APIs
REST resources
The API has hundreds of routes. This page is the map. For the exact method, path, permission, and input schema of any operation, call GET /agent/tools or GET /openapi.json. Those catalogs are generated from the running product.
Studio routes are documented separately in the Studio API.
Auth and identity
| Prefix | What it manages | Representative routes |
|---|---|---|
/auth | Sessions | POST /auth/login, POST /auth/refresh, GET /auth/sessions |
/api-tokens | Programmatic sk_ tokens | GET/POST /api-tokens, DELETE /api-tokens/{id} |
/users, /groups, /roles | People, service accounts, RBAC | GET/POST /users, GET /roles |
/identity | IdP configuration, break-glass | GET/POST /identity/providers, POST /identity/providers/{id}/test, GET/PUT /identity/break-glass |
/tenants | Tenant registry and key policy | GET/POST /tenants, PUT /tenants/{id}/key-policy |
Providers are hot-reloaded on save. POST /identity/providers/{id}/test checks configuration without opening a network session. See Connect an identity provider.
Builder
| Prefix | What it manages | Representative routes |
|---|---|---|
/sources | Inbound listeners and pollers | GET/POST /sources, POST /sources/{id}/probe, GET /sources/{id}/checkpoints |
/destinations | Outbound endpoints | GET/POST /destinations, POST /destinations/{id}/probe |
/connectors | Catalog and templates | GET /connectors, GET /connectors/{kind}, POST /connectors/{kind}/validate, POST /connectors/{kind}/probe |
/components | Running integrations | GET/POST /components, POST /components/{id}/start|stop|restart, GET /components/{id}/health |
/workflows | Visual graphs and versions | GET/POST /workflows, PUT …/versions/{v}/graph, POST …/validate|publish|revert|reactivate, GET …/export, POST /workflows/import |
A source or destination is a named, reusable connector in the tenant registry. A workflow is the graph. A component is the compiled, runnable integration.
Probe bodies look like { "mode": "dry_run"|"live", "settings": {}, "sample": "" }. Dry-run builds the connector and does no I/O. Live exercises the real path.
Graph bodies are top-level nodes and edges — do not wrap them in a graph object. Node kinds: source, transform, router, filter, destination. Bind I/O with connector_kind + settings, or source_ref / destination_ref.
See Build a flow and Export and import.
Messages and operations
| Prefix | What it manages | Representative routes |
|---|---|---|
/messages | Ledger and replay | GET /messages, POST /messages/{queue_id}/{seq}/replay |
/failures | Dead-letter queue | GET /failures, POST /failures/{id}/retry|resolve|terminal |
/operations | Dashboard and instance metrics | GET /operations/overview, GET /operations/instance/metrics, GET/PUT /operations/monitoring/settings |
/runtime | Supervisors, outbox, incidents | GET /runtime/supervisors, POST /runtime/outbox/replay |
/txcoord | In-flight multi-destination transactions | GET /txcoord/transactions, GET /txcoord/transactions/{id} |
/logs | Search, retention, export | GET /logs, GET/PUT /logs/policy |
/alerts | Rules, channels, instances | GET/POST /alerts/rules, POST /alerts/channels/{id}/test, POST /alerts/instances/{id}/ack |
/diagnostics | Connectivity and support bundles | POST /diagnostics/* |
Replay and retry create new history. terminal on a failure is irreversible.
See Replay a message, Watch the runtime, and Page on failure.
Platform
| Prefix | What it manages | Representative routes |
|---|---|---|
/deployments | Promotion pipeline | GET/POST /deployments, POST /deployments/{id}/advance|rollback |
/upgrade, /db | App + data-layer upgrade | POST /upgrade, POST /db/snapshots, POST /db/restore |
/backup | Backup lifecycle | GET/POST /backup/* |
/cluster | HA membership | POST /cluster/join, GET /cluster/config-bundle |
/env, /secrets, /keys | Settings and encryption | GET/PUT/DELETE /env, GET/PUT/DELETE /secrets |
/license | License status | GET /license, POST /license |
/audit | Audit trail | GET /audit |
/access-review | Attestation and evidence | /access-review/* |
Standards, processes, and agents
| Prefix | What it manages | Representative routes |
|---|---|---|
/schemas, /parsers, /scripts | Message models | GET/POST /schemas |
/edi | EDI companion guides | GET/POST /edi/* |
/codecs | Stateless parse / set / validate | POST /codecs/{family}/parse (and serialize, get, set, validate) |
/bpmn | Long-running processes | POST /bpmn/processes/import, POST …/execute|run, POST /bpmn/processes/{id}/instances |
/streams | Streaming topologies | GET /streams/readiness, GET/POST /streams/topologies, POST …/run|enable |
/migration | Native translation of existing scripts | POST /migration/{engine}/analyze, …/translate |
/agent | Tools, skills, chat | GET /agent/tools, GET /agent/skills, POST /agent/chat |
/fix/sessions | Live FIX session state | GET /fix/sessions |
Codec families include ISO 20022, FIX, and related interchange formats. The {engine} segment on /migration is the source dialect you are leaving — the output is always native Sirius.
A route that exists in the catalog but is not wired in this deployment returns 501 not_configured. That is configuration, not a missing product.
Deeper pages: Identity, Operations, Advanced.