enterprise_ai.manager.operations

Source: sdks/python/src/enterprise_ai/manager/_generated.py. Back to the Python SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Class AgentTemplatesApi

Agent templates. The registry of the agent templates (Service Templates of the Navin products such as the Navin Enterprise RAG Agent): each template with its name, publisher, version, status and the catalog service that installs it. A template is published only when that service exists in the catalog and the template was published, by the release (status published) or on this Manager by an administrator (POST .../publish, the validation of the customer: the service definition joins the catalog of this Manager); otherwise reason says why it cannot be deployed and publishable whether it can be published here. Reading is open to any signed in user, like the stack catalog; publishing and withdrawing need agent_templates:publish. Operations of this group of the Navin Manager API.

Resource

AgentTemplatesApi.agent_template

agent_template(template_id: str) -> Any

Get an agent template. One agent template by its identifier: name and description (fr and en), publisher, version, status, catalog service, documentation and source paths, components, published, reason, publication, publishable and publish_blocker. Any signed in user; 404 for an unknown template.

Route: /api/v1/agent-templates/{template_id} (GET).

Name	Type	Default	Required	Description
template_id	str		yes	Identifier of the agent template, equal to the name of its descriptor file.

Returns: Any. Decoded JSON answer of the operation "Get an agent template".

Raises: the typed errors of the transport (Errors).

AgentTemplatesApi.agent_templates

agent_templates() -> Any

List the agent templates. Every agent template of the registry, sorted by identifier, with published computed against the loaded catalog and the publications of this Manager, reason (fr and en) when it cannot be deployed, publication (version, who, when) when it was published here, publishable and publish_blocker. Returns items and count. Any signed in user.

Route: /api/v1/agent-templates (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the agent templates".

Raises: the typed errors of the transport (Errors).

AgentTemplatesApi.publish_agent_template

publish_agent_template(template_id: str) -> Any

Validate and publish an agent template. The validation of the customer: the service definition and the templates of the agent are checked by the catalog loader together with the whole catalog (on a staging copy, nothing is written when a check fails), then copied under published_templates_dir; the service joins the catalog of this Manager, the template answers published: true and its Deploy button opens the install wizard. Publishing again replaces the files with the current sources. Returns the template. Permission agent_templates:publish; audited as agent_template.publish. Errors: 404 agent_template_unknown, 409 agent_template_not_publishable (planned or in development), 409 agent_template_sources_missing, 409 agent_template_already_published (service shipped with the catalog), 422 agent_template_invalid (the problems found are in details.problems).

Route: /api/v1/agent-templates/{template_id}/publish (POST).

Name	Type	Default	Required	Description
template_id	str		yes	Identifier of the agent template.

Returns: Any. Decoded JSON answer of the operation "Validate and publish an agent template".

Raises: the typed errors of the transport (Errors).

AgentTemplatesApi.withdraw_agent_template

withdraw_agent_template(template_id: str) -> Any

Withdraw the publication of an agent template. Removes the service definition and the templates published on this Manager and the publication record: the service leaves the catalog and the template is awaiting validation again. Refused while an instance of the service is installed in a cluster (409 agent_template_in_use, the instances are in details.instances). Returns the template. Permission agent_templates:publish; audited as agent_template.unpublish. Errors: 404 agent_template_unknown, 404 agent_template_not_published.

Route: /api/v1/agent-templates/{template_id}/publication (DELETE).

Name	Type	Default	Required	Description
template_id	str		yes	Identifier of the agent template.

Returns: Any. Decoded JSON answer of the operation "Withdraw the publication of an agent template".

Raises: the typed errors of the transport (Errors).

Class AlertsApi

Alerts and notifications. Alerts raised by the Manager from its alert definitions (host down, disk full, service unhealthy, certificate about to expire...), and the notification targets that receive them. Operations of this group of the Navin Manager API.

Resource

AlertsApi.ack_alert

ack_alert(alert_id: str, body: Any = None) -> Any

Acknowledge an alert. Records who acknowledged the alert, when, and the note; the alert stays open until its condition clears. Returns the alert. Permission alerts:manage on its cluster. Audited as alert.ack.

Route: /api/v1/alerts/{alert_id}/ack (POST).

Name	Type	Default	Required	Description
alert_id	str		yes	Identifier of the alert.
body	Any	None	no	Optional note.

Returns: Any. Decoded JSON answer of the operation "Acknowledge an alert".

Raises: the typed errors of the transport (Errors).

AlertsApi.create_target

create_target(body: Any = None) -> Any

Add a notification target. Creates a target and returns it (201). An email target needs config.to, a webhook target config.url (http:// or https://); a syslog target uses the syslog server of the settings. Permission alerts:manage; 422 notification_target_invalid. Audited as notification_target.create.

Route: /api/v1/notification-targets (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Name, kind, configuration and minimum severity of the target.

Returns: Any. Decoded JSON answer of the operation "Add a notification target".

Raises: the typed errors of the transport (Errors).

AlertsApi.delete_target

delete_target(target_id: str) -> Any

Delete a notification target. Deletes the target. Answers 204. Permission alerts:manage; 404 notification_target_not_found. Audited as notification_target.delete.

Route: /api/v1/notification-targets/{target_id} (DELETE).

Name	Type	Default	Required	Description
target_id	str		yes	Identifier of the notification target.

Returns: Any. Decoded JSON answer of the operation "Delete a notification target".

Raises: the typed errors of the transport (Errors).

AlertsApi.get_alert

get_alert(alert_id: str) -> Any

Get an alert. Returns one alert with the history of its state changes (the last 200: ts, from_state, to_state, value, text). Permission alerts:read on its cluster; 404 alert_not_found.

Route: /api/v1/alerts/{alert_id} (GET).

Name	Type	Default	Required	Description
alert_id	str		yes	Identifier of the alert.

Returns: Any. Decoded JSON answer of the operation "Get an alert".

Raises: the typed errors of the transport (Errors).

AlertsApi.list_alerts

list_alerts(cluster_id: str, state: string | null = None, severity: string | null = None, include_resolved: boolean = None) -> Any

List the alerts of a cluster. Alerts of the cluster, last changed first (at most 500): definition, label, fingerprint, host, service, component, state, text, value, first and last seen, acknowledgement and resolution. Open alerts only unless include_resolved. Permission alerts:read.

Route: /api/v1/clusters/{cluster_id}/alerts (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
state	string | null	None	no	Only the alerts in this state: warning, critical, unknown or ok.
severity	string | null	None	no	Only the alerts of this severity (warning or critical); compared with the state of the alert.
include_resolved	boolean	None	no	Also return the resolved alerts. Default false.

Returns: Any. Decoded JSON answer of the operation "List the alerts of a cluster".

Raises: the typed errors of the transport (Errors).

AlertsApi.list_definitions

list_definitions() -> Any

List the alert definitions. Every definition with its name, scope, kind, label, description, enabled, interval_s, warning and critical thresholds and params. Permission alerts:read.

Route: /api/v1/alert-definitions (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the alert definitions".

Raises: the typed errors of the transport (Errors).

AlertsApi.list_targets

list_targets() -> Any

List the notification targets. Every target with its kind, config, min_severity, enabled and whether an HMAC secret is set (never its value). Permission alerts:manage.

Route: /api/v1/notification-targets (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the notification targets".

Raises: the typed errors of the transport (Errors).

AlertsApi.patch_definition

patch_definition(definition_id: str, body: Any = None) -> Any

Tune an alert definition. Turns a definition on or off and changes its thresholds or its evaluation interval; a field left out is kept. Returns the definition. Permission alerts:manage; 404 alert_definition_not_found. Audited as alert_definition.update.

Route: /api/v1/alert-definitions/{definition_id} (PATCH).

Name	Type	Default	Required	Description
definition_id	str		yes	Identifier of the alert definition.
body	Any	None	no	Fields of the definition to change.

Returns: Any. Decoded JSON answer of the operation "Tune an alert definition".

Raises: the typed errors of the transport (Errors).

AlertsApi.patch_target

patch_target(target_id: str, body: Any = None) -> Any

Update a notification target. Changes the fields given and returns the target. Permission alerts:manage. Errors: 404 notification_target_not_found, 422 notification_target_invalid. Audited as notification_target.update.

Route: /api/v1/notification-targets/{target_id} (PATCH).

Name	Type	Default	Required	Description
target_id	str		yes	Identifier of the notification target.
body	Any	None	no	Fields of the target to change.

Returns: Any. Decoded JSON answer of the operation "Update a notification target".

Raises: the typed errors of the transport (Errors).

