Admin API

Reference

Generated source hash: sha256:ec4b837acf7eeb986cc4742942398466c5c10efb9f6b2f851acc0b1d1f809f04.

Look up control-plane operations by domain. Each row comes from the current OpenAPI contract and includes the method, path, operation identifier, and declared responses.

Use the operation contract for request bodies and authentication requirements. Use guides for the sequence of actions around an endpoint.

Operations

• 397 operations are read from the OpenAPI paths object.
• Operation IDs and summaries are copied from the spec.
• Schema references point back to OpenAPI components; JSON Schema references are listed on Schemas.
• No live unauthenticated Try It widget is generated.

Access

Method	Path	Operation	Summary	Responses
GET	/v1/admin/role-bindings	list_role_bindings	List gateway role bindings for the active tenant.	200
POST	/v1/admin/role-bindings	create_role_binding	Create a gateway role binding.	201
POST	/v1/admin/role-bindings/preview	preview_role_bindings	Preview effective roles and collection permissions for a normalized actor context.	200
PATCH	/v1/admin/role-bindings/{binding_id}	patch_role_binding	Update a gateway role binding.	200
POST	/v1/admin/role-bindings/{binding_id}/disable	disable_role_binding	Disable a gateway role binding immediately.	200

Admin Activity

Method	Path	Operation	Summary	Responses
GET	/v1/admin-activity	list_admin_activity	List curated admin activity rows backed by sanitized durable audit events.
GET	/v1/admin-activity/{audit_event_id}	get_admin_activity	Read one curated admin activity detail by audit event ID.	200, 400, 403, 404

Agents

Method	Path	Operation	Summary	Responses
GET	/v1/agents	list_agents	List governed agent registry records with pagination, facets, search, and per-row permissions.	200
POST	/v1/agents	create_agent	Submit an agent registry record for security approval. Created records are non-callable until approved.	202, 409
GET	/v1/agents/{agent_id}	get_agent_registry_record	Read agent registry metadata, lifecycle state, allowed surfaces, environments, and instance identity.	200
PATCH	/v1/agents/{agent_id}	patch_agent_registry_record	Edit agent governance metadata without making the agent callable unless it remains approved.	202
POST	/v1/agents/{agent_id}/approval	transition_agent_approval	Move an agent through approval, disabled, deprecated, or archived states.	202
POST	/v1/agents/{agent_id}/revoke	revoke_agent	Disable an agent, append agent revocation outbox metadata, revoke affected active sessions, and audit the admin action.	202

Approvals

Method	Path	Operation	Summary	Responses
GET	/v1/approvals	list_approvals_queue	List reviewable submissions (decision workbench) across the tenant, all environments.	200
POST	/v1/approvals/batch	batch_approve_registry_submissions	Batch approve eligible MCP server submissions using submission_id and manifest_hash pins.	202

Audit

Method	Path	Operation	Summary	Responses
POST	/v1/audit/search	search_audit	Search tool, policy, session, credential, API adapter, and admin audit events.	200, 403
POST	/v1/audit/exports	create_audit_export	Create an async metadata-only audit evidence export job.	202, 400, 403, 422, 429
GET	/v1/audit/exports/{export_id}	get_audit_export	Read audit export job status and evidence metadata.	200, 403, 404
GET	/v1/audit/exports/{export_id}/download	download_audit_export	Download a completed audit export artifact.	200, 403, 404, 409, 410
GET	/v1/audit/requests/{request_id}	get_audit_request_bundle	Read the ordered audit event chain for one runtime request.	200, 403

Client Surfaces

Method	Path	Operation	Summary	Responses
GET	/v1/client-surfaces	list_client_surfaces	List canonical client surfaces visible in the requesting tenant and environment.	200, 400, 403, 503
GET	/v1/client-surfaces/{client_surface_id}	get_client_surface	Read canonical client-surface metadata for simulator, agent, audit, and emergency workflows.	200, 403, 404, 503
POST	/v1/client-surfaces/{client_surface_id}/lifecycle	transition_client_surface_lifecycle	Safely disable or revoke a client surface, audit the reason, and publish revocation impact.	202, 400, 403, 404, 409, 503

