Looking for the complete API reference?

Every public endpoint, schema, and auth requirement is generated from the live OpenAPI specification.

Open full API reference OpenAPI JSON
Sandbox

Build a request

Choose an implemented route family, set a base URL, and generate a cURL command plus example response shape.

POST

Register tenant

API FAQ

Create a tenant and bootstrap an administrator user.

HTTP
POST /api/tenancy/tenant-registrations
Content-Type: application/json
Request Body
{
  "tenantName": "Acme Corp",
  "tenantSlug": "acme",
  "userName": "acme-admin",
  "email": "[email protected]",
  "password": "ChangeThisPassword123!",
  "planCode": "developer"
}
cURL
Example Response
{
  "tenantId": "...",
  "organizationId": "...",
  "administratorUserId": "..."
}
Route Families

Public API map

Use these guide cards to move from request examples to implementation-specific boundaries.

Protocol

Discovery, tokens, userinfo, device flow, and mTLS

Use discovery metadata for protocol endpoints. OAuth device authorization is available when enabled and provisioned. mTLS token requests require safe certificate forwarding or direct termination.

  • /.well-known/openid-configuration
  • /connect/token
  • /connect/userinfo
  • /connect/deviceauthorization
  • /connect/mtls/token
Device Trust

Activation, credentials, posture, fleet inventory

Installed-device routes cover activation, approval, heartbeat, offline lease renewal, transfer, revoke, credential lifecycle, posture snapshots, and fleet queries.

Open device API guide
Authorization

Runtime access checks

Use runtime authorization routes for feature and action checks. Use scoped checks when access decisions also need resource or entitlement context.

  • /api/runtime/authorization/me
  • /api/runtime/authorization/check
  • /api/runtime/authorization/check-scoped
Enterprise

OIDC, SCIM, diagnostics

Enterprise routes manage OIDC/SAML setup metadata, SCIM tokens, diagnostics, and connection-scoped SCIM user and group lifecycle.

Open enterprise API guide