Runners
Scoped to runners that currently host one of the caller's project's live
sandboxes (any non-terminal status — stopped/paused persistent sandboxes
are still placed there): any other id — malformed, unknown, another
tenant's placement, or a runner the project only used in the past — is a
400 or a 404, never a probe.
AuthorizationBearer <token>Project API key (dtn_…) as a Bearer token. Mint via the management API (POST /projects/:id/api-keys) or this deployment's key-mint CLI. Every key carries an explicit set of verb:resource project permissions chosen at mint time (PLAN-API-KEY-PERMISSIONS.md); each operation lists the project permission it requires in its security requirement, and a key lacking it is answered 403 missing required project permission: <project-permission>. Some operations require an additional permission depending on the request body, stated in the operation's description. Holding a mutating verb (write:/delete:/invoke:) implies the resource's read: permission. Operations whose api_key project-permission list is empty need no specific project permission — any live project key works (the global catalogs and the artifact-cache read).
Scope: read:runners
id*stringrunner id ([A-Za-z0-9_-]{1,128})
Capacity report (live or last heartbeat)
application/json- response
One runner's capacity report.
capacity*unknownCapacity document as produced by the runner (free-form JSON).
id*stringRunner id.
source*stringlive — fresh NATS probe of the runner; heartbeat — the runner was
unreachable, so this is its last stored heartbeat capacity.
curl -X GET 'https://example.com/runners/string/capacity'{ "capacity": null, "id": "string", "source": "string"}