Consumer Oauth

Method	Path	Operation	Summary	Responses
GET	/v1/consumer-oauth/client-use-authorizations	list_client_use_authorizations	List client consent decisions for upstream connections.	200, 403
POST	/v1/consumer-oauth/client-use-authorizations/{authorization_id}/revoke	revoke_client_use_authorization	Revoke one client consent without disconnecting its upstream account.	202, 404, 409, 403, 422
GET	/v1/consumer-oauth/workspace-identities	get_workspace_external_identity	Read an exact external identity link.	200, 404, 403
POST	/v1/consumer-oauth/workspace-identities	link_workspace_external_identity	Link an external subject to an existing active workspace user.	202, 409, 403, 422
POST	/v1/consumer-oauth/workspace-identities/revoke	revoke_workspace_external_identity	Revoke an exact identity mapping and its client consents.	202, 409, 403, 422
GET	/v1/consumer-oauth/workspace-default	get_consumer_oauth_workspace_default	Read the configured incoming-client authorization server for this workspace environment.	200, 403
PUT	/v1/consumer-oauth/workspace-default	set_consumer_oauth_workspace_default	Set or clear an explicit incoming-client trust default with optimistic concurrency.	202, 403, 409, 422
POST	/v1/consumer-oauth/workspace-default/native	ensure_native_consumer_oauth_workspace_default	Provision the gateway-native authorization server as this workspace environment’s default.	202, 403, 409
GET	/v1/consumer-oauth/authorization-server-profiles	list_consumer_authorization_server_profiles	List tenant-scoped OAuth authorization-server profiles.	200, 403
POST	/v1/consumer-oauth/authorization-server-profiles	create_consumer_authorization_server_profile	Create a draft OAuth authorization-server profile.	201, 403, 422
GET	/v1/consumer-oauth/authorization-server-profiles/{profile_id}	get_consumer_authorization_server_profile	Read one OAuth authorization-server profile.	200, 403, 404
PATCH	/v1/consumer-oauth/authorization-server-profiles/{profile_id}	update_consumer_authorization_server_profile	Update a draft, disabled, or version-compatible OAuth authorization-server profile.	200, 403, 404, 409, 422
POST	/v1/consumer-oauth/authorization-server-profiles/{profile_id}/lifecycle	transition_consumer_authorization_server_profile	Validate, activate, disable, re-enable, roll back, or retire an OAuth authorization-server profile.	202, 403, 404, 409, 422
POST	/v1/consumer-oauth/authorization-server-profiles/{profile_id}/diagnostics	diagnose_consumer_authorization_server_profile	Refresh and report safe OAuth metadata, JWKS, claim-mapping, and interoperability diagnostics.	200, 403, 404
POST	/v1/consumer-oauth/authorization-server-profiles/{profile_id}/diagnostics/token	test_consumer_oauth_access_token	Test a sample OAuth access token against a profile and endpoint binding.	200, 403, 404, 422
GET	/v1/consumer-oauth/resource-auth-bindings	list_mcp_resource_auth_bindings	List endpoint-scoped consumer-auth bindings.	200, 403
POST	/v1/consumer-oauth/resource-auth-bindings	create_mcp_resource_auth_binding	Create a draft endpoint consumer-auth binding.	201, 403, 409, 422
GET	/v1/consumer-oauth/resource-auth-bindings/{binding_id}	get_mcp_resource_auth_binding	Read one endpoint consumer-auth binding.	200, 403, 404
PATCH	/v1/consumer-oauth/resource-auth-bindings/{binding_id}	update_mcp_resource_auth_binding	Update a version-compatible endpoint consumer-auth binding.	200, 403, 404, 409, 422
POST	/v1/consumer-oauth/resource-auth-bindings/{binding_id}/lifecycle	transition_mcp_resource_auth_binding	Activate, disable, roll back, or retire an endpoint consumer-auth binding.	202, 403, 404, 409, 422
GET	/v1/consumer-oauth/resource-auth-bindings/{binding_id}/protected-resource-metadata	preview_mcp_protected_resource_metadata	Preview the RFC 9728 metadata and path-specific metadata URL for an endpoint binding.	200, 403, 404
GET	/v1/consumer-oauth/resource-auth-bindings/{binding_id}/migration-status	get_consumer_oauth_migration_status	Read persisted migration evidence for one endpoint auth binding.	200, 403, 404, 409
POST	/v1/consumer-oauth/revocations/preview	preview_consumer_oauth_revocation	Preview sessions, cached credentials, and data-plane instances affected by an OAuth revocation.	200, 403, 422
GET	/v1/consumer-oauth/revocations	list_consumer_oauth_revocations	Search OAuth revocations and propagation status by governed identity or endpoint dimensions.	200, 403
POST	/v1/consumer-oauth/revocations	create_consumer_oauth_revocation	Revoke a principal, OAuth client, auth profile, agent, workload, endpoint, or session.	202, 403, 422
GET	/v1/consumer-oauth/revocations/{revocation_id}	get_consumer_oauth_revocation	Read OAuth revocation propagation status.	200, 403, 404
GET	/v1/consumer-oauth/upstream-providers	list_upstream_oauth_providers	List tenant-scoped upstream OAuth provider metadata.	200, 403
POST	/v1/consumer-oauth/upstream-providers	create_upstream_oauth_provider	Create a draft upstream OAuth provider.	201, 403, 409, 422
POST	/v1/consumer-oauth/upstream-providers/discovery-prefill	discover_upstream_oauth_provider_prefill	Discover safe upstream OAuth provider metadata from protected-resource metadata.	200, 403, 422
POST	/v1/consumer-oauth/upstream-providers/{provider_id}/client-credential	seal_upstream_oauth_client_credential	Install an existing upstream OAuth application.	200, 403, 404, 409, 422
GET	/v1/consumer-oauth/upstream-providers/{provider_id}/registration	get_upstream_oauth_client_registration	Read the dynamically registered client this provider authenticates with.	200, 403, 404
POST	/v1/consumer-oauth/upstream-providers/{provider_id}/registration	register_upstream_oauth_client	Register the gateway as an OAuth client with the provider’s authorization server (RFC 7591).	200, 201, 403, 404, 409, 422
GET	/v1/consumer-oauth/upstream-providers/{provider_id}	get_upstream_oauth_provider	Read one upstream OAuth provider.	200, 403, 404
PATCH	/v1/consumer-oauth/upstream-providers/{provider_id}	update_upstream_oauth_provider	Update a version-compatible upstream OAuth provider.	200, 403, 404, 409, 422
POST	/v1/consumer-oauth/upstream-providers/{provider_id}/lifecycle	transition_upstream_oauth_provider	Validate, activate, disable, re-enable, or retire an upstream OAuth provider.	202, 403, 404, 409, 422
POST	/v1/consumer-oauth/upstream-providers/{provider_id}/diagnostics	diagnose_upstream_oauth_provider	Test target-bound upstream token acquisition without calling a production tool.	200, 403, 404, 422
GET	/v1/consumer-oauth/upstream-grants	list_upstream_oauth_grants	List metadata-only user upstream OAuth grant and refresh health.	200, 403
POST	/v1/consumer-oauth/upstream-grants/authorizations	initiate_upstream_oauth_grant_authorization	Create a short-lived user-bound upstream OAuth authorization.	201, 401, 403, 409, 422
GET	/v1/consumer-oauth/workspace-login/callback	complete_upstream_workspace_identity_proof	Verify the workspace identity initiating an upstream connection.	303, 400, 404
GET	/v1/consumer-oauth/workspace-login/consent	show_upstream_client_use_consent	Show exact client, server, tool and upstream scopes for consent.	200, 404
POST	/v1/consumer-oauth/workspace-login/consent	approve_upstream_client_use_consent	Permit or decline client use of a workspace-owned upstream account.	200, 303, 400, 404
GET	/v1/consumer-oauth/upstream-grants/authorizations/connect	connect_upstream_oauth_grant_from_runtime_ticket	Start upstream authorization from a short-lived runtime ticket.	303, 401, 404, 409, 422
GET	/v1/consumer-oauth/upstream-grants/authorizations/{authorization_id}/connect	connect_upstream_oauth_grant_authorization	Verify the initiating user before redirecting to the upstream authorization server.	303, 401, 404, 409
GET	/v1/consumer-oauth/upstream-grants/authorizations/callback	complete_upstream_oauth_grant_authorization	Complete a PKCE-bound upstream OAuth authorization callback.	200, 401, 404, 409, 422
GET	/v1/consumer-oauth/upstream-grants/{grant_id}	get_upstream_oauth_grant	Read one metadata-only upstream OAuth grant.	200, 403, 404
POST	/v1/consumer-oauth/upstream-grants/{grant_id}/disconnect	disconnect_upstream_oauth_grant	Disconnect and revoke an upstream OAuth grant.	202, 403, 404, 409

Credential Bindings

Method	Path	Operation	Summary	Responses
GET	/v1/credential-bindings	list_credential_bindings	List credential binding metadata with server-side search, filters, KPIs, facets, and permissions.	200
POST	/v1/credential-bindings	create_credential_binding	Submit a credential binding record for security approval without exposing credential material.	202
GET	/v1/credential-bindings/{credential_binding_id}	get_credential_binding	Read credential binding detail, approved projection, broker check, activity, and permissions.	200, 403
PATCH	/v1/credential-bindings/{credential_binding_id}	update_credential_binding	Update credential binding metadata or submit approval-impacting changes for re-review.	202, 403
POST	/v1/credential-bindings/{credential_binding_id}/approval	transition_credential_binding_approval	Move a credential binding through approval states. Disable/revoke use dedicated endpoints.	202, 403
POST	/v1/credential-bindings/{credential_binding_id}/rotate	rotate_credential_binding	Rotate credential binding reference metadata without accepting credential material.	202, 403
POST	/v1/credential-bindings/{credential_binding_id}/disable	disable_credential_binding	Disable a credential binding so new broker resolutions and upstream calls fail closed.	202, 403, 409
POST	/v1/credential-bindings/{credential_binding_id}/revoke	revoke_credential_binding	Revoke a credential binding, emit revocation fanout, and terminate affected sessions.	202, 403, 409
POST	/v1/credential-bindings/{credential_binding_id}/rollback	rollback_credential_binding	Activate a prior immutable approved credential-binding version.	202, 403, 404, 409

Data Planes

Method	Path	Operation	Summary	Responses
GET	/v1/data-planes	get_data_planes	List data-plane topology and health metadata for a tenant/environment scope.	200, 403
GET	/v1/data-planes/{data_plane_id}	get_data_plane	Inspect one data plane with topology, health, sync, sessions, drain, upgrade, backup, and trust-boundary metadata.	200, 403, 404

Deny Diagnostics

Method	Path	Operation	Summary	Responses
POST	/v1/deny-diagnostics	create_deny_diagnostics_bundle	Build a metadata-only deny diagnostics bundle from a denied request, audit event, or explicit actor/tool context.	200, 400, 403, 404
POST	/v1/deny-diagnostics/remediations	list_deny_diagnostics_remediations	List the bounded set of mechanical remediation options for one denial.	200, 400, 403, 404
POST	/v1/deny-diagnostics/remediation-impact	evaluate_deny_diagnostics_remediation_impact	Evaluate a candidate policy manifest against the denial, comparable stored denials, and other subjects.	200, 400, 403, 404

Deployment

Method	Path	Operation	Summary	Responses
GET	/v1/deployment/status	get_deployment_status	Inspect data plane, database, cache, connector, topology, telemetry, and version status.	200
GET	/v1/control-plane/scope	get_control_plane_scope	Read the backend-resolved tenant and environment scope for UI registration workflows.	200

Emergency Disable

Method	Path	Operation	Summary	Responses
POST	/v1/emergency-disable	emergency_disable	Disable a server, tool, agent, credential, connector, or client surface.	202

Engineering

Method	Path	Operation	Summary	Responses
POST	/v1/engineering/github	engineering_github	Start or poll an immutable Nila GitHub invocation
POST	/v1/engineering/model	engineering_model	Start or poll an immutable Nila model invocation
POST	/v1/engineering/mail	support_mail	Start or poll an immutable Nila mail intent
GET	/v1/engineering/receipts/{requestId}	engineering_receipt	Read this workload’s durable native attempt receipt
POST	/mcp/engineering	engineering_mcp	Execute the engineering workload catalog through MCP
GET	/v1/engineering/operations	list_engineering_operations	Discover the workload scope-filtered engineering catalog
POST	/v1/engineering/operations/{operation_id}	call_engineering_operation	Execute the exact named engineering operation

