Every endpoint of the management API that your application's operator console uses, with the credential each one needs.
The management API is the API your application's operator console uses: every action in the console has a matching endpoint below. It is served by your application's region. This page is an index of the endpoints; request and response bodies are not described here yet.
Common conventions
Credentials. The Credential column names what an endpoint needs in Authorization: Bearer <token>:
Credential
What it is
Operator session
The access token of a member of your organization signed in to the operator console, obtained with POST /mgt/v1/auth/login on the operator console's host and renewed with POST /mgt/v1/auth/refresh. The session belongs to one organization and one current application; POST /mgt/v1/auth/switch changes them
Node credential
A credential that ShipRev holds to set up and remove a region's tenants; you do not call these endpoints
None
No bearer token. The endpoint relies on something else: credentials or a one-time token in the request body, the refresh cookie set at sign-in, or the request's host
Most endpoints also need a role in the organization: reading needs any role, and changing needs owner or admin. Paths with {orgId} must name the session's organization, and paths with {projectId} an application of that organization; otherwise the answer is 403 or 404.
Requests and answers. Bodies are JSON. Unknown fields in a request body are dropped. An error answers with the body described in Error codes, with a stable code.
Lists. The Query column names the query parameters an endpoint takes. Lists that page take limit together with either page or cursor.
Writes while ShipRev is unreachable. If your application's region has not had an answer from ShipRev about your plan within the validity period, new writes are refused with 403 UPSTREAM_LEVEL_RESTRICTED; see If the link between your region and ShipRev is interrupted.
Endpoints
Credentials
Method
Path
Credential
Query
Purpose
POST
/mgt/v1/m2m/token
None
Exchange a management-scoped API key for a short-lived signed access token
GET
/mgt/v1/credentials
Operator session
organization_id, project_id, scope
List machine credentials of your organization, optionally filtered by application or scope
POST
/mgt/v1/credentials
Operator session
Create a machine credential (API key) for your organization or one application
DELETE
/mgt/v1/credentials/{id}
Operator session
organization_id
Revoke a machine credential so it can no longer be exchanged for tokens
Bootstrap
Method
Path
Credential
Query
Purpose
GET
/mgt/v1/bootstrap/status
None
Check whether this deployment has already completed its first-run bootstrap
POST
/mgt/v1/bootstrap
None
Set up a new deployment with its tenant, first owner and operator domain
Operator sign-in and session
Method
Path
Credential
Query
Purpose
POST
/mgt/v1/auth/login
None
Sign an operator in with email and password and obtain a session token
GET
/mgt/v1/auth/me
Operator session
Read the signed-in operator profile, memberships and current organization context
PATCH
/mgt/v1/auth/me
Operator session
Update profile preferences of the signed-in operator, such as display name
POST
/mgt/v1/auth/switch
Operator session
Switch the session to another organization or application and receive a new token
POST
/mgt/v1/auth/refresh
None
Obtain a fresh operator access token using the refresh cookie from login
POST
/mgt/v1/auth/logout
Operator session
Sign out of the current operator session and clear the refresh cookie
POST
/mgt/v1/auth/logout-all
Operator session
Sign the operator out everywhere by revoking all of their active sessions
Brand domains
Method
Path
Credential
Query
Purpose
GET
/mgt/v1/identities/{identityId}/domains
Operator session
List the custom brand domains registered for one of your identity gates
POST
/mgt/v1/identities/{identityId}/domains
Operator session
Register a custom brand domain for one of your identity gates