Admin

List the normalized bare registry refs that this cell routes globally. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The set is evaluated in the cell-local routing snapshot alongside images.global.

Add or update a normalized bare registry ref in this cell's global-routing set. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The set is cell-local because the routing snapshot is cell-local.

Remove one normalized bare registry ref from this cell's global-routing set. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The ref is a query parameter because image refs contain / and :.

List the global-region groups. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The global-region catalog is served centrally: served on home and central cells (central is the write authority for this replicated tenancy metadata); a workload cell answers 501 MANAGEMENT_PLANE_ELSEWHERE.

Create a global-region group. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The global-region catalog is served centrally: served on home and central cells (central is the write authority for this replicated tenancy metadata); a workload cell answers 501 MANAGEMENT_PLANE_ELSEWHERE.

Rename a global-region group. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The global-region catalog is served centrally: served on home and central cells (central is the write authority for this replicated tenancy metadata); a workload cell answers 501 MANAGEMENT_PLANE_ELSEWHERE.

List the affinity-group routing state for the current cell. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. Group membership, breaker state, and vslot routing are cell-local, so callers must query the cell whose fleet they want to inspect.

List the registry and Dockerfile images known to this cell's layer index; capture and Windows images are not listed. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. Image routing flags and indexed layer totals are cell-local because the manifest and layer index describe the current cell's storage.

Update operator-only image flags on the owning cell. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The global flag changes only routing within the image's own cell; it does not copy artifacts, mutate workload-plane JSON fields, or make the image visible to any other project. Only setting global: true is restricted to registry and dockerfile images; global: false is accepted on any image to clear a stale flag.

List the indexed layer stack for one image on the owning cell. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. Layer sharing and reclaimability are cell-local because the manifest and layer index describe the current cell's storage.

Backfill missing manifest-layer index rows on this cell. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The work is cell-local because manifests are read through this cell's own runners.

List every artifact on this cell that still references one diff-id. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The answer is cell-local because layer reachability is determined from this cell's manifest index and live VM rows.

List the imported Macro regions (one per workload cell). This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The Macro catalog is served by whichever deployment mounts the management plane from the replicated topology metadata: Home in a fused deployment, Central in a split deployment; a workload cell answers 501 MANAGEMENT_PLANE_ELSEWHERE.

Rename one Macro region or move it under a different Geo region. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. Macro regions are imported from deployment inventory, so only the display name and Geo parent are editable here; the Macro id and its bound cell remain immutable.

List the indexed layer stack for one manifest name on this cell. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The answer is cell-local because manifest indexing happens against this cell's storage.

List this cell's platform images: operator-published Linux images every organization and project can create sandboxes from, with the cell's platform default per class. Requires the platform-operator credential: an OIDC JWT for a configured platform admin, or the internal token. Served on home and workload cells, each answering for its own images; a central deployment answers 501 WORKLOAD_PLANE_ELSEWHERE.

Publish a platform image on this cell: import a public registry ref, pinned by digest, under a name every project can create sandboxes from. A project's own image of the same name takes precedence for that project. Idempotent per name and ref: publishing an existing name with the same ref answers 200 and enqueues nothing, unless its import failed, which retries it. Platform images are immutable; a new ref needs a new name. Requires the platform-operator credential (an OIDC JWT for a configured platform admin, or the internal token).

Clear the cell's platform default image for a class (idempotent). A POST /sandboxes without image then answers 400 DEFAULT_IMAGE_NOT_CONFIGURED. Requires the platform-operator credential (an OIDC JWT for a configured platform admin, or the internal token).

Set the cell's platform default image for a class: the image a POST /sandboxes without image boots. Only linux. The image must be a ready, non-deprecated Linux platform image. Takes effect on the next create. Requires the platform-operator credential (an OIDC JWT for a configured platform admin, or the internal token).

Deprecate or restore a platform image, or change its description. A deprecated image takes no new creates by name and is not listed to tenants; sandboxes that already use it keep booting, and its img_… id still resolves. The current default cannot be deprecated. Requires the platform-operator credential (an OIDC JWT for a configured platform admin, or the internal token).

Delete a platform image. Refused while any sandbox references it or while it is the platform default; deprecate it first to stop new creates. Requires the platform-operator credential (an OIDC JWT for a configured platform admin, or the internal token).

List the concrete region catalog visible on this cell for operator routing. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. Workload and home cells serve the concrete regions they mount. A standalone central deployment does not author a concrete-region catalog: it keeps this GET only as the cell router's authenticated discovery oracle, returning the empty response the router replaces with its own directory.

List the global registry credentials: credentials an operator stored for image pulls by every organization, each scoped to a registry host and a repository prefix. Passwords are never returned. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token. Served on home and workload cells (each reads its own rows, where its pulls resolve); a central deployment answers 501 WORKLOAD_PLANE_ELSEWHERE.

Create or replace the global registry credential for a registry host and repository prefix. Every organization's pulls of an image under that prefix authenticate with it; an empty prefix covers every repository on the host. A prefixed credential takes precedence over a project's own credential for the host; a host-wide one does not. With import_only: true the credential serves only pulls of images the platform imported from Daytona v1 (the archived-sandbox import), never an organization's own pull of the same image ref — set it for a v1 registry, which holds every organization's backups. import_only absent keeps the stored value on a replace (false on a create). The password is write-only; an empty password keeps the stored one when the kind and username are unchanged. For kind: ecr with a new secret, the keys must belong to the AWS account in the host. Requires the platform-operator credential (an OIDC JWT for a configured platform admin, or the internal token).

Delete a global registry credential (idempotent). New pulls stop using it; images already cached with it stay bootable for existing sandboxes. Requires the platform-operator credential (an OIDC JWT for a configured platform admin, or the internal token).

List the runner fleet visible to the current cell. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. Runner liveness and capacity are cell-local, so callers must query the cell whose fleet they want to inspect; a standalone central deployment has no fleet and answers 501 workload_plane_elsewhere with the workload API URL to use instead.

Get one runner and every sandbox currently recorded on it. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. Runner state is cell-local, so the request must go to the cell that owns the runner.

Cordon a runner so it stops accepting new work. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The change applies only on the runner's own cell, where its heartbeats and NATS control channel live.

List one runner's NATS credentials (live and revoked; never the token or its hash). Requires an operator's own login: the internal token is refused on this route.

Mint a NATS credential for one runner (PLAN-NATS-CLIENT-IDENTITY.md D4/D14/D15). The token is returned once and only its hash is stored; the runner presents it to the api's auth callout and receives a user JWT scoped to its own subjects. Requires an operator's own login (OIDC JWT of a configured platform admin): the internal token is refused on this route, automation mints with rlp-api nats-runner-credential mint. An empty body means the configured default lifetime; expires_at and no_expiry are mutually exclusive, and an unknown field is a 400.

Revoke EVERY live NATS credential of a runner — the decommission step. 200 with the count, also when it is zero. Requires an operator's own login: the internal token is refused on this route.

Revoke one NATS credential of a runner. A connection authenticated with it is cut the next time the callout or the bus re-evaluates it. Requires an operator's own login: the internal token is refused on this route.

Return a runner to the active scheduling state. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The change applies only on the runner's own cell, where its heartbeats and NATS control channel live.

Per-runner billed usage over time (hourly or daily), proxied verbatim from rlp-billing's ClickHouse export of delivered billing events. This route requires the platform-operator credential: either an OIDC JWT for a configured platform admin or the internal token; organization roles and org API keys are not accepted. The runner must exist on the addressed cell.