Environments

Method	Path	Operation	Summary	Responses
GET	/v1/environments	list_environments	List tenant environments for settings/topology awareness without changing current scope.	200, 403
GET	/v1/environments/{environment_id}	get_environment	Read one tenant-scoped environment settings record without switching UI scope.	200, 403, 404

Gateway

Method	Path	Operation	Summary	Responses
GET	/v1/gateway/health	get_gateway_health	Read aggregate gateway health for the authenticated workspace.	200, 401, 403

Gateway Managed Secrets

Method	Path	Operation	Summary	Responses
GET	/v1/gateway-managed-secrets	list_managed_secrets	List gateway-managed secret metadata for the scope.	200, 403
POST	/v1/gateway-managed-secrets	create_managed_secret	Vault a secret value with the gateway.	201, 400, 403, 503

Governance

Method	Path	Operation	Summary	Responses
POST	/v1/mcp-servers/{server_id}/activation-publications/{operation_id}/verify	verify_mcp_server_activation	Execute a test call or fenced policy-denial check through the deployed gateway.	200, 403, 409
GET	/v1/mcp-servers/{server_id}/activation-publications/{operation_id}/verify/{request_id}	read_mcp_server_activation_verification	Observe exact invocation proof without executing another operation.	200, 403, 409
GET	/v1/mcp-servers/{server_id}/activation-publications	get_latest_mcp_server_activation_publication	Resume the latest scoped server publication after a browser reload.	200, 404
POST	/v1/mcp-servers/{server_id}/activation-publications	publish_mcp_server_activation	Validate and atomically publish an activation candidate with a durable replay receipt.	200, 202, 409
GET	/v1/mcp-servers/{server_id}/activation-publications/{operation_id}	get_mcp_server_activation_publication	Read durable publication progress and independently observed runtime readiness.	200, 404
GET	/v1/mcp-servers	list_mcp_server_registry_records	List MCP server registry records with UI-ready envelope metadata.	200
POST	/v1/mcp-servers	register_mcp_server	Register or submit an MCP server manifest for approval.	202
GET	/v1/mcp-servers/{server_id}	get_mcp_server_registry_record	Read an MCP server registry record with owner, health, approval, and history.	200
PATCH	/v1/mcp-servers/{server_id}/catalog-visibility	patch_mcp_server_catalog_visibility	Change authorized catalog visibility for an MCP server and append durable admin audit.	200, 403
GET	/v1/mcp-servers/{server_id}/activity	list_mcp_server_activity	Read typed MCP server activity from submission, snapshot, and change metadata.	200
GET	/v1/mcp-servers/{server_id}/policy-credentials	get_mcp_server_policy_credentials	Read backend-owned policy, credential, connector, and access posture for one MCP server.	200, 403, 404
GET	/v1/mcp-servers/{server_id}/usage	get_mcp_server_usage	Read backend-owned usage rollups for one MCP server.	200, 400, 403, 404
POST	/v1/mcp-servers/{server_id}/validate	validate_mcp_server_manifest	Validate a proposed manifest for a specific MCP server.	200
PATCH	/v1/mcp-servers/{server_id}/owner	edit_mcp_server_owner	Submit an immutable owner metadata edit for an MCP server.	202, 403
POST	/v1/mcp-servers/{server_id}/registration-status/deprecate	deprecate_mcp_server_registration_status	Submit an immutable registration_status=deprecated edit for an MCP server.	202
GET	/v1/mcp-servers/{server_id}/pending-submission/compare-live	compare_mcp_server_pending_submission_to_live	Compare the pending MCP server submission against the live snapshot.	200
POST	/v1/mcp-servers/{server_id}/approval	transition_mcp_server_approval	Compatibility shim for non-terminal review and live-resource lifecycle transitions; approval/rejection require submission_id and manifest_hash.	202
POST	/v1/mcp-servers/{server_id}/submissions	submit_mcp_server_manifest_revision	Submit a new immutable manifest for an existing MCP server without changing the live snapshot.	202
GET	/v1/mcp-servers/{server_id}/submissions	list_mcp_server_submissions	List immutable MCP server submissions for audit and review context.	200
GET	/v1/mcp-servers/{server_id}/submissions/{submission_id}	get_mcp_server_submission	Read one immutable MCP server submission and its safe manifest snapshot.	200
POST	/v1/mcp-servers/{server_id}/submissions/{submission_id}/review	review_mcp_server_submission	Review a specific submission by submission_id and manifest_hash; approval creates an immutable live snapshot.	202, 409
POST	/v1/mcp-servers/{server_id}/lifecycle	transition_mcp_server_lifecycle	Disable or archive the live MCP server resource without changing submission history.	202
GET	/v1/mcp-servers/{server_id}/versions	list_mcp_server_versions	List approved immutable snapshots only, newest first.	200
GET	/v1/mcp-servers/{server_id}/versions/compare	compare_mcp_server_versions	Compare two approved backend snapshot IDs.	200
GET	/v1/mcp-servers/{server_id}/versions/{snapshot_id}	get_mcp_server_version	Read one approved immutable snapshot by snapshot_id.	200
GET	/v1/mcp-servers/{server_id}/health	get_mcp_server_health	Query backend health and route availability for a registered MCP server.	200
POST	/v1/mcp-servers/{server_id}/health/observe	observe_mcp_server_health	Observe the current diagnostic health of an approved registered MCP server.	200, 400, 403, 404, 409, 500, 503
POST	/v1/mcp-servers/{server_id}/reprobe	reprobe_mcp_server	Re-probe an approved registered MCP server from its immutable live snapshot.	200, 403, 404, 409, 500, 503
GET	/v1/mcp-servers/{server_id}/tools/{tool_name}/upstream-connection	get_mcp_tool_upstream_connection	Read the current person connection for an approved MCP tool.	200, 403, 404, 409, 503
POST	/v1/mcp-servers/{server_id}/tools/{tool_name}/upstream-connection	connect_mcp_tool_upstream_account	Connect or reconnect the current person to an approved MCP tool.	200, 403, 404, 409, 503
DELETE	/v1/mcp-servers/{server_id}/tools/{tool_name}/upstream-connection	disconnect_mcp_tool_upstream_account	Disconnect the current person from this approved MCP tool.	200, 403, 404, 409, 503
POST	/v1/mcp-servers/openapi/preview	preview_openapi_mcp_server	Parse an OpenAPI or Swagger spec and preview the MCP server it would become.	200
POST	/v1/mcp-servers/openapi	register_openapi_mcp_server	Register an MCP server built from an OpenAPI spec.	202
GET	/v1/mcp-servers/{server_id}/openapi/spec	download_openapi_mcp_server_spec	Download the spec an OpenAPI-backed MCP server was built from.	200
POST	/v1/mcp-servers/{server_id}/tools/{tool_name}/try	try_mcp_server_tool	Run one governed test call against a live MCP server tool.	200, 403, 404, 409
GET	/v1/mcp-servers/{server_id}/diagnostic-recordings	list_diagnostic_recordings	List retained diagnostic recordings for one server.	200, 403, 404
POST	/v1/mcp-servers/{server_id}/diagnostic-recordings	create_diagnostic_recording	Start an automatically expiring server diagnostic recording.	200, 400, 403, 409, 503
GET	/v1/mcp-servers/{server_id}/diagnostic-recordings/{recording_id}	get_diagnostic_recording	Read one scoped recording with audited access.	200, 403, 404
POST	/v1/mcp-servers/{server_id}/diagnostic-recordings/{recording_id}/stop	stop_diagnostic_recording	Stop recording new events without extending retention.	200, 403, 404
GET	/v1/mcp-servers/{server_id}/diagnostic-recordings/{recording_id}/events	get_diagnostic_recording_events	Read the correlated redacted diagnostic timeline.	200, 403, 404
POST	/v1/mcp-servers/{server_id}/diagnostic-recordings/{recording_id}/export	export_diagnostic_recording	Download an audited redacted diagnostic bundle.	200, 403, 404
GET	/v1/catalog/capabilities	list_catalog_capabilities	List policy-visible and owner-tier-visible capabilities for the authenticated actor.	200, 401
GET	/v1/catalog/capabilities/{capability_id}	get_catalog_capability	Read one visible catalog capability without revealing hidden or out-of-scope existence.	200, 404
POST	/v1/catalog/access-requests	create_catalog_access_request	Request access to one visible catalog source or a visible tool subset.	201, 404, 409
GET	/v1/catalog/access-requests	list_catalog_access_requests	List the caller’s requests or the permission-gated review queue.	200, 403
POST	/v1/catalog/access-requests/{request_id}/approve	approve_catalog_access_request	Approve a pending request and publish its scoped policy grant.	200, 403, 409
POST	/v1/catalog/access-requests/{request_id}/deny	deny_catalog_access_request	Deny a pending request with a machine-readable reason.	200, 400, 403, 409
POST	/v1/catalog/access-requests/{request_id}/cancel	cancel_catalog_access_request	Cancel the caller’s own pending request.	200, 403, 409
GET	/v1/mcp-servers/{server_id}/traffic-limits	get_mcp_server_traffic_limit	Read the traffic limit profile for an MCP server.	200, 403, 404
PUT	/v1/mcp-servers/{server_id}/traffic-limits	upsert_mcp_server_traffic_limit	Publish or revise the traffic limit profile for an MCP server.	200, 400, 403, 503
GET	/v1/mcp-servers/{server_id}/audit	get_mcp_server_audit	Search audit events for one MCP server.	200, 403
GET	/v1/mcp-servers/{server_id}/denied-attempts	get_mcp_server_denied_attempts	Recent denied tool-call attempts for one MCP server, backed by audit search.	200, 403

