API reference

Authenticate every request

Use bearer credentials for administrators, scoped services, and nodes. Never ship a bootstrap token to browser code.

Bearer tokens

All endpoints except /healthz, /v1/info, node enrollment, and signed artifact downloads require an Authorization header.

HTTP

Authorization: Bearer <token>

Service credentials

POST/v1/service-credentials

Create a service credential with an opaque actor_ref, expiration, explicit resource permissions, and optional runtime limits. The token is returned once.

Errors and request IDs

Every response includes X-Request-ID. Errors use a stable envelope and tell callers whether a retry is safe.

JSON

{
  "error": {
    "code": "capacity_unavailable",
    "message": "No eligible capacity is available",
    "retryable": true,
    "retry_after_seconds": 10,
    "request_id": "req_01..."
  }
}