REST API overview
Everything in the console is also a REST API - the same one the dashboard uses. It's the operator surface: enroll devices, publish signed artifacts, drive rollouts, pull compliance evidence. The agent on each device uses a separate, mTLS-only gRPC service - see Device gRPC API.
Base path and versioning
All endpoints live under a versioned prefix:
https://<your-domain>/api/v1/...
JSON in, JSON out - except files (SBOM uploads, report PDFs, log bundles), which use their native content types.
Authentication
Two credentials are accepted, and most endpoints take either:
- Session cookie - issued by
POST /api/v1/auth/loginand stored as an httpOnly cookie. This is what the browser console uses. - API key - a bearer token for automation. Send it as
Authorization: Bearer <key>. Create keys in the console; the plaintext is shown once at creation and only its hash is stored.
curl https://<your-domain>/api/v1/devices \
-H "Authorization: Bearer <your-api-key>"
A few endpoints are session-only - creating users and managing keys - so a leaked key can't mint more keys or users. API keys do full day-to-day fleet work, never user or key administration.
What the API covers
| Area | Endpoints |
|---|---|
| Auth & profile | POST /auth/login, POST /auth/logout, GET /auth/me, GET/PATCH /profile |
| Devices | GET /devices, GET /devices/{name}/history, DELETE /devices/{name}, device log request/download |
| Enrollment | POST /enroll-tokens, GET /enroll-tokens, DELETE /enroll-tokens/{id} |
| Artifacts | POST /artifacts, GET /artifacts, PATCH /artifacts/{id}, SBOM attach/download |
| Registries | POST /registries, GET /registries, tag browse and import |
| Groups & rollouts | POST /groups, POST /rollouts, rollout approve / resume / abort, rollout detail |
| Evidence & compliance | incident reporting, audit-trail export, readiness and vulnerability reports |
| Administration | API keys, users, report branding |
Every route is gated on the permission it needs - a viewer-scoped credential reads but can't change the fleet, and a request missing a permission is refused with that permission named.
Conventions
- Publishing is always signed. An artifact enters the update-signing repository before any record of it exists. There is no unsigned publish path.
- Metadata only. We record artifact metadata, SBOMs you attach, and audit events
- never the contents of your application or model payloads.
- Pagination and errors are uniform across list endpoints - see Errors & pagination.