AlertsApi.test_target

test_target(target_id: str) -> Any

Send a test notification. Sends a test message (state warning, fingerprint test) to the target now and returns {"ok": true}. Permission alerts:manage. Errors: 404 notification_target_not_found, 502 notification_failed (the target refused or could not be reached). Audited as notification_target.test.

Route: /api/v1/notification-targets/{target_id}/test (POST).

Name	Type	Default	Required	Description
target_id	str		yes	Identifier of the notification target.

Returns: Any. Decoded JSON answer of the operation "Send a test notification".

Raises: the typed errors of the transport (Errors).

Class AuditApi

Audit. The audit trail of the Manager: every change, sign in, refusal and sensitive read, with the actor (user, API token, agent or system), the action (for example service.install), the target, the cluster, the outcome (success, failure, denied), the client address and details. Events are chained: each one carries the hash of the previous one, so a modified or deleted event breaks the chain. Operations of this group of the Navin Manager API.

Resource

AuditApi.export

export(format: string = None, from_: string | null = None, to: string | null = None) -> Any

Export the audit trail. Streams every event of the period in sequence order as a file download: audit.ndjson (one JSON object per line) or audit.csv (cells a spreadsheet would read as a formula are prefixed with a quote). Permission audit:read; 422 export_format_invalid for another format. Audited as audit.export.

Route: /api/v1/audit/export (GET).

Name	Type	Default	Required	Description
format	string	None	no	File format: ndjson (default) or csv.
from_	string | null	None	no	Events at or after this date and time (ISO 8601). Omit it to start at the first event.
to	string | null	None	no	Events before this date and time (ISO 8601), excluded. Omit it to export up to now.

Returns: Any. Decoded JSON answer of the operation "Export the audit trail".

Raises: the typed errors of the transport (Errors).

AuditApi.list_audit

list_audit(actor: string | null = None, action: string | null = None, target_type: string | null = None, cluster_id: string | null = None, outcome: "success" | "failure" | "denied" | null = None, from_: string | null = None, to: string | null = None, limit: int | None = None, cursor: str | None = None) -> Any

Search the audit trail. Events matching every filter given, newest first: seq, id, ts, actor_type, actor_id, actor_name, action, target_type, target_id, cluster_id, outcome, ip, details, prev_hash, hash. Paginated with limit and cursor. Permission audit:read.

Route: /api/v1/audit (GET).

Name	Type	Default	Required	Description
actor	string | null	None	no	Name or identifier of the actor, exact match.
action	string | null	None	no	Action, exact match (auth.login) or a family ending with .* (service.*).
target_type	string | null	None	no	Type of the target, for example user, service, cluster or operation.
cluster_id	string | null	None	no	Only the events of this cluster.
outcome	"success" | "failure" | "denied" | null	None	no	Outcome: success, failure or denied.
from_	string | null	None	no	Events at or after this date and time (ISO 8601).
to	string | null	None	no	Events before this date and time (ISO 8601), excluded.
limit	int | None	None	no	Maximum number of events in the page, from 1 to 500. Default 50.
cursor	str | None	None	no	The next_cursor of the previous page (a sequence number). Omit it for the first page.

Returns: Any. Decoded JSON answer of the operation "Search the audit trail".

Raises: the typed errors of the transport (Errors).

AuditApi.verify

verify() -> Any

Verify the hash chain of the audit trail. Recomputes the hash of every event and checks the link to the previous one. Returns valid, the number of events checked and first_broken_seq (null when the chain is intact). Permission audit:read. Audited as audit.verify (outcome failure when the chain is broken).

Route: /api/v1/audit/verify (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Verify the hash chain of the audit trail".

Raises: the typed errors of the transport (Errors).

Class AuthApi

Authentication. Sign in and sign out of the console: identity providers, first run setup, local and LDAP login, second factor (TOTP), password change, session and OIDC login. Operations of this group of the Navin Manager API.

Resource

AuthApi.providers

providers() -> Any

List the sign in methods. Public endpoint used by the login page. Returns local (always true), ldap (enabled, name), oidc (the enabled providers, id and name), setup_required (true while no user exists: call POST /auth/setup) and mfa (whether the TOTP second factor is turned on for this Manager).

Route: /api/v1/auth/providers (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the sign in methods".

Raises: the typed errors of the transport (Errors).

AuthApi.session

session() -> Any

Read the current session. Returns the authenticated user (user), its effective permissions (permissions.global and permissions.clusters by cluster identifier), the csrf_token of the session (null for an API token) and expires_at (of the session or of the token). Any authenticated caller; 401 otherwise.

Route: /api/v1/auth/session (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Read the current session".

Raises: the typed errors of the transport (Errors).

Class AuthConfigApi

Identity providers and security policy. Configuration of how users sign in: the LDAP directory, the OIDC providers and the security policy (passwords, lockout, session timeouts, roles that require MFA). Operations of this group of the Navin Manager API.

Resource

AuthConfigApi.create_oidc

create_oidc(body: Any = None) -> Any

Add an OIDC provider. Creates a provider and returns it (201). The scopes must include openid. Permission auth:manage. Errors: 409 provider_name_taken, 422 oidc_config_invalid, 422 role_invalid. Audited.

Route: /api/v1/auth-config/oidc (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Settings of the provider.

Returns: Any. Decoded JSON answer of the operation "Add an OIDC provider".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.delete_oidc

delete_oidc(provider_id: str) -> Any

Delete an OIDC provider. Removes the provider; its users can no longer sign in through it. Answers 204. Permission auth:manage; 404 oidc_provider_not_found. Audited as auth_config.oidc_delete.

Route: /api/v1/auth-config/oidc/{provider_id} (DELETE).

Name	Type	Default	Required	Description
provider_id	str		yes	Identifier of the OIDC provider.

Returns: Any. Decoded JSON answer of the operation "Delete an OIDC provider".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.get_ldap

get_ldap() -> Any

Get the LDAP configuration. Returns the LDAP settings with their defaults, the bind password as {"secret": true, "set": ...} and the role mappings. Permission auth:manage.

Route: /api/v1/auth-config/ldap (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the LDAP configuration".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.get_oidc

get_oidc(provider_id: str) -> Any

Get an OIDC provider. Returns one provider with its settings and mappings. Permission auth:manage; 404 oidc_provider_not_found.

Route: /api/v1/auth-config/oidc/{provider_id} (GET).

Name	Type	Default	Required	Description
provider_id	str		yes	Identifier of the OIDC provider.

Returns: Any. Decoded JSON answer of the operation "Get an OIDC provider".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.get_policy

get_policy() -> Any

Get the security policy. Returns the current policy, defaults included: password minimum length 12, history 5, no maximum age, lockout after 5 failures for 15 minutes, sessions of 30 idle minutes and 12 hours at most, MFA required for admin and security_admin. Permission auth:manage.

Route: /api/v1/auth-config/policy (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the security policy".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.list_oidc

list_oidc() -> Any

List the OIDC providers. Every OIDC provider, enabled or not, with its settings and mappings; client secrets are never returned. Permission auth:manage.

Route: /api/v1/auth-config/oidc (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the OIDC providers".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.put_ldap

put_ldap(body: Any = None) -> Any

Save the LDAP configuration. Replaces the LDAP settings and role mappings and returns them. Every URL must be protected by TLS (ldaps://, or ldap:// with start_tls), at least one URL is needed when enabled, filters must be balanced in parentheses. Permission auth:manage. Errors: 422 ldap_config_invalid (with details.problems), 422 role_invalid. Audited as auth_config.ldap.

Route: /api/v1/auth-config/ldap (PUT).

Name	Type	Default	Required	Description
body	Any	None	no	Complete LDAP settings.

Returns: Any. Decoded JSON answer of the operation "Save the LDAP configuration".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.put_oidc

put_oidc(provider_id: str, body: Any = None) -> Any

Update an OIDC provider. Replaces the settings and mappings of the provider and returns it; the client secret is kept unless a new one is sent. Permission auth:manage. Errors: 404 oidc_provider_not_found, 409 provider_name_taken, 422 oidc_config_invalid. Audited.

Route: /api/v1/auth-config/oidc/{provider_id} (PUT).

Name	Type	Default	Required	Description
provider_id	str		yes	Identifier of the OIDC provider.
body	Any	None	no	Complete settings of the provider.

Returns: Any. Decoded JSON answer of the operation "Update an OIDC provider".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.put_policy

put_policy(body: Any = None) -> Any

Save the security policy. Replaces the whole policy and returns it. It applies to the next password change, sign in and session check. Permission auth:manage; 422 role_invalid for an unknown role in mfa_required_roles. Audited as auth_config.policy.

Route: /api/v1/auth-config/policy (PUT).