Hosted

Method	Path	Operation	Summary	Responses
GET	/v1/hosted/auth/csrf	get_hosted_auth_csrf	Issue a hosted auth CSRF token and HttpOnly Secure SameSite CSRF cookie.	200, 403
POST	/v1/hosted/auth/signup	signup_hosted_auth	Create a work-domain hosted email-password account and restricted pre-activation session.	201, 400, 429
POST	/v1/hosted/auth/signup/resend-confirmation	resend_hosted_signup_confirmation	Neutrally accept a hosted email confirmation resend request.	200, 429
POST	/v1/hosted/auth/signup/confirm	confirm_hosted_signup	Consume a hosted email confirmation challenge and activate membership when eligible.	200
POST	/v1/hosted/auth/login	login_hosted_auth	Create a hosted browser session for an email-password account.	200, 429
GET	/v1/hosted/auth/entry-status	get_hosted_auth_entry_status	Resume the restricted hosted account-entry journey.	200, 401, 403
POST	/v1/hosted/auth/logout	logout_hosted_auth	Revoke the hosted browser session and clear hosted cookies.	200
GET	/v1/hosted/social-auth/providers	list_hosted_social_auth_providers	List hosted Google, Microsoft, and GitHub signup/login providers.	200, 403
POST	/v1/hosted/social-auth/begin	begin_hosted_social_auth	Begin hosted Google, Microsoft, or GitHub signup/login.	200, 400, 403, 429
POST	/v1/hosted/social-auth/callback	complete_hosted_social_auth_callback	Complete a normalized hosted social auth callback in test environments.	200, 400, 403
GET	/v1/hosted/social-auth/google/callback	complete_hosted_google_social_auth_callback	Complete hosted Google signup/login from the provider redirect.	303
GET	/v1/hosted/social-auth/github/callback	complete_hosted_github_social_auth_callback	Complete hosted GitHub signup/login from the provider redirect.	303
POST	/v1/hosted/auth/password-reset	request_hosted_password_reset	Request a hosted password reset challenge without disclosing account existence.	200, 429
POST	/v1/hosted/auth/password-reset/complete	complete_hosted_password_reset	Consume a single-use hosted reset challenge and set a new password.	200
POST	/v1/hosted/auth/password/change	change_hosted_password	Add or change the password for an active hosted browser session.	200
GET	/v1/hosted/current-user	get_hosted_current_user	Read the managed current-user identity and stable capability set.	200, 401, 403
POST	/v1/hosted/workspaces	create_hosted_workspace	Create a hosted workspace for the current account.	200
GET	/v1/hosted/workspaces	list_hosted_workspaces	List the active workspaces available to the current hosted account.	200, 401
POST	/v1/hosted/workspaces/select	select_hosted_workspace	Select the workspace used by the current hosted browser session.	200, 403
POST	/v1/hosted/onboarding/join	submit_hosted_onboarding_join	Submit the current account’s hosted workspace join choice.	200
POST	/v1/hosted/onboarding/accept-invitation	accept_hosted_onboarding_invitation	Accept a hosted invitation by its invite reference.	200
GET	/v1/hosted/domain-policies	list_hosted_domain_policies	List domain policies controlled by the current account.	200
PUT	/v1/hosted/domain-policies/{work_domain}	update_hosted_domain_policy	Update a domain routing policy controlled by the current account.	200
POST	/v1/hosted/voice/session	create_hosted_voice_session	Mint a short-lived voice provider session for the active managed user.	200, 401, 404
GET	/v1/hosted/current-user/browser-sessions	list_hosted_browser_sessions	List active browser sessions for the managed current user.	200, 401
POST	/v1/hosted/current-user/browser-sessions/revoke-others	revoke_other_hosted_browser_sessions	Revoke every browser session except the current managed session.	200, 403
POST	/v1/hosted/current-user/membership/leave	leave_hosted_organization	Leave the current managed organization.	200, 400, 401, 403, 409
GET	/v1/hosted/organization/upgrade-request	get_hosted_organization_upgrade_request	Read the session-derived organization upgrade-request status.	200, 403
POST	/v1/hosted/organization/upgrade-request	submit_hosted_organization_upgrade_request	Submit the current managed organization for manual upgrade review.	200, 403
GET	/v1/hosted/organization/members	list_hosted_organization_members	List members in the session-derived managed organization.	200, 403
GET	/v1/hosted/organization/members/{member_ref}	get_hosted_organization_member	Read one member in the session-derived managed organization.	200, 404
DELETE	/v1/hosted/organization/members/{member_ref}	remove_hosted_organization_member	Remove a member from the session-derived managed organization.	200, 403, 409
PATCH	/v1/hosted/organization/members/{member_ref}/role	change_hosted_organization_member_role	Change a managed organization member role.	200, 403, 409
POST	/v1/hosted/organization/members/{member_ref}/suspend	suspend_hosted_organization_member	Suspend a managed organization member and revoke browser sessions.	200, 403, 409
POST	/v1/hosted/organization/members/{member_ref}/reactivate	reactivate_hosted_organization_member	Reactivate a suspended managed organization member.	200, 403, 409
POST	/v1/hosted/organization/members/{member_ref}/revoke-browser-sessions	revoke_hosted_organization_member_browser_sessions	Revoke all browser sessions for a managed organization member.	200, 403, 409
GET	/v1/hosted/account-settings	get_hosted_account_settings	Read hosted workspace settings and account security state.	200, 403
GET	/v1/hosted/workspace/runtime	get_hosted_workspace_runtime	Read runtime provisioning for the signed-in workspace.	200, 403, 404
POST	/v1/hosted/workspace/runtime/retry	retry_hosted_workspace_runtime	Retry failed runtime provisioning for the signed-in workspace.	200, 403, 404
PATCH	/v1/hosted/workspace-profile	update_hosted_workspace_profile	Update the hosted workspace display name.	200, 403
PATCH	/v1/hosted/activation-policy	update_hosted_activation_policy	Update hosted activation policy defaults for future resource activation.	200, 400, 403
POST	/v1/hosted/orgs/trials	create_hosted_trial_org	Create a hosted trial org after verified work-domain signup.	201, 400, 403
GET	/v1/hosted/orgs/{org_ref}	get_hosted_org	Read hosted org lifecycle, trial, plan, and entitlement state.	200, 404
POST	/v1/hosted/orgs/{org_ref}/upgrade-request	request_hosted_org_upgrade	Mark that a locked or trial org requested upgrade.	202
POST	/v1/hosted/orgs/{org_ref}/trial/expire	expire_hosted_org_trial_for_smoke	Prove hosted trial expiry hard-lock for public smoke.	200
POST	/v1/hosted/orgs/{org_id}/trial/extend	extend_hosted_org_trial	DAC operator extends a hosted trial and unlocks trial entitlements.	202
PUT	/v1/hosted/orgs/{org_id}/plan	set_hosted_org_plan	DAC operator manually sets hosted plan state.	202
POST	/v1/hosted/orgs/{org_id}/lock	lock_hosted_org	DAC operator locks a hosted org and disables runtime/configuration entitlements.	202
POST	/v1/hosted/orgs/{org_id}/restore-access	restore_hosted_org_access	DAC operator restores hosted org access according to current trial and plan state.	202
POST	/v1/hosted/email/challenges	create_hosted_email_challenge	Issue a hosted-only email verification challenge.	202, 503
POST	/v1/hosted/email/challenges/verify-code	verify_hosted_email_code	Verify a hosted email challenge with a short code.	200
POST	/v1/hosted/email/challenges/verify-link	verify_hosted_email_link	Verify a hosted email challenge with a magic-link token.	200
GET	/v1/hosted/invites	list_hosted_invites	List hosted invites for admin management.	200
POST	/v1/hosted/invites	create_hosted_invite	Invite a security/admin, developer, or viewer user to a hosted org.	201
POST	/v1/hosted/invites/{invite_id}/resend	resend_hosted_invite	Resend a pending hosted invite with a rotated action ref.	200
POST	/v1/hosted/invites/{invite_id}/cancel	cancel_hosted_invite	Cancel a pending hosted invite.	200
GET	/v1/hosted/auth/invite-binding	preview_hosted_invite	Read the invitation bound to this browser.	200
POST	/v1/hosted/auth/invite-binding	bind_hosted_invite_continuation	Bind an invite email continuation to this browser.	200
POST	/v1/hosted/invites/accept	accept_hosted_invite	Accept a hosted invite and establish the invited account.	200
POST	/v1/hosted/domain-signups/resolve	resolve_hosted_domain_signup	Resolve hosted signup route for a verified domain.	200, 400, 403
GET	/v1/hosted/join-requests	list_hosted_join_requests	List hosted same-domain access requests for admin review.	200
POST	/v1/hosted/join-requests	create_hosted_join_request	Create a same-domain hosted access request.	201, 409
POST	/v1/hosted/join-requests/{join_request_ref}/approve	approve_hosted_join_request	Approve a same-domain hosted access request.	200, 403
POST	/v1/hosted/join-requests/{join_request_ref}/reject	reject_hosted_join_request	Reject a same-domain hosted access request.	200, 403
GET	/v1/hosted/join-requests/{join_request_ref}/public-status	get_hosted_join_request_public_status	Read neutral public status for a hosted access request.	200, 404
POST	/v1/hosted/separate-workspace-requests	create_hosted_separate_workspace_request	Request a separate hosted workspace for an existing domain.	201, 409
POST	/v1/hosted/separate-workspace-requests/{request_id}/review	review_hosted_separate_workspace_request	DAC operator reviews a separate hosted workspace request.	202, 403
POST	/v1/hosted/runtime/endpoints	register_hosted_runtime_endpoint	Register a customer-owned HTTPS API or HTTPS MCP endpoint for hosted runtime.	201, 400
POST	/v1/hosted/runtime/endpoints/{endpoint_ref}/reachability	validate_hosted_runtime_endpoint_reachability	Run hosted runtime reachability validation from DAC egress.	202, 409
POST	/v1/hosted/runtime/endpoints/{endpoint_ref}/readiness	evaluate_hosted_runtime_endpoint_readiness	Evaluate hosted runtime route readiness for a governed call.	200
GET	/v1/hosted/audit/posture	get_hosted_audit_posture	Read hosted audit posture with metadata-only defaults.	200, 403
GET	/v1/hosted/payload-capture	get_payload_capture_settings	Read SaaS payload capture settings for the authenticated organization.	200, 403, 404
PUT	/v1/hosted/payload-capture	update_payload_capture_settings	Disable capture or enable timed or manual capture.	200, 400, 403, 409, 503
GET	/v1/hosted/payload-capture/requests/{request}	get_captured_payload	Read an unexpired captured payload within the authenticated organization.	200, 403
POST	/v1/hosted/payload-capture/windows	create_hosted_payload_capture_window	Create a short-lived hosted payload-capture window.	201, 400, 403
POST	/v1/hosted/payload-capture/windows/{window_id}/evaluate	evaluate_hosted_payload_capture_window	Evaluate whether a runtime request falls inside a capture window.	200, 403
POST	/v1/hosted/payload-capture/windows/{window_id}/ttl-purge	evaluate_hosted_payload_capture_ttl_purge	Evaluate TTL purge for an expired or suspended hosted capture window.	200
POST	/v1/hosted/payload-capture/windows/{window_id}/incident-action	apply_hosted_payload_capture_incident_action	Apply a DAC operator incident action to a hosted capture window.	200, 403
POST	/v1/hosted/audit/runtime-events	append_hosted_runtime_metadata_audit_event	Append hosted runtime metadata audit evidence.	202, 400

