | handleResourceAdvisorFindings |
| GET | /api/v1/resource-advisor/summary | AbilityRead | handleResourceAdvisorSummary |
| POST | /api/v1/resource-advisor/findings//apply | AbilityWrite | handleResourceAdvisorApply |
| POST | /api/v1/resource-advisor/findings//dismiss | AbilityWrite | handleResourceAdvisorState |
| POST | /api/v1/resource-advisor/findings//snooze | AbilityWrite | handleResourceAdvisorState |
| POST | /api/v1/resource-advisor/findings//restore | AbilityWrite | handleResourceAdvisorState |
| POST | /api/v1/imports/analyze | AbilityWrite | handleAnalyzeImport |
| GET | /api/v1/storage/orphans | AbilityRead | handleListStorageOrphans |
| DELETE | /api/v1/storage/orphans/ | AbilityWriteSensitive | handleReclaimStorageOrphan |
| GET | /api/v1/setup/guide | AbilityRead | handleGetSetupGuide |
| PUT | /api/v1/setup/guide/steps/ | AbilityRoot | handleSetSetupGuideStep |
| PUT | /api/v1/setup/guide/visibility | AbilityRoot | handleSetSetupGuideVisibility |
| POST | /api/v1/setup/guide/reset | AbilityRoot | handleResetSetupGuide |
| GET | /api/v1/logs/queries | AbilityRead | handleListSavedLogQueries |
| POST | /api/v1/logs/queries | AbilityWrite | handleCreateSavedLogQuery |
| PUT | /api/v1/logs/queries/ | AbilityWrite | handleUpdateSavedLogQuery |
| DELETE | /api/v1/logs/queries/ | AbilityWrite | handleDeleteSavedLogQuery |
| GET | /api/v1/usage/report | AbilityRead | handleUsageReport |
| GET | /api/v1/usage/settings | AbilityRoot | handleGetUsageSettings |
| PUT | /api/v1/usage/settings | AbilityRoot | handlePutUsageSettings |
| GET | /api/v1/usage/budgets | AbilityRead | handleListUsageBudgets |
| PUT | /api/v1/usage/budgets | AbilityWrite | handlePutUsageBudget |
| DELETE | /api/v1/usage/budgets/ | AbilityWrite | handleDeleteUsageBudget |
| POST | /api/v1/mobile/pairing-codes | AbilityRoot | handleCreateMobilePairing |
| POST | /api/v1/mobile/pair | Public | handleMobilePair |
| GET | /api/v1/mobile/devices | AbilityRead | handleListMobileDevices |
| DELETE | /api/v1/mobile/devices/ | AbilityRead | handleRevokeMobileDevice |
| GET | /api/v1/mobile/overview | AbilityRead | handleMobileOverview |
| GET | /api/v1/gate/check | Public | handleGateCheck |
| GET | /gate/login | Public | handleGateLogin |
See also
- Feature Catalog - high-level overview of platform capabilities
- Observability - metrics, logs, alerts, and telemetry APIs
- Architecture - control plane design and reconciliation patterns
- CLI Reference - command-line tool for all API operations