Name	Type	Default	Required	Description
body	Any	None	no	Every field of the policy.

Returns: Any. Decoded JSON answer of the operation "Save the security policy".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.test_ldap

test_ldap(body: Any = None) -> Any

Test the LDAP configuration. Binds with the stored settings and, when a test account is given, searches the user, checks its password and reads its groups. Returns ok, bind, user_found, groups and error_code. Nothing is changed. Permission auth:manage; 404 ldap_not_configured. Audited as auth_config.ldap_test.

Route: /api/v1/auth-config/ldap/test (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Optional test account.

Returns: Any. Decoded JSON answer of the operation "Test the LDAP configuration".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.test_oidc

test_oidc(provider_id: str) -> Any

Test an OIDC provider. Reads the discovery document of the issuer and its signing keys. Returns ok, issuer, jwks_keys (number of keys) and error_code. Permission auth:manage; 404 oidc_provider_not_found. Audited as auth_config.oidc_test.

Route: /api/v1/auth-config/oidc/{provider_id}/test (POST).

Name	Type	Default	Required	Description
provider_id	str		yes	Identifier of the OIDC provider.

Returns: Any. Decoded JSON answer of the operation "Test an OIDC provider".

Raises: the typed errors of the transport (Errors).

Class AvailabilityApi

High availability groups. A high availability group describes how one component of a cluster stays available: its HA mode (single, active_passive, active_active, quorum), its profile (standalone, ha with at least 2 replicas in 2 fault domains, critical-ha with at least 3 in 3), its members and their fault domains, its failover policy and its recovery objectives (RTO, RPO). The group reports its HA status from the heartbeats of its members. Operations of this group of the Navin Manager API.

Resource

AvailabilityApi.create_group

create_group(body: Any = None) -> Any

Create a high availability group. Declares a group and its members and returns it (201). The profile must be met by desired_replicas and fault_domains, two members cannot share a host. Permission cluster:manage on the cluster. Errors: 422 ha_profile_unmet, 422 ha_mode_unsupported, 422 ha_members_same_host, 404 cluster_not_found, 404 host_not_found. Audited as ha_group.create.

Route: /api/v1/ha-groups (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The group, its policy and its members.

Returns: Any. Decoded JSON answer of the operation "Create a high availability group".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.get_group

get_group(group_id: str) -> Any

Get a high availability group. Returns the group with its members, its HA status and its last test run. Permission cluster:read on its cluster; 404 ha_group_not_found.

Route: /api/v1/ha-groups/{group_id} (GET).

Name	Type	Default	Required	Description
group_id	str		yes	Identifier of the HA group.

Returns: Any. Decoded JSON answer of the operation "Get a high availability group".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.ha_modes

ha_modes() -> Any

List the deployment modes and their support. Every deployment mode with supported, ha_possible and the reason in both languages. Any signed in user.

Route: /api/v1/ha-modes (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the deployment modes and their support".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.list_groups

list_groups() -> Any

List the high availability groups. Groups of every cluster the caller may read (cluster:read), sorted by name, each with its members, its HA status and its last test run.

Route: /api/v1/ha-groups (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the high availability groups".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.operations

operations(group_id: str) -> Any

Get the failover history of a group. Returns test_runs (status, fencing token, observed RTO and RPO in seconds, evidence, times), fencing_operations (member, method, verified, token) and the last 200 events. Permission cluster:read.

Route: /api/v1/ha-groups/{group_id}/operations (GET).

Name	Type	Default	Required	Description
group_id	str		yes	Identifier of the HA group.

Returns: Any. Decoded JSON answer of the operation "Get the failover history of a group".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.test_failover

test_failover(group_id: str) -> Any

Run a failover test. Takes the failover lease of the group, records a test run with a new fencing token and, when the group is bound to installed components, starts the failover. Answers 202 with run_id, status, fencing_token, executed and the started operations. Permission services:operate. Errors: 409 ha_operation_locked (another failover holds the lease), 409 ha_client_managed_refused. Audited as ha_group.test_failover.

Route: /api/v1/ha-groups/{group_id}/test-failover (POST).

Name	Type	Default	Required	Description
group_id	str		yes	Identifier of the HA group.

Returns: Any. Decoded JSON answer of the operation "Run a failover test".

Raises: the typed errors of the transport (Errors).

Class BackupApi

Backup, restore and disaster recovery. The Backup & Recovery Manager: backup targets and plans, backup artefacts with their verifications, retention, restore tests, restores and disaster recovery (sites, plans, exercises, failovers, DNS and load balancer switches). Operations of this group of the Navin Manager API.

Resource

BackupApi.approve_exercise

approve_exercise(exercise_id: str) -> Any

Approve a DR exercise or failover. Approves the request; the approver must not be the requester. Permission dr:manage. Errors: 403 restore_self_approval, 404 dr_exercise_not_found. Audited as dr.approve.

Route: /api/v1/dr-exercises/{exercise_id}/approve (POST).

Name	Type	Default	Required	Description
exercise_id	str		yes	Identifier of the exercise or failover request.

Returns: Any. Decoded JSON answer of the operation "Approve a DR exercise or failover".

Raises: the typed errors of the transport (Errors).

BackupApi.approve_restore

approve_restore(plan_id: str) -> Any

Approve a restore plan. Adds the approval of the caller; two approvals by people other than the requester are needed. Permission restore:execute. Errors: 403 restore_self_approval, 409 restore_not_approvable. Audited as restore.approve.

Route: /api/v1/restores/{plan_id}/approve (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the restore plan.

Returns: Any. Decoded JSON answer of the operation "Approve a restore plan".

Raises: the typed errors of the transport (Errors).

BackupApi.backup_consistency

backup_consistency(body: Any = None) -> Any

Check the consistency of a backup target. Compares the database rows, the stored objects and the artefact registry of a filesystem target (its bucket is the root directory). With reconcile, rows whose object is gone are marked missing and orphan objects are moved into a quarantine directory, never deleted. Permission backup:manage. Errors: 404 backup_target_not_found, 422 backup_provider_unsupported (not filesystem).

Route: /api/v1/backups/consistency (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Target, registry digests and reconcile flag.

Returns: Any. Decoded JSON answer of the operation "Check the consistency of a backup target".

Raises: the typed errors of the transport (Errors).

BackupApi.complete_exercise

complete_exercise(exercise_id: str, body: Any = None) -> Any

Complete a DR exercise with its measures. Records the observed RPO and RTO, the result and the evidence of an approved exercise or failover. Permission dr:manage; 409 dr_not_approved. Audited as dr.complete.

Route: /api/v1/dr-exercises/{exercise_id}/complete (POST).

Name	Type	Default	Required	Description
exercise_id	str		yes	Identifier of the exercise or failover request.
body	Any	None	no	Observed measures, result and evidence.

Returns: Any. Decoded JSON answer of the operation "Complete a DR exercise with its measures".

Raises: the typed errors of the transport (Errors).

BackupApi.create_dr_plan

create_dr_plan(body: Any = None) -> Any

Create a DR plan. Creates a plan between a primary and a secondary site (created when unknown) and returns it (201). Permission dr:manage. Errors: 422 dr_mode_invalid, 422 dr_same_site. Audited as dr.plan.create.

Route: /api/v1/dr-plans (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Name, mode, sites, targets and sequence of the plan.

Returns: Any. Decoded JSON answer of the operation "Create a DR plan".

Raises: the typed errors of the transport (Errors).

BackupApi.create_plan

create_plan(body: Any = None) -> Any

Create a backup plan. Creates a backup plan on a target and returns it (201). With immutability_required the target must have verified object lock and retention capabilities. Permission backup:manage. Errors: 404 backup_target_not_found, 409 backup_worm_unsupported. Audited as backup.plan.create.

Route: /api/v1/backup-plans (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Target, scope, schedule, encryption and retention of the plan.

Returns: Any. Decoded JSON answer of the operation "Create a backup plan".

Raises: the typed errors of the transport (Errors).

BackupApi.create_target

create_target(body: Any = None) -> Any

Declare a backup target. Creates a target and returns it (201). Permission backup:manage; 422 backup_provider_unsupported. Audited as backup.target.create.

Route: /api/v1/backup-targets (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Provider, location and capabilities of the target.

Returns: Any. Decoded JSON answer of the operation "Declare a backup target".

Raises: the typed errors of the transport (Errors).

BackupApi.declare_traffic

declare_traffic(plan_id: str, body: Any = None) -> Any

Declare a traffic switch of a DR plan. Declares (or replaces) a DNS record or a load balancer of the plan with its value per site and the health check that must pass before a switch (201). Permission dr:manage. Errors: 422 dr_traffic_invalid, 404 dr_plan_not_found. Audited as dr.traffic.declare.