Identity

Method	Path	Operation	Summary	Responses
GET	/v1/identity/me	get_identity_me	Read the normalized authenticated admin actor and backend-computed collection permissions.	200
GET	/v1/identity-provider	get_identity_provider	Read metadata-only active auth mode and provider configuration state.	200
POST	/v1/identity-provider/diagnostics	diagnose_identity_provider	Run metadata-only auth provider readiness checks.	200
POST	/v1/local-identity/bootstrap-admin	bootstrap_local_identity_admin	Bootstrap the first local platform admin before any local user exists.	201
POST	/v1/local-identity/login	login_local_identity	Create a backend-owned local browser session.	200
POST	/v1/local-identity/logout	logout_local_identity	Revoke the active local browser session.	200
GET	/v1/local-identity/session	get_local_identity_session	Read the current local browser session and normalized actor.	200
GET	/v1/local-identity/users	list_local_identity_users	List local users without password hashes.	200
POST	/v1/local-identity/users	create_local_identity_user	Create a local user and return a generated temporary password once when omitted.	201
PATCH	/v1/local-identity/users/{user_id}	patch_local_identity_user	Update local user profile metadata.	200
POST	/v1/local-identity/users/{user_id}/disable	disable_local_identity_user	Disable a local user and revoke active local sessions.	200
POST	/v1/local-identity/users/{user_id}/reset-password	reset_local_identity_user_password	Reset a local user’s password and return the temporary password once.	200
POST	/v1/local-identity/users/{user_id}/change-password	change_local_identity_user_password	Change the authenticated local user’s password and clear reset-required state.	200
GET	/v1/local-identity/groups	list_local_identity_groups	List local groups and member IDs.	200
POST	/v1/local-identity/groups	create_local_identity_group	Create a local group principal.	201
PATCH	/v1/local-identity/groups/{group_id}	patch_local_identity_group	Update local group metadata.	200
POST	/v1/local-identity/groups/{group_id}/members	add_local_identity_group_member	Add a local user to a local group.	200
DELETE	/v1/local-identity/groups/{group_id}/members/{user_id}	remove_local_identity_group_member	Remove a local user from a local group.	200
GET	/v1/local-identity/service-accounts	list_local_identity_service_accounts	List local service accounts without token hashes.	200
POST	/v1/local-identity/service-accounts	create_local_identity_service_account	Create a local service principal.	201
GET	/v1/local-identity/service-accounts/{service_id}/tokens	list_local_identity_service_account_tokens	List service-account token metadata without token hashes or plaintext tokens.	200
POST	/v1/local-identity/service-accounts/{service_id}/tokens	create_local_identity_service_account_token	Create a service-account token and return plaintext once.	200
POST	/v1/local-identity/service-accounts/{service_id}/tokens/{token_id}/revoke	revoke_local_identity_service_account_token	Revoke one service-account token by metadata ID.	200
POST	/v1/local-identity/service-accounts/{service_id}/disable	disable_local_identity_service_account	Disable a local service account and revoke active tokens.	200

License

Method	Path	Operation	Summary	Responses
GET	/v1/license	get_license_status	Read safe license and entitlement status for one environment.	200, 403

