Daytona API

Sandbox (micro-VM) lifecycle: create, list, inspect, start/stop/pause/resume/fork/delete, logs, runtime mounts, and network-policy desired/applied state.

Image build + registry-ref resolution, list, and the shared artifact cache.

Moving an organization from Daytona v1: what came over for the caller's organization, its v1 sandboxes, and importing an archived one as a persistent sandbox in the default project.

Sandbox snapshots: capture, list, delete; create-from-snapshot.

Persistent disk volumes and S3 bucket volumes (PLAN-VOLUMES.md, PLAN-VOLUME-TYPES.md).

Project-scoped secrets. Values are write-only — never returned by any endpoint.

Project-scoped private container registries. Passwords are write-only.

HTTP preview endpoints exposing a sandbox's in-VM ports through the proxy.

Region catalog for SDK target discovery (read-only).

Hardware catalogs: CPU types, network classes, disk classes (read-only).

Async job status reads.

Runner fleet reads available to project keys.

Project-scoped usage reports.

Identity of the signed-in management-plane user.

Organization lifecycle and org-scoped reads.

Project lifecycle, membership reach, and project-scoped management reads.

Organization and project membership plus feature-flag reads.

Organization invitations: create (which emails the invitee a single-use link when SMTP is configured), list, revoke, and the token-authorized lookup, accept and decline.

Fixed role catalog and permission metadata.

Project and organization API-key mint/list/read/revoke surfaces, and introspection of the project key presented on a workload request.

Non-human principals and their project reach.

Organization billing, wallet, invoice, and payment proxy routes.

Organization audit-log queries and capture configuration, and the supported action × target-type matrix.

Platform-operator routes under `/manage/*`: runner operations, cell-local routing/layer introspection, and global/macro region management from whichever deployment mounts the management plane (Home in a fused deployment, Central in a split deployment). Workload cells forward the management-owned subset there.

Health and readiness probes.

Token exchange: trade a signed-in user's OIDC session for a short-lived project-scoped platform token (RFC 8693).