Route: /api/v1/dr-plans/{plan_id}/traffic (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the DR plan.
body	Any	None	no	Kind, name and specification of the switch.

Returns: Any. Decoded JSON answer of the operation "Declare a traffic switch of a DR plan".

Raises: the typed errors of the transport (Errors).

BackupApi.delete_backup

delete_backup(backup_id: str) -> Any

Delete a backup. Deletes a backup artefact whose retention is over. Permission backup:manage. Errors: 409 backup_retention_active (before expires_at), 404 backup_artifact_not_found. Audited as backup.delete.

Route: /api/v1/backups/{backup_id} (DELETE).

Name	Type	Default	Required	Description
backup_id	str		yes	Identifier of the backup artefact.

Returns: Any. Decoded JSON answer of the operation "Delete a backup".

Raises: the typed errors of the transport (Errors).

BackupApi.dry_run_restore

dry_run_restore(plan_id: str) -> Any

Dry run a restore plan. Checks the digest, decryption and compatibility without writing to the destination, and returns the recorded approvers. For a named destination it also checks its identity, emptiness and restricted role (checks.destination, checks.executor). A successful dry run does not authorize execution: two approvals are still required. Permission restore:execute. Audited as restore.dry_run.

Route: /api/v1/restores/{plan_id}/dry-run (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the restore plan.

Returns: Any. Decoded JSON answer of the operation "Dry run a restore plan".

Raises: the typed errors of the transport (Errors).

BackupApi.enforce_retention

enforce_retention() -> Any

Apply the retention now. Removes the artefacts past their expires_at and marks them expired. Returns expired. Permission backup:manage. Audited as backup.expire.

Route: /api/v1/backups/retention/enforce (POST).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Apply the retention now".

Raises: the typed errors of the transport (Errors).

BackupApi.execute_restore

execute_restore(plan_id: str) -> Any

Execute an approved restore. Runs an approved plan with a destination: status executing and a durable execution_token are committed before any write. The artefact is checked again (size, digest, decryption), restored with pg_restore --single-transaction by the restricted role, then its rows are read back and compared with the backup inventory (result.inventory, rows, tables). Success: executed. Recorded failure: failed, rollback_performed: false, HTTP 502 restore_execution_failed; its nested result.error identifies the cause, including backup_corrupted, restore_target_busy or restore_execution_timeout. A process interruption can leave executing for manual inspection. Nothing is automatically rolled back or replayed. Pre-execution refusals include 409 restore_not_approved, 501 restore_executor_unavailable and 409 restore_target_changed. Permission restore:execute. Audited as restore.execute.started and restore.execute.

Route: /api/v1/restores/{plan_id}/execute (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the restore plan.

Returns: Any. Decoded JSON answer of the operation "Execute an approved restore".

Raises: the typed errors of the transport (Errors).

BackupApi.get_restore

get_restore(plan_id: str) -> Any

Get a restore plan. Returns the plan with its compatibility, steps, approvers and required_approvals (2). Permission backup:read; 404 restore_plan_not_found.

Route: /api/v1/restores/{plan_id} (GET).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the restore plan.

Returns: Any. Decoded JSON answer of the operation "Get a restore plan".

Raises: the typed errors of the transport (Errors).

BackupApi.list_backups

list_backups() -> Any

List the backups. The last 200 backup artefacts, newest first: location, SHA-256, size, versions, expiry, plan and the outcome of their last verification. Permission backup:read.

Route: /api/v1/backups (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the backups".

Raises: the typed errors of the transport (Errors).

BackupApi.list_dr_plans

list_dr_plans() -> Any

List the DR plans. Every disaster recovery plan with its mode, its primary and secondary sites, its RPO and RTO targets and its sequence. Permission backup:read.

Route: /api/v1/dr-plans (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the DR plans".

Raises: the typed errors of the transport (Errors).

BackupApi.list_exercises

list_exercises() -> Any

List the DR exercises and failovers. The last 200 exercises and failover requests with their report: status, requester, approver, observed RPO and RTO compared with the targets, evidence. Permission backup:read.

Route: /api/v1/dr-exercises (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the DR exercises and failovers".

Raises: the typed errors of the transport (Errors).

BackupApi.list_jobs

list_jobs() -> Any

List the backup jobs. The last 200 backup jobs, newest first, with their plan name, status and error. Permission backup:read.

Route: /api/v1/backup-jobs (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the backup jobs".

Raises: the typed errors of the transport (Errors).

BackupApi.list_plans

list_plans() -> Any

List the backup plans. Every backup plan, and alerts: the plans whose last successful backup is older than the interval plus the window, or whose last job failed. Permission backup:read.

Route: /api/v1/backup-plans (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the backup plans".

Raises: the typed errors of the transport (Errors).

BackupApi.list_restore_targets

list_restore_targets() -> Any

List the restore destinations. The restore destinations declared by the operator in the restore_targets setting: name, environment, kind (pg_dump) and declared versions. Connection strings and secret variable names never leave the server. Permission restore:execute.

Route: /api/v1/restore-targets (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the restore destinations".

Raises: the typed errors of the transport (Errors).

BackupApi.list_restore_tests

list_restore_tests() -> Any

List the restore tests. The last 200 restore tests with their outcome and signed report. Permission backup:read.

Route: /api/v1/restore-tests (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the restore tests".

Raises: the typed errors of the transport (Errors).

BackupApi.list_restores

list_restores() -> Any

List the restore plans. The last 200 restore plans with their status and number of approvals. Permission backup:read.

Route: /api/v1/restores (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the restore plans".

Raises: the typed errors of the transport (Errors).

BackupApi.list_sites

list_sites() -> Any

List the DR sites. Sites known to the disaster recovery plans, with their role (primary or secondary). Sites are created by the plans. Permission backup:read.

Route: /api/v1/dr-sites (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the DR sites".

Raises: the typed errors of the transport (Errors).

BackupApi.list_traffic

list_traffic(plan_id: str) -> Any

List the traffic switches of a DR plan. DNS records and load balancers declared for the plan, with their value per site and health check. Permission backup:read.

Route: /api/v1/dr-plans/{plan_id}/traffic (GET).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the DR plan.

Returns: Any. Decoded JSON answer of the operation "List the traffic switches of a DR plan".

Raises: the typed errors of the transport (Errors).

BackupApi.list_verifications

list_verifications(backup_id: str) -> Any

List the verifications of a backup. Every verification of the artefact, newest first, with its outcome (passed or failed) and details (expected and observed digest, size, reason). Permission backup:read.

Route: /api/v1/backups/{backup_id}/verifications (GET).

Name	Type	Default	Required	Description
backup_id	str		yes	Identifier of the backup artefact.

Returns: Any. Decoded JSON answer of the operation "List the verifications of a backup".

Raises: the typed errors of the transport (Errors).

BackupApi.plan_restore

plan_restore(body: Any = None) -> Any

Plan a restore. Creates a restore plan for a backup artefact: checks the compatibility of the backed up versions with the target versions (same major version) and lists the steps (verify artefact, verify destination, restore, verify restored). With target_name, the artefact must be an available pg_dump with a verification_inventory and the destination an empty PostgreSQL database owned by a restricted role; its identity is frozen in target_snapshot. Returns the plan (201). Permission restore:execute. Errors: 404 backup_artifact_not_found, 501 restore_executor_unavailable (unknown destination), 409 restore_target_invalid, 409 restore_target_not_empty, 422 restore_inventory_required. Audited as restore.plan.

Route: /api/v1/restores/plan (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Artefact, environment, destination and target versions.

Returns: Any. Decoded JSON answer of the operation "Plan a restore".

Raises: the typed errors of the transport (Errors).

BackupApi.record_backup

record_backup(plan_id: str, body: Any = None) -> Any

Record a backup. Records one job and its artefact: the Manager hashes the file at location, stores its digest, size and versions, and sets expires_at from the retention of the plan. When the file cannot be read the job is recorded as failed. Returns the job with its artifact (201). Permission backup:manage; 404 backup_policy_not_found. Audited as backup.job.

Route: /api/v1/backup-plans/{plan_id}/backups (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the backup plan.
body	Any	None	no	Location, kind and versions of the artefact.

Returns: Any. Decoded JSON answer of the operation "Record a backup".

Raises: the typed errors of the transport (Errors).

BackupApi.request_exercise

request_exercise(body: Any = None) -> Any

Request a DR exercise. Records an exercise request for a plan (201); another person must approve it before it can be completed. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.exercise.request.

Route: /api/v1/dr-exercises (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The DR plan.