Managed

Method	Path	Operation	Summary	Responses
GET	/v1/managed/plans	list_managed_plans	List the offers in the current approved managed catalog release.	200, 401, 403, 503
GET	/v1/managed/plan	get_managed_plan	Read the current member’s managed plan and usage.	200, 401, 403, 503
GET	/v1/managed/usage	get_managed_usage_analytics	Read runtime request volume, successful, failed and denied tool-call counts, and quota usage for the current organization over a rolling or calendar date window.	200, 400, 401, 403, 503
POST	/v1/managed/plan-change-requests	create_managed_plan_change_request	Request a change to another managed plan.	202, 400, 401, 403, 409, 503
GET	/v1/managed/invocations/{receipt}	get_managed_invocation_status	Read pending or terminal managed invocation metadata.	200, 401, 403, 404, 503

Management

Method	Path	Operation	Summary	Responses
POST	/mcp/management	workspace_management_mcp	Operate the caller’s workspace through the permission-filtered management MCP server.	200, 202, 401, 403
GET	/v1/management/operations	list_workspace_management_operations	Discover the caller’s workspace operations and input schemas shared with MCP and CLI.	200, 401, 403
POST	/v1/management/operations/{operation_id}	call_workspace_management_operation	Execute a workspace operation through the shared authorized Admin API foundation.	200, 400, 401, 403, 404, 409

Oauth

Method	Path	Operation	Summary	Responses
GET	/oauth/{tenant}/jwks	readNativeMcpPublicKeys	Read native MCP signing keys	200
POST	/oauth/{tenant}/register	registerNativeMcpClient	Register a public MCP client	201, 400, 503
GET	/oauth/{tenant}/authorize	authorizeNativeMcpClient	Start native MCP authorization	200, 303, 400, 503
POST	/oauth/{tenant}/authorize	decideNativeMcpConsent	Decide native MCP client consent	200, 303, 400, 503
GET	/oauth/{tenant}/resume	resumeNativeMcpAuthorization	Continue native MCP authorization	200, 400, 503
POST	/oauth/{tenant}/token	exchangeNativeMcpToken	Exchange a native MCP code or refresh token	200, 400, 401, 503
POST	/oauth/{tenant}/revoke	revokeNativeMcpToken	Revoke a native MCP token	200, 401, 503

Oauth Authorization Server

Method	Path	Operation	Summary	Responses
GET	/.well-known/oauth-authorization-server/oauth/{tenant}	discoverNativeMcpAuthorizationServer	Discover the native MCP authorization server	200

Oauth Protected Resource

Method	Path	Operation	Summary	Responses
GET	/.well-known/oauth-protected-resource/tenants/{tenant_id}/environments/{environment_id}/servers/{server_id}/mcp	get_mcp_server_protected_resource_metadata	Read path-specific RFC 9728 metadata for a registered MCP server resource.	200, 404, 503
GET	/.well-known/oauth-protected-resource/mcp/management	get_workspace_management_protected_resource_metadata	Discover the workspace management OAuth resource and Auth0 issuer.	200, 503
GET	/.well-known/oauth-protected-resource/mcp/super-admin	get_super_admin_management_protected_resource_metadata	Discover the super-admin management OAuth resource and Auth0 issuer.	200, 503
GET	/.well-known/oauth-protected-resource/mcp/engineering	get_engineering_protected_resource_metadata	Discover the engineering OAuth resource and issuer

Operations

Method	Path	Operation	Summary	Responses
GET	/v1/telemetry	get_telemetry_settings	Read metadata-only telemetry configuration and delivery health.	200, 403
PUT	/v1/telemetry	update_telemetry_settings	Update telemetry mode and destination references with write-only secret refs.	200, 403
POST	/v1/telemetry/test	test_telemetry_settings	Request a telemetry delivery test through the workload worker.	501, 403
POST	/v1/telemetry/disable	disable_telemetry_settings	Disable telemetry export for an environment.	202, 403
GET	/v1/siem-webhooks	list_siem_webhooks	List revisioned SIEM audit destinations and observed health.	200, 403, 422, 503
POST	/v1/siem-webhooks	create_siem_webhook	Create a disabled SIEM destination revision.	201, 403, 422, 424, 429, 503
GET	/v1/siem-webhooks/{destination_id}	get_siem_webhook	Read one SIEM destination, immutable revision, dependencies, and observed health.	200, 403, 404, 422, 503
PUT	/v1/siem-webhooks/{destination_id}	update_siem_webhook	Create a new immutable SIEM destination revision.	200, 403, 404, 409, 422, 424, 429, 503
POST	/v1/siem-webhooks/{destination_id}/test	test_siem_webhook	Queue and optionally wait for a live SIEM worker test.	200, 202, 409, 403, 404, 424, 429, 422, 503
POST	/v1/siem-webhooks/{destination_id}/enable	enable_siem_webhook	Enable a SIEM destination from an exact current worker observation.	200, 403, 404, 409, 424, 429, 422, 503
POST	/v1/siem-webhooks/{destination_id}/disable	disable_siem_webhook	Disable a SIEM destination without deleting delivery evidence.	200, 403, 404, 422, 503
GET	/v1/siem-webhooks/{destination_id}/deliveries	list_siem_webhook_deliveries	List metadata-only SIEM delivery summaries.	200, 403, 404, 422, 503
GET	/v1/siem-webhooks/{destination_id}/deliveries/{delivery_id}	get_siem_webhook_delivery	Get one metadata-only SIEM delivery summary.	200, 403, 404, 422, 503
GET	/v1/siem-webhooks/{destination_id}/deliveries/{delivery_id}/attempts	list_siem_webhook_delivery_attempts	Page through complete durable SIEM send-attempt evidence.	200, 403, 404, 422, 503
GET	/v1/siem-webhooks/{destination_id}/deliveries/{delivery_id}/confirmations	list_siem_webhook_delivery_confirmations	Page through complete durable Splunk HEC confirmation evidence.	200, 403, 404, 422, 503
GET	/v1/siem-webhooks/{destination_id}/deliveries/{delivery_id}/confirmations/{confirmation_id}/polls	list_siem_webhook_confirmation_polls	Page through complete durable Splunk HEC acknowledgment poll evidence.	200, 403, 404, 422, 503
POST	/v1/siem-webhooks/{destination_id}/deliveries:redrive	redrive_siem_webhook_deliveries	Idempotently re-drive up to 100 dead-lettered SIEM deliveries onto current revisions.	202, 403, 404, 409, 422, 424, 429, 503
GET	/v1/siem-webhooks/{destination_id}/replays	list_siem_webhook_replays	List bounded SIEM audit replay jobs without exposing audit payloads.	200, 403, 404, 422, 503
POST	/v1/siem-webhooks/{destination_id}/replays	create_siem_webhook_replay	Create one bounded historical audit replay for a SIEM destination.	202, 403, 404, 409, 422, 424, 429, 503
GET	/v1/siem-webhooks/{destination_id}/replays/{replay_id}	get_siem_webhook_replay	Read one metadata-only SIEM audit replay job.	200, 403, 404, 422, 503
GET	/v1/connectors	list_connectors	List connector registry read-model rows for the UI with safe health, route, lifecycle, KPI, and permission metadata.	200, 422, 403
GET	/v1/connectors/{connector_id}	get_connector	Read connector registry detail metadata for UI rendering without client-side status, audit, route, or session joins.	200, 403, 404
GET	/v1/connectors/{connector_id}/impact	get_connector_impact	Read safe connector blast-radius metadata before a lifecycle action.	200, 403, 404, 500
POST	/v1/connectors/{connector_id}/lifecycle	transition_connector_lifecycle	Move a connector through explicit lifecycle transitions without patching raw fields.	200, 403, 404, 409, 422, 500

Outbound Endpoints

Method	Path	Operation	Summary	Responses
GET	/v1/outbound-endpoints	list_outbound_endpoints	List shared outbound endpoints with safe summaries and immutable revisions.	200, 403, 422, 500, 503
POST	/v1/outbound-endpoints	create_outbound_endpoint	Create a revisioned outbound HTTPS endpoint.	201, 403, 422, 500, 503
GET	/v1/outbound-endpoints/{endpoint_id}	get_outbound_endpoint	Read one outbound endpoint and every immutable revision.	200, 403, 404, 422, 500, 503
PUT	/v1/outbound-endpoints/{endpoint_id}	update_outbound_endpoint	Update endpoint metadata or create an immutable receiver-affecting revision.	200, 403, 404, 409, 422, 500, 503
POST	/v1/outbound-endpoints/{endpoint_id}/archive	archive_outbound_endpoint	Archive an endpoint that has no live target dependencies.	202, 403, 404, 409, 422, 500, 503
GET	/v1/outbound-endpoints/{endpoint_id}/dependencies	get_outbound_endpoint_dependencies	Read endpoint blast radius before revision or archive actions.	200, 403, 404, 422, 500, 503

Outbound Target Tests

Method	Path	Operation	Summary	Responses
GET	/v1/outbound-target-tests/{job_id}	get_outbound_target_test	Read one durable outbound target test and its observed result.	200, 403, 404, 422, 500, 503

Outbound Targets

Method	Path	Operation	Summary	Responses
GET	/v1/outbound-targets	list_outbound_targets	List workload-scoped outbound targets and immutable revisions.	200, 403, 422, 500, 503
POST	/v1/outbound-targets	create_outbound_target	Create a revisioned workload target pinned to an endpoint revision and credential binding.	201, 403, 422, 424, 500, 503
GET	/v1/outbound-targets/{target_id}	get_outbound_target	Read one workload target and every immutable revision.	200, 403, 404, 422, 500, 503
PUT	/v1/outbound-targets/{target_id}	update_outbound_target	Update target metadata or create an immutable receiver-affecting revision.	200, 403, 404, 409, 422, 424, 500, 503
POST	/v1/outbound-targets/{target_id}/test	test_outbound_target	Enqueue a durable workload-worker target test.	200, 202, 403, 404, 409, 422, 429, 500, 503
GET	/v1/outbound-targets/{target_id}/credential-rotation	get_outbound_target_credential_rotation	Read the exact credential version and rotation evidence pinned to a target revision.	200, 403, 404, 422, 500, 503
POST	/v1/outbound-targets/{target_id}/credential-rotation	stage_outbound_target_credential_rotation	Stage a newer approved credential binding version for worker testing.	200, 403, 404, 409, 422, 500, 503
POST	/v1/outbound-targets/{target_id}/credential-rotation/promote	promote_outbound_target_credential_rotation	Promote the exact successfully tested candidate credential version.	200, 403, 404, 409, 422, 500, 503
POST	/v1/outbound-targets/{target_id}/credential-rotation/settle	settle_outbound_target_credential_rotation	Settle an expired credential overlap to durable stable state.	200, 403, 404, 409, 422, 500, 503
POST	/v1/outbound-targets/{target_id}/enable	enable_outbound_target	Enable a target only after a successful exact-revision worker observation.	200, 403, 404, 409, 422, 500, 503
POST	/v1/outbound-targets/{target_id}/disable	disable_outbound_target	Disable a workload target while retaining revisions and evidence.	200, 403, 404, 409, 422, 500, 503
GET	/v1/outbound-targets/{target_id}/dependencies	get_outbound_target_dependencies	Read target blast radius and exact pinned dependencies.	200, 403, 404, 422, 500, 503

Policy

Method	Path	Operation	Summary	Responses
GET	/v1/reason-codes	list_reason_codes	List backend-owned governance reason codes.	200
POST	/v1/reason-codes	create_reason_code	Create or replace a tenant governance reason code.	202
GET	/v1/reason-codes/export	export_reason_codes	Export tenant governance reason-code catalog.	200
POST	/v1/reason-codes/import	import_reason_codes	Import tenant governance reason-code catalog entries.	200
PATCH	/v1/reason-codes/{code}	patch_reason_code	Update a tenant governance reason code.	200
POST	/v1/policies/simulate	simulate_policy	Preview a V1 gateway policy decision without runtime mutation.	200
GET	/v1/policies	list_policies	List policy versions for the scoped tenant and environment.	200, 403
POST	/v1/policies	create_policy	Create a brand-new draft policy version with no parent.	201, 400, 403, 409
POST	/v1/policies/resolve-refs	resolve_policy_refs	Resolve policy refs for manifest validation and policy picker flows.	200, 400
GET	/v1/policies/{policy_version}	read_policy	Read a policy version including editable safe body, validation, usage, hash, and permissions.	200, 403, 404
PUT	/v1/policies/{policy_version}	update_policy_draft	Update a draft policy body with manifest_hash or etag concurrency pinning.	202, 400, 403, 409
POST	/v1/policies/{policy_version}/validate	validate_policy_version	Validate a stored or supplied policy body and return structured errors.	200, 403, 409
POST	/v1/policies/{policy_version}/publish	publish_policy_version	Publish a draft policy version and make it active for the environment.	202, 403, 409, 422
POST	/v1/policies/{policy_version}/archive	archive_policy_version	Archive a draft, rejected, or safe old policy version.	202, 403, 409

Registry

Method	Path	Operation	Summary	Responses
POST	/v1/registry/mcp-discovery-authorizations	connect_mcp_discovery_account	Connect a personal upstream account for MCP registration discovery.	201, 400, 403
GET	/v1/registry/mcp-discovery-authorizations/{grant_id}	get_mcp_discovery_connection	Read the current person’s registration discovery connection.	200, 404
POST	/v1/registry/mcp-discovery-authorizations/{grant_id}/probe	probe_mcp_with_discovery_connection	Discover tools through the current person’s registration connection.	200, 404, 409
POST	/v1/registry/validate-manifest	validate_registry_manifest	Validate MCP server or API source manifests without publishing them.	200
GET	/v1/registry/mcp-compatibility/options	get_mcp_compatibility_options	Read MCP compatibility choices and the effective configuration envelope.	200, 403, 404
POST	/v1/registry/probe-mcp-server	probe_mcp_server	Probe an MCP server from its configured runtime route and return compatibility evidence.	200, 422
GET	/v1/registry/probes/{probe_id}	get_mcp_server_probe	Read the most recent in-memory MCP server probe result.	200, 404

Runtime

Method	Path	Operation	Summary	Responses
POST	/v1/runtime/audit-events	ingest_runtime_audit_events	Ingest metadata-only DP runtime audit events into CP audit storage.	202, 400, 403

Sessions

Method	Path	Operation	Summary	Responses
POST	/v1/revocations	revoke_access	Apply a target revocation and revoke affected active sessions.	202, 403
POST	/v1/revocations/preview	preview_revocation	Preview active sessions and backend sessions affected by a target revocation.	200, 403
GET	/v1/sessions	list_active_sessions	Query durable active session metadata.	200, 403
POST	/v1/sessions/batch-revoke	batch_revoke_sessions	Revoke selected sessions in one backend call.	200, 403
GET	/v1/sessions/{client_session_id}	get_session_lifecycle	Read durable session metadata, backend sessions, transitions, and allowed actions.	200, 403
POST	/v1/sessions/{client_session_id}/terminate	terminate_session	Explicitly terminate a client session and fail closed for future calls.	202, 403
POST	/v1/sessions/{client_session_id}/revoke	revoke_session	Revoke an active client session and affected backend sessions through the internal outbox path.	202, 403

Super Admin

Method	Path	Operation	Summary	Responses
POST	/mcp/super-admin	super_admin_management_mcp	Operate workspaces through the separately authorized super-admin MCP server.	200, 202, 401, 403
GET	/v1/super-admin/operations	list_super_admin_management_operations	Discover the caller’s super-admin operations and input schemas shared with MCP and CLI.	200, 401, 403
POST	/v1/super-admin/operations/{operation_id}	call_super_admin_management_operation	Execute a super-admin operation through the shared authorized service.	200, 400, 401, 403, 404, 409
GET	/v1/super-admin/workspaces	list_super_admin_workspaces	List workspaces with lifecycle, member count, and concurrency version metadata.	200, 401, 403
GET	/v1/super-admin/workspaces/{workspace_id}	get_super_admin_workspace	Inspect one workspace before an operator lifecycle change.	200, 401, 403, 404
GET	/v1/super-admin/workspaces/{workspace_id}/activity	list_super_admin_workspace_activity	Read committed operator activity for one workspace with stable cursor pagination.
POST	/v1/super-admin/workspaces/{workspace_id}/lifecycle	transition_super_admin_workspace_lifecycle	Change workspace lifecycle with an explicit reason and expected version.	200, 400, 401, 403, 404, 409