Returns: Any. Decoded JSON answer of the operation "Request a DR exercise".

Raises: the typed errors of the transport (Errors).

BackupApi.request_failover

request_failover(body: Any = None) -> Any

Request a DR failover. Records a real failover request for a plan (201); it follows the same approval and completion as an exercise. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.failover.request.

Route: /api/v1/dr-failovers/request (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The DR plan.

Returns: Any. Decoded JSON answer of the operation "Request a DR failover".

Raises: the typed errors of the transport (Errors).

BackupApi.run_restore_test

run_restore_test(backup_id: str, body: Any = None) -> Any

Run a restore test. Copies the artefact into an isolated directory, optionally injects a corruption, verifies the digest and the decryption and signs the report (Ed25519). A failure raises an audited alarm. Returns the test (201). Permission backup:manage. Audited as backup.restore_test.

Route: /api/v1/backups/{backup_id}/restore-tests (POST).

Name	Type	Default	Required	Description
backup_id	str		yes	Identifier of the backup artefact.
body	Any	None	no	Whether to inject a corruption (to prove the test catches it).

Returns: Any. Decoded JSON answer of the operation "Run a restore test".

Raises: the typed errors of the transport (Errors).

BackupApi.set_dr_targets

set_dr_targets(plan_id: str, body: Any = None) -> Any

Set the RPO and RTO targets of a DR plan. Sets your own recovery objectives (seconds, or null to clear); the product never proposes them. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.plan.targets.

Route: /api/v1/dr-plans/{plan_id}/targets (PUT).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the DR plan.
body	Any	None	no	RPO and RTO targets.

Returns: Any. Decoded JSON answer of the operation "Set the RPO and RTO targets of a DR plan".

Raises: the typed errors of the transport (Errors).

BackupApi.traffic_switch_plan

traffic_switch_plan(plan_id: str, body: Any = None) -> Any

Plan a traffic switch to a site. Runs the health checks of the declared switches against the target site (real HTTP requests) and returns the ordered DNS and load balancer changes. Nothing is applied: applying needs the API of your DNS and load balancer (status requires_client_provider). Permission dr:manage.

Route: /api/v1/dr-plans/{plan_id}/switch-plan (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the DR plan.
body	Any	None	no	Site to switch the traffic to.

Returns: Any. Decoded JSON answer of the operation "Plan a traffic switch to a site".

Raises: the typed errors of the transport (Errors).

BackupApi.verify_backup

verify_backup(backup_id: str) -> Any

Verify a backup. Hashes the file again, compares digest and size with the recorded ones and, when they match, decrypts it with its key. Returns the verification with its outcome (passed or failed). Permission backup:manage; 404 backup_artifact_not_found. Audited as backup.verify.

Route: /api/v1/backups/{backup_id}/verify (POST).

Name	Type	Default	Required	Description
backup_id	str		yes	Identifier of the backup artefact.

Returns: Any. Decoded JSON answer of the operation "Verify a backup".

Raises: the typed errors of the transport (Errors).

Class BackupsApi

Backup, restore and disaster recovery. The Backup & Recovery Manager: backup targets and plans, backup artefacts with their verifications, retention, restore tests, restores and disaster recovery (sites, plans, exercises, failovers, DNS and load balancer switches). Operations of this group of the Navin Manager API.

Resource

BackupsApi.create_plan

create_plan(body: Any = None) -> Any

Create a backup plan. Creates a backup plan on a target and returns it (201). With immutability_required the target must have verified object lock and retention capabilities. Permission backup:manage. Errors: 404 backup_target_not_found, 409 backup_worm_unsupported. Audited as backup.plan.create.

Route: /api/v1/backup-plans (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Target, scope, schedule, encryption and retention of the plan.

Returns: Any. Decoded JSON answer of the operation "Create a backup plan".

Raises: the typed errors of the transport (Errors).

BackupsApi.list

list() -> Any

List the backups. The last 200 backup artefacts, newest first: location, SHA-256, size, versions, expiry, plan and the outcome of their last verification. Permission backup:read.

Route: /api/v1/backups (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the backups".

Raises: the typed errors of the transport (Errors).

BackupsApi.run

run(plan_id: str, body: Any = None) -> Any

Record a backup. Records one job and its artefact: the Manager hashes the file at location, stores its digest, size and versions, and sets expires_at from the retention of the plan. When the file cannot be read the job is recorded as failed. Returns the job with its artifact (201). Permission backup:manage; 404 backup_policy_not_found. Audited as backup.job.

Route: /api/v1/backup-plans/{plan_id}/backups (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the backup plan.
body	Any	None	no	Location, kind and versions of the artefact.

Returns: Any. Decoded JSON answer of the operation "Record a backup".

Raises: the typed errors of the transport (Errors).

BackupsApi.verify

verify(backup_id: str) -> Any

Verify a backup. Hashes the file again, compares digest and size with the recorded ones and, when they match, decrypts it with its key. Returns the verification with its outcome (passed or failed). Permission backup:manage; 404 backup_artifact_not_found. Audited as backup.verify.

Route: /api/v1/backups/{backup_id}/verify (POST).

Name	Type	Default	Required	Description
backup_id	str		yes	Identifier of the backup artefact.

Returns: Any. Decoded JSON answer of the operation "Verify a backup".

Raises: the typed errors of the transport (Errors).

Class BlueprintApi

Blueprints. A blueprint describes the services of a cluster in a portable form, to rebuild the same platform on another cluster: the services with their mode, method, non secret configuration and bindings, and host groups (sets of components that run together, with their number of hosts). Its shape: Operations of this group of the Navin Manager API.

Resource

BlueprintApi.apply_blueprint

apply_blueprint(cluster_id: str, body: Any = None) -> Any

Apply a blueprint to a cluster. Turns the blueprint and the host mapping into install requests and creates one install operation (type blueprint.apply), with the same checks as a service install. Returns operation_id and the ha checks. Permissions cluster:manage and services:install. Errors: 422 blueprint_invalid (with details.errors), and the errors of an install. Audited as blueprint.apply.

Route: /api/v1/clusters/{cluster_id}/blueprint/apply (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Blueprint, host mapping and install options.

Returns: Any. Decoded JSON answer of the operation "Apply a blueprint to a cluster".

Raises: the typed errors of the transport (Errors).

BlueprintApi.export_blueprint

export_blueprint(cluster_id: str) -> Any

Export the blueprint of a cluster. Returns the blueprint of the cluster: its managed services with their non secret configuration (secrets are never exported) and host groups built from the components that run together; hosts of a group lists the hosts of this cluster for information. Permission cluster:manage.

Route: /api/v1/clusters/{cluster_id}/blueprint (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Export the blueprint of a cluster".

Raises: the typed errors of the transport (Errors).

BlueprintApi.validate_blueprint

validate_blueprint(cluster_id: str, body: Any = None) -> Any

Validate a blueprint for a cluster. Checks the shape of the blueprint and, when a host_mapping is given, the mapping and the resulting install requests. Returns ok and errors (each with service, field, code, message_i18n). Nothing is changed. Permission cluster:manage.

Route: /api/v1/clusters/{cluster_id}/blueprint/validate (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Blueprint and optional host mapping.

Returns: Any. Decoded JSON answer of the operation "Validate a blueprint for a cluster".

Raises: the typed errors of the transport (Errors).

Class ClustersApi

Platform Manager clusters operations.

Resource

ClustersApi.create_cluster

create_cluster(body: Any = None) -> Any

Create a cluster. Creates an empty cluster on the current catalog version and returns it (201). Without a profile, production and preprod clusters get standard, the other modes development. Permission clusters:create; 409 cluster_name_taken (names are case insensitive). Audited as cluster.create.

Route: /api/v1/clusters (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Name, mode, description and profile of the cluster.

Returns: Any. Decoded JSON answer of the operation "Create a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.create_token

create_token(cluster_id: str, body: Any = None) -> Any

Create a bootstrap token for new hosts. Creates a token that lets agents register in this cluster and returns id, token (shown only here), expires_at, register_command (the nm-agent register command with the server URL, the token and the fingerprint of the CA) and install_command (a script that installs the agent from the mirror and registers it). Answers 201. Permission hosts:manage. Audited as bootstrap_token.create.

Route: /api/v1/clusters/{cluster_id}/bootstrap-tokens (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Lifetime and number of uses of the token.

Returns: Any. Decoded JSON answer of the operation "Create a bootstrap token for new hosts".

Raises: the typed errors of the transport (Errors).

ClustersApi.delete_cluster

delete_cluster(cluster_id: str) -> Any

Delete an empty cluster. Deletes a cluster that has no service and no host other than decommissioned ones. Answers 204. Permission cluster:manage. Errors: 404 cluster_not_found, 409 cluster_not_empty. Audited as cluster.delete.