Support

Method	Path	Operation	Summary	Responses
POST	/v1/support/cases	create_support_service_case	Authorize a support case from received email reported by Nila.	200, 401, 403, 409
GET	/v1/support/cases/{id}	get_support_service_case	Revalidate current case authority before private delivery.	200, 403, 404
POST	/v1/support/cases/{id}/revoke	revoke_support_service_case	Revoke the service case without discarding its audit history.	200, 404
GET	/v1/support/policy	get_support_service_policy	Read workspace support opt-in using the native hosted admin session.	200, 403
PUT	/v1/support/policy	update_support_service_policy	Set workspace support opt-in with native session and CSRF protection.	200, 403
GET	/v1/support/changes/operations	list_support_proposal_operations	List permitted operations that the customer may approve; this grants no execution authority.	200, 403
POST	/v1/support/changes	propose_support_change	Persist one immutable operation and its exact inputs for customer review.	200, 400, 403
GET	/v1/support/changes/{id}	get_support_change	Read the exact same-identity customer proposal and its observed outcome.	200, 403, 404
POST	/v1/support/changes/{id}/confirm	confirm_support_change	Accept or decline the exact customer proposal using a hosted browser session and CSRF.	200, 400, 403, 409
GET	/v1/support/changes/{id}/review	review_support_change	Show the customer exact immutable inputs before a decision.	200, 403
GET	/v1/support/changes/review.js	get_support_change_review_script	Serve the same-origin customer approval interaction script.	200
GET	/v1/support/connections/current/receipts/{requestId}	get_support_management_receipt	Read a durable management receipt for the current support connection

Tenants

Method	Path	Operation	Summary	Responses
POST	/tenants/{tenant_id}/environments/{environment_id}/servers/{server_id}/mcp	path_scoped_mcp_server_post	Path-scoped MCP Streamable HTTP request for one registered server.	200, 202, 400, 401, 403, 429, 503
GET	/tenants/{tenant_id}/environments/{environment_id}/servers/{server_id}/mcp	path_scoped_mcp_server_get	Check path-scoped MCP Streamable HTTP GET support.	405, 401, 403, 429, 503
DELETE	/tenants/{tenant_id}/environments/{environment_id}/servers/{server_id}/mcp	path_scoped_mcp_server_delete	Delete a path-scoped MCP session after authenticating the request actor.	202, 401, 403, 429, 503

V1

Method	Path	Operation	Summary	Responses
GET	/api/v1/hosted/auth/social/google/callback	complete_hosted_google_social_auth_api_callback	Complete hosted Google signup/login through the public API prefix.	303
GET	/api/v1/hosted/auth/social/github/callback	complete_hosted_github_social_auth_api_callback	Complete hosted GitHub signup/login through the public API prefix.	303
POST	/internal/v1/managed/assignments	assign_managed_tenant_from_roster	Apply one approved commercial-roster assignment.	200, 400, 401, 403, 404, 409, 503
POST	/internal/v1/managed/quota-periods/{quota_period_ref}/support-credit-requests	create_managed_support_credit_request	Request a managed quota support credit.	200, 400, 401, 403, 404, 409, 503
POST	/internal/v1/managed/support-credit-requests/{request_ref}/approve	approve_managed_support_credit_request	Approve an above-threshold managed support credit.	200, 400, 401, 403, 404, 409, 503
GET	/internal/v1/runtime/projection	get_runtime_projection	Export one CP-published runtime projection to its configured data plane.	200, 403, 503
POST	/internal/v1/runtime/fleet/sessions	create_managed_fleet_heartbeat_session		201, 401, 409, 503
GET	/internal/v1/runtime/fleet/projection	get_managed_fleet_projection		200, 401, 409, 503
POST	/internal/v1/runtime/fleet/heartbeats	post_managed_fleet_heartbeat		200, 400, 401, 409, 503
GET	/internal/v1/runtime/fleet/readiness	get_managed_fleet_readiness		200, 401, 409, 503
POST	/internal/v1/runtime/consumer-oauth/jwks-refresh-signals	signal_consumer_oauth_jwks_refresh	Submit bounded unknown-key refresh signals from a data plane.	202, 400, 403
POST	/internal/v1/runtime/consumer-oauth/revocation-acknowledgements	acknowledge_consumer_oauth_revocations	Acknowledge locally applied Consumer OAuth revocations.	202, 400, 401, 403, 503

Webhook Event Types

Method	Path	Operation	Summary	Responses
GET	/v1/webhook-event-types	list_webhook_event_types	List the immutable release-seeded generic webhook event catalog.	200, 403, 422, 503
GET	/v1/webhook-event-types/{event_type}	get_webhook_event_type	Read one exact immutable event catalog version.	200, 403, 404, 422, 503
POST	/v1/webhook-event-types/{event_type}:deprecate	deprecate_webhook_event_type	Deprecate one stable generic webhook event type version.	200, 403, 404, 409, 422, 503
POST	/v1/webhook-event-types/{event_type}:retire	retire_webhook_event_type	Retire one deprecated generic webhook event type version.	200, 403, 404, 409, 422, 424, 503

Webhook Subscriptions

Method	Path	Operation	Summary	Responses
GET	/v1/webhook-subscriptions	list_webhook_subscriptions	List generic webhook subscriptions with current revisions and observed health.	200, 403, 422, 503
POST	/v1/webhook-subscriptions	create_webhook_subscription	Create a disabled generic webhook subscription and immutable revision one.	201, 403, 409, 422, 424, 429, 503
GET	/v1/webhook-subscriptions/{subscription_id}	get_webhook_subscription	Read one generic webhook subscription, current revision, and observed health.	200, 403, 404, 422, 503
PUT	/v1/webhook-subscriptions/{subscription_id}	revise_webhook_subscription	Append an immutable subscription revision and leave it disabled pending explicit enable.	200, 403, 404, 409, 422, 424, 429, 503
POST	/v1/webhook-subscriptions/{subscription_id}/test	test_webhook_subscription	Enqueue a synthetic conformance event through the generic webhook worker.	200, 202, 403, 404, 409, 422, 424, 429, 503
GET	/v1/webhook-subscriptions/{subscription_id}/dependencies	get_webhook_subscription_dependencies	Read the exact target, endpoint, credential, catalog, and backlog dependencies for one subscription.	200, 403, 404, 422, 503
POST	/v1/webhook-subscriptions/{subscription_id}:archive	archive_webhook_subscription	Start an idempotent archive job for a disabled generic webhook subscription.	202, 403, 404, 409, 422, 424, 429, 503
POST	/v1/webhook-subscriptions/{subscription_id}/backlog:dispose	dispose_webhook_subscription_backlog	Continue an authorized subscription archive by disposing its frozen backlog.	202, 403, 404, 409, 422, 424, 503
POST	/v1/webhook-subscriptions/{subscription_id}/enable	enable_webhook_subscription	Explicitly activate the current subscription revision.	200, 403, 404, 409, 422, 424, 429, 503
POST	/v1/webhook-subscriptions/{subscription_id}/disable	disable_webhook_subscription	Close the current activation interval and pause pending work.	200, 403, 404, 409, 422, 503
GET	/v1/webhook-subscriptions/{subscription_id}/deliveries	list_webhook_deliveries	List generic webhook delivery and attempt evidence.	200, 403, 404, 422, 503
GET	/v1/webhook-subscriptions/{subscription_id}/deliveries/{delivery_id}	get_webhook_delivery	Read one generic webhook delivery and its bounded safe attempt evidence.	200, 403, 404, 422, 503
POST	/v1/webhook-subscriptions/{subscription_id}/deliveries:redrive	redrive_webhook_deliveries	Idempotently re-drive a bounded set of dead-lettered generic deliveries.	200, 403, 404, 409, 422, 424, 429, 503

Usage notes

Use the response contract for the declared failure shape. If implementation and specification differ, resolve the contract mismatch before relying on an undocumented field. Examples should contain safe identifiers and no credentials.

Source truth

• contracts/openapi/admin-api.yaml
• contracts/openapi/mcp-oauth.yaml
• apps/docs/scripts/generate-reference-pages.mjs

Next

• Read Schemas for JSON Schema contracts.
• Read gatewayctl for CLI parity surfaces.
• Read Audit Events for retained event fields.