Route: /api/v1/clusters/{cluster_id} (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Delete an empty cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.get_cluster

get_cluster(cluster_id: str) -> Any

Get a cluster. Returns the cluster. Permission cluster:read; 404 cluster_not_found.

Route: /api/v1/clusters/{cluster_id} (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Get a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.import_kubernetes

import_kubernetes(cluster_id: str, body: Any = None) -> Any

Register a Kubernetes cluster. Checks the kubeconfig against the API server given, calls /version, seals the kubeconfig and turns the cluster into a Kubernetes cluster. The cluster must have no host. Returns the target (201). Permission cluster:manage. Errors: 409 k8s_already_registered, 409 k8s_cluster_has_hosts, kubeconfig guard and API errors. Audited as k8s.cluster.register.

Route: /api/v1/clusters/{cluster_id}/kubernetes (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	API server, kubeconfig and namespace.

Returns: Any. Decoded JSON answer of the operation "Register a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.list_clusters

list_clusters() -> Any

List the clusters. Clusters the caller may read (cluster:read globally or on the cluster), sorted by name: id, name, mode, description, stack_version, profile, kind (hosts or kubernetes), created_at, updated_at.

Route: /api/v1/clusters (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the clusters".

Raises: the typed errors of the transport (Errors).

ClustersApi.list_tokens

list_tokens(cluster_id: str) -> Any

List the bootstrap tokens of a cluster. Tokens of the cluster, newest first, with prefix, expires_at, max_uses, uses, created_at and revoked_at; the secret is never returned. Permission hosts:manage.

Route: /api/v1/clusters/{cluster_id}/bootstrap-tokens (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the bootstrap tokens of a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.patch_cluster

patch_cluster(cluster_id: str, body: Any = None) -> Any

Rename a cluster or change its profile. Changes the name, the description or the profile; a field left out is kept. Returns the cluster. Permission cluster:manage. Errors: 404 cluster_not_found, 409 cluster_name_taken. Audited as cluster.update.

Route: /api/v1/clusters/{cluster_id} (PATCH).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Fields of the cluster to change.

Returns: Any. Decoded JSON answer of the operation "Rename a cluster or change its profile".

Raises: the typed errors of the transport (Errors).

ClustersApi.register

register(body: Any = None) -> Any

Create a cluster. Creates an empty cluster on the current catalog version and returns it (201). Without a profile, production and preprod clusters get standard, the other modes development. Permission clusters:create; 409 cluster_name_taken (names are case insensitive). Audited as cluster.create.

Route: /api/v1/clusters (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Name, mode, description and profile of the cluster.

Returns: Any. Decoded JSON answer of the operation "Create a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.revoke_token

revoke_token(cluster_id: str, token_id: str) -> Any

Revoke a bootstrap token. Revokes the token: no new agent can register with it; hosts already registered are not affected. Answers 204. Permission hosts:manage; 404 bootstrap_token_not_found (unknown or already revoked). Audited as bootstrap_token.revoke.

Route: /api/v1/clusters/{cluster_id}/bootstrap-tokens/{token_id} (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
token_id	str		yes	Identifier of the bootstrap token.

Returns: Any. Decoded JSON answer of the operation "Revoke a bootstrap token".

Raises: the typed errors of the transport (Errors).

ClustersApi.status

status(cluster_id: str) -> Any

Get the summary of a cluster. Counters for the home page of a cluster: hosts by state, services by state and by health, open alerts (critical, warning) and running operations. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/summary (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Get the summary of a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.summary

summary(cluster_id: str) -> Any

Get the summary of a cluster. Counters for the home page of a cluster: hosts by state, services by state and by health, open alerts (critical, warning) and running operations. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/summary (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Get the summary of a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.topology

topology(cluster_id: str) -> Any

Get the topology of a cluster. Hosts (id, hostname, state, rack) and component instances (service, component, host_id, state, health) of the cluster, to draw where every component runs. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/topology (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Get the topology of a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.validate

validate(cluster_id: str, body: Any = None) -> Any

Run the installation preflight of a cluster. Every check that must pass before a service is installed or upgraded, with its severity, evidence and a blocking verdict: host facts, DNS, catalog preflight entries, firewall, capacity, versions, TLS and profile rules. A check in fail blocks. Nothing is changed. Permission services:install.

Route: /api/v1/clusters/{cluster_id}/preflight (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Services and hosts to check.

Returns: Any. Decoded JSON answer of the operation "Run the installation preflight of a cluster".

Raises: the typed errors of the transport (Errors).

Class ConfigsApi

Configurations. The configuration of a managed service: its parameters (declared by the catalog with their types, defaults and sections), saved as numbered versions, with config groups that override values on some hosts. Operations of this group of the Navin Manager API.

Resource

ConfigsApi.apply

apply(cluster_id: str, service: str, body: Any = None) -> Any

Apply the configuration to the hosts. Starts the operation that writes the current configuration to the hosts and restarts the components as asked (rolling by batch_size, all, or none). Returns operation_id. Permission configs:edit. Under banking-secure an approval is needed (409 approval_required). Audited as config.apply.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/apply (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Restart policy of the apply.

Returns: Any. Decoded JSON answer of the operation "Apply the configuration to the hosts".

Raises: the typed errors of the transport (Errors).

ConfigsApi.create_group

create_group(cluster_id: str, service: str, body: Any = None) -> Any

Create a config group. Creates a group of hosts with values that override the service configuration on them. A host belongs to one group at most. Permission configs:edit. Errors: 409 config_group_name_taken, 409 config_group_host_conflict, 422 config_group_host_invalid, 422 config_invalid. Audited as config_group.create.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/groups (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Name, hosts and overrides of the group.

Returns: Any. Decoded JSON answer of the operation "Create a config group".

Raises: the typed errors of the transport (Errors).

ConfigsApi.delete_group

delete_group(cluster_id: str, service: str, group_id: str) -> Any

Delete a config group. Deletes the group; its hosts fall back to the service configuration at the next apply. Answers 204. Permission configs:edit; 404 config_group_not_found. Audited as config_group.delete.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/groups/{group_id} (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
group_id	str		yes	Identifier of the config group.

Returns: Any. Decoded JSON answer of the operation "Delete a config group".

Raises: the typed errors of the transport (Errors).

ConfigsApi.diff

diff(cluster_id: str, service: str, from_: integer = None, to: integer = None) -> Any

Compare two configuration versions. Lists the parameters whose value differs between the two versions, each with param, secret, from and to; for a secret only whether it is set is shown. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/diff (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
from_	integer	None	no	Older version number (1 or more).
to	integer	None	no	Newer version number (1 or more).

Returns: Any. Decoded JSON answer of the operation "Compare two configuration versions".

Raises: the typed errors of the transport (Errors).

ConfigsApi.get_config

get_config(cluster_id: str, service: str) -> Any

Get the configuration of a service. Returns the current version, the effective properties (defaults merged, secrets masked), the parameter definitions params and sections of the catalog, the recommendations computed for the hosts, the config groups and the stale_hosts. Permission configs:read; 409 service_unmanaged for a service the Manager does not manage.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Get the configuration of a service".

Raises: the typed errors of the transport (Errors).

ConfigsApi.get_version

get_version(cluster_id: str, service: str, version: str) -> Any

Get a configuration version. Returns the values of one version (secrets masked) with its note and author. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/versions/{version} (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
version	str		yes	Version number, starting at 1.

Returns: Any. Decoded JSON answer of the operation "Get a configuration version".

Raises: the typed errors of the transport (Errors).

ConfigsApi.list_groups

list_groups(cluster_id: str, service: str) -> Any

List the config groups of a service. Every config group with its id, name, hosts, overrides (secrets masked) and updated_at. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/groups (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "List the config groups of a service".

Raises: the typed errors of the transport (Errors).

ConfigsApi.list_versions

list_versions(cluster_id: str, service: str, limit: int | None = None, cursor: str | None = None) -> Any

List the configuration versions. Versions of the configuration, newest first: version, note, restored_from, secret_keys, created_by, created_at. Paginated with limit and cursor. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/versions (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
limit	int | None	None	no	Maximum number of versions in the page, from 1 to 500. Default 50.
cursor	str | None	None	no	The next_cursor of the previous page: versions below this number are returned.

Returns: Any. Decoded JSON answer of the operation "List the configuration versions".

Raises: the typed errors of the transport (Errors).

ConfigsApi.preview

preview(cluster_id: str, service: str, host_id: string = None, component: string = None) -> Any

Preview the files of a component instance. Renders the configuration files one instance would receive with the current version and its groups: path, mode, owner, group, content, secrets redacted. Nothing is written. Permission configs:read; 404 host_component_not_found.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/preview (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
host_id	string	None	no	Host of the instance.
component	string	None	no	Component of the instance.

Returns: Any. Decoded JSON answer of the operation "Preview the files of a component instance".

Raises: the typed errors of the transport (Errors).

ConfigsApi.put_config

put_config(cluster_id: str, service: str, body: Any = None) -> Any

Save a new configuration version. Merges the properties sent over the current values, validates them against the parameter definitions and saves a new version. Returns version and stale_hosts. Permission configs:edit. Errors: 422 config_invalid (with the fields), 409 service_unmanaged. Audited as config.update (parameter names only).

Route: /api/v1/clusters/{cluster_id}/services/{service}/config (PUT).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Changed properties and a note.

Returns: Any. Decoded JSON answer of the operation "Save a new configuration version".

Raises: the typed errors of the transport (Errors).

ConfigsApi.restore

restore(cluster_id: str, service: str, version: str) -> Any

Restore a configuration version. Saves the values of an old version as a new version (note restore of version N) and returns version and stale_hosts; apply it to reach the hosts. Permission configs:edit. Audited as config.restore.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/versions/{version}/restore (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
version	str		yes	Version number to restore.

Returns: Any. Decoded JSON answer of the operation "Restore a configuration version".

Raises: the typed errors of the transport (Errors).

ConfigsApi.update_group

update_group(cluster_id: str, service: str, group_id: str, body: Any = None) -> Any

Update a config group. Replaces the name, hosts and overrides of the group. Permission configs:edit. Errors: 404 config_group_not_found, 409 config_group_name_taken, 409 config_group_host_conflict, 422 config_group_host_invalid. Audited as config_group.update.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/groups/{group_id} (PUT).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
group_id	str		yes	Identifier of the config group.
body	Any	None	no	Name, hosts and overrides of the group.

Returns: Any. Decoded JSON answer of the operation "Update a config group".

Raises: the typed errors of the transport (Errors).

Class ConnectionsApi

External connections. Connections to systems outside the clusters that services can use: databases (PostgreSQL, MySQL, ClickHouse), search engines (Elasticsearch, OpenSearch, Qdrant), messaging (Kafka, NATS, Redis), S3 object storage, LDAP and OIDC directories, SMTP, syslog and plain HTTP endpoints. A service binds to a connection through its bindings (kind connection). Operations of this group of the Navin Manager API.

Resource

ConnectionsApi.create_connection

create_connection(body: Any = None) -> Any

Create a connection. Saves a connection and returns it (201). Permission connections:manage. Errors: 409 connection_name_taken, 422 connection_params_invalid (fields in details.fields). Audited as connection.create.

Route: /api/v1/connections (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Name, type, parameters and secret of the connection.

Returns: Any. Decoded JSON answer of the operation "Create a connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.delete_connection

delete_connection(connection_id: str) -> Any

Delete a connection. Deletes a connection no service is bound to. Answers 204. Permission connections:manage. Errors: 404 connection_not_found, 409 connection_in_use (services in details.services). Audited as connection.delete.

Route: /api/v1/connections/{connection_id} (DELETE).

Name	Type	Default	Required	Description
connection_id	str		yes	Identifier of the connection.

Returns: Any. Decoded JSON answer of the operation "Delete a connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.get_connection

get_connection(connection_id: str) -> Any

Get a connection. Returns one connection, its secret masked. Permission connections:read; 404 connection_not_found.

Route: /api/v1/connections/{connection_id} (GET).

Name	Type	Default	Required	Description
connection_id	str		yes	Identifier of the connection.

Returns: Any. Decoded JSON answer of the operation "Get a connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.list_connections

list_connections(type_: string | null = None, limit: int | None = None, cursor: str | None = None) -> Any

List the external connections. Connections sorted by name: id, name, type, params, secret (set or not), description, last_test, created_at, updated_at. Paginated with limit and cursor. Permission connections:read.

Route: /api/v1/connections (GET).

Name	Type	Default	Required	Description
type_	string | null	None	no	Only the connections of this type, for example postgresql, s3 or kafka.
limit	int | None	None	no	Maximum number of connections in the page, from 1 to 500. Default 50.
cursor	str | None	None	no	The next_cursor of the previous page (the last name, lower case). Omit it for the first page.

Returns: Any. Decoded JSON answer of the operation "List the external connections".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.patch_connection

patch_connection(connection_id: str, body: Any = None) -> Any

Update a connection. Changes the fields given; the type cannot change. Returns the connection. Permission connections:manage. Errors: 404 connection_not_found, 409 connection_name_taken, 422 connection_params_invalid. Audited as connection.update.

Route: /api/v1/connections/{connection_id} (PATCH).

Name	Type	Default	Required	Description
connection_id	str		yes	Identifier of the connection.
body	Any	None	no	Fields of the connection to change.

Returns: Any. Decoded JSON answer of the operation "Update a connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.test_connection

test_connection(connection_id: str) -> Any

Test a saved connection. Runs the protocol test with the stored parameters and secret, stores the result with its time in last_test and returns it (ok, error_code, latency_ms...). Permission connections:manage; 404 connection_not_found. Audited as connection.test.

Route: /api/v1/connections/{connection_id}/test (POST).

Name	Type	Default	Required	Description
connection_id	str		yes	Identifier of the connection.

Returns: Any. Decoded JSON answer of the operation "Test a saved connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.validate_connection

validate_connection(body: Any = None) -> Any

Test a connection before saving it. Dry run: checks the parameters of the type, then runs the real protocol test with the given secret. Returns the test result (ok, error_code, latency_ms...). Nothing is stored; the secret is never sent back nor audited. Permission connections:manage. Audited as connection.validate.

Route: /api/v1/connections/validate (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Type, parameters and secret to test.

Returns: Any. Decoded JSON answer of the operation "Test a connection before saving it".

Raises: the typed errors of the transport (Errors).

Class ConsolesApi

Service consoles. The local web interfaces of the installed services (for example the administration console of Keycloak or of a message broker), opened from the Manager. Operations of this group of the Navin Manager API.

Resource

ConsolesApi.list_consoles

list_consoles(cluster_id: str) -> Any

List the service consoles of a cluster. Every console of the catalog with its state on the cluster: installed or not, health, internal address, compliance checks, whether the caller may open it and, for the vault administrators, the vault entry holding its credentials. Services without a web interface are listed apart with their HTTP endpoints. Permission services:operate. Audited as consoles.list.

Route: /api/v1/clusters/{cluster_id}/consoles (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the service consoles of a cluster".

Raises: the typed errors of the transport (Errors).

ConsolesApi.open_console

open_console(cluster_id: str, service: str) -> Any

Open a service console. Returns url, the checks and compliant. Needs services:operate and the permission of the console (vault:manage for an identity or secrets console). Errors: 404 console_unknown, 409 console_not_installed, 409 console_no_url, 409 console_not_compliant (production or pre-production). Audited as console.open.

Route: /api/v1/clusters/{cluster_id}/consoles/{service}/open (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Open a service console".

Raises: the typed errors of the transport (Errors).

ConsolesApi.put_access

put_access(cluster_id: str, service: str, body: Any = None) -> Any

Publish the internal address of a console. Sets the internal address of the console (behind the HTTPS gateway of the bank) and its protection; both null go back to the discovered address. Returns the console; the vault entry of the service is updated with the new address. Permission cluster:manage; 422 console_url_invalid. Audited as console.access.

Route: /api/v1/clusters/{cluster_id}/consoles/{service}/access (PUT).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Published address and protection.

Returns: Any. Decoded JSON answer of the operation "Publish the internal address of a console".

Raises: the typed errors of the transport (Errors).

ConsolesApi.rotate_credentials

rotate_credentials(cluster_id: str, service: str, body: Any = None) -> Any

Rotate the password of a console account. Sets a new password (generated when omitted) for the console account read from the configuration: creates a new configuration version and starts the apply operation; the vault entry follows when the apply succeeds. Answers 202 with operation_id and version. The password is never logged. Permissions configs:edit and vault:manage. Errors: 409 console_no_credential, 409 console_rotation_manual, 409 service_unmanaged, 422 config_invalid. Audited as console.credentials.rotate.

Route: /api/v1/clusters/{cluster_id}/consoles/{service}/credentials/rotate (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	New password and restart policy.

Returns: Any. Decoded JSON answer of the operation "Rotate the password of a console account".

Raises: the typed errors of the transport (Errors).

Class DRApi

Backup, restore and disaster recovery. The Backup & Recovery Manager: backup targets and plans, backup artefacts with their verifications, retention, restore tests, restores and disaster recovery (sites, plans, exercises, failovers, DNS and load balancer switches). Operations of this group of the Navin Manager API.

Resource

DRApi.approve

approve(exercise_id: str) -> Any

Approve a DR exercise or failover. Approves the request; the approver must not be the requester. Permission dr:manage. Errors: 403 restore_self_approval, 404 dr_exercise_not_found. Audited as dr.approve.

Route: /api/v1/dr-exercises/{exercise_id}/approve (POST).

Name	Type	Default	Required	Description
exercise_id	str		yes	Identifier of the exercise or failover request.

Returns: Any. Decoded JSON answer of the operation "Approve a DR exercise or failover".

Raises: the typed errors of the transport (Errors).

DRApi.complete

complete(exercise_id: str, body: Any = None) -> Any

Complete a DR exercise with its measures. Records the observed RPO and RTO, the result and the evidence of an approved exercise or failover. Permission dr:manage; 409 dr_not_approved. Audited as dr.complete.

Route: /api/v1/dr-exercises/{exercise_id}/complete (POST).

Name	Type	Default	Required	Description
exercise_id	str		yes	Identifier of the exercise or failover request.
body	Any	None	no	Observed measures, result and evidence.

Returns: Any. Decoded JSON answer of the operation "Complete a DR exercise with its measures".

Raises: the typed errors of the transport (Errors).

DRApi.list_plans

list_plans() -> Any

List the DR plans. Every disaster recovery plan with its mode, its primary and secondary sites, its RPO and RTO targets and its sequence. Permission backup:read.

Route: /api/v1/dr-plans (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the DR plans".

Raises: the typed errors of the transport (Errors).

DRApi.plan

plan(body: Any = None) -> Any

Create a DR plan. Creates a plan between a primary and a secondary site (created when unknown) and returns it (201). Permission dr:manage. Errors: 422 dr_mode_invalid, 422 dr_same_site. Audited as dr.plan.create.

Route: /api/v1/dr-plans (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Name, mode, sites, targets and sequence of the plan.

Returns: Any. Decoded JSON answer of the operation "Create a DR plan".

Raises: the typed errors of the transport (Errors).

DRApi.request_failover

request_failover(body: Any = None) -> Any

Request a DR failover. Records a real failover request for a plan (201); it follows the same approval and completion as an exercise. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.failover.request.

Route: /api/v1/dr-failovers/request (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The DR plan.

Returns: Any. Decoded JSON answer of the operation "Request a DR failover".

Raises: the typed errors of the transport (Errors).

DRApi.status

status() -> Any

List the DR exercises and failovers. The last 200 exercises and failover requests with their report: status, requester, approver, observed RPO and RTO compared with the targets, evidence. Permission backup:read.

Route: /api/v1/dr-exercises (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the DR exercises and failovers".

Raises: the typed errors of the transport (Errors).

DRApi.test

test(body: Any = None) -> Any

Request a DR exercise. Records an exercise request for a plan (201); another person must approve it before it can be completed. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.exercise.request.

Route: /api/v1/dr-exercises (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The DR plan.

Returns: Any. Decoded JSON answer of the operation "Request a DR exercise".

Raises: the typed errors of the transport (Errors).

Class HAApi

High availability groups. A high availability group describes how one component of a cluster stays available: its HA mode (single, active_passive, active_active, quorum), its profile (standalone, ha with at least 2 replicas in 2 fault domains, critical-ha with at least 3 in 3), its members and their fault domains, its failover policy and its recovery objectives (RTO, RPO). The group reports its HA status from the heartbeats of its members. Operations of this group of the Navin Manager API.

Resource

HAApi.list

list() -> Any

List the high availability groups. Groups of every cluster the caller may read (cluster:read), sorted by name, each with its members, its HA status and its last test run.

Route: /api/v1/ha-groups (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the high availability groups".

Raises: the typed errors of the transport (Errors).

HAApi.plan

plan(body: Any = None) -> Any

Create a high availability group. Declares a group and its members and returns it (201). The profile must be met by desired_replicas and fault_domains, two members cannot share a host. Permission cluster:manage on the cluster. Errors: 422 ha_profile_unmet, 422 ha_mode_unsupported, 422 ha_members_same_host, 404 cluster_not_found, 404 host_not_found. Audited as ha_group.create.

Route: /api/v1/ha-groups (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The group, its policy and its members.

Returns: Any. Decoded JSON answer of the operation "Create a high availability group".

Raises: the typed errors of the transport (Errors).

HAApi.status

status(group_id: str) -> Any

Get a high availability group. Returns the group with its members, its HA status and its last test run. Permission cluster:read on its cluster; 404 ha_group_not_found.

Route: /api/v1/ha-groups/{group_id} (GET).

Name	Type	Default	Required	Description
group_id	str		yes	Identifier of the HA group.

Returns: Any. Decoded JSON answer of the operation "Get a high availability group".

Raises: the typed errors of the transport (Errors).

HAApi.test_failover

test_failover(group_id: str) -> Any

Run a failover test. Takes the failover lease of the group, records a test run with a new fencing token and, when the group is bound to installed components, starts the failover. Answers 202 with run_id, status, fencing_token, executed and the started operations. Permission services:operate. Errors: 409 ha_operation_locked (another failover holds the lease), 409 ha_client_managed_refused. Audited as ha_group.test_failover.

Route: /api/v1/ha-groups/{group_id}/test-failover (POST).

Name	Type	Default	Required	Description
group_id	str		yes	Identifier of the HA group.

Returns: Any. Decoded JSON answer of the operation "Run a failover test".

Raises: the typed errors of the transport (Errors).

Class HostsApi

Platform Manager hosts operations.

Resource

HostsApi.bootstrap

bootstrap(body: Any = None) -> Any

Bootstrap a node agent over SSH. Starts an operation that installs and registers the agent on one host:

Route: /api/v1/hosts/bootstrap (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Target host, jump hosts, SSH account, private key or certificate.

Returns: Any. Decoded JSON answer of the operation "Bootstrap a node agent over SSH".

Raises: the typed errors of the transport (Errors).

HostsApi.bootstrap_plan

bootstrap_plan(body: Any = None) -> Any

Preview the bootstrap of a node agent. Checks the credential against the SSH policy and returns the plan without connecting: SSH user, target, jumps, credential verdict, the sudoers file and its validation, the allowlist, the systemd unit and the staging directory. Permission hosts:manage; 422 ssh_policy_refused.

Route: /api/v1/hosts/bootstrap/plan (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Same body as a bootstrap.

Returns: Any. Decoded JSON answer of the operation "Preview the bootstrap of a node agent".

Raises: the typed errors of the transport (Errors).

HostsApi.decommission

decommission(host_id: str) -> Any

Decommission a host. Starts an operation in two stages: the agent runs its decommission task, then the Manager marks the host decommissioned and revokes its certificates. The host must have no component left. Answers 202 with operation_id. Permission hosts:manage; 409 host_has_components. Audited as host.decommission.

Route: /api/v1/hosts/{host_id}/decommission (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Decommission a host".

Raises: the typed errors of the transport (Errors).

HostsApi.delete_host

delete_host(host_id: str) -> Any

Delete a host. Removes the host from the Manager and revokes its agent certificates, without contacting the agent (use decommission to clean the machine). Answers 204. Permission hosts:manage. Errors: 404 host_not_found, 409 host_has_components. Audited as host.delete.

Route: /api/v1/hosts/{host_id} (DELETE).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Delete a host".

Raises: the typed errors of the transport (Errors).

HostsApi.diagnostics

diagnostics(host_id: str) -> Any

Get the inventory of a host. Returns host_id, the inventory reconciled from the agent facts (hardware, GPUs, platform) and updated_at. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/inventory (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Get the inventory of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.discover

discover(cluster_id: string | null = None) -> Any

List the hosts of every cluster. Hosts of every cluster the caller may read (or of one cluster), sorted by FQDN, with their trust state, management mode, identity, metrics, inventory and platform.

Route: /api/v1/hosts (GET).

Name	Type	Default	Required	Description
cluster_id	string | null	None	no	Only the hosts of this cluster.

Returns: Any. Decoded JSON answer of the operation "List the hosts of every cluster".

Raises: the typed errors of the transport (Errors).

HostsApi.enroll

enroll(body: Any = None) -> Any

Issue an enrollment token for one agent key. Issues a single use token for one host and one key: host_fingerprint is the SHA-256 (hex) of the public key of the agent (nm-agent prints it before enrolling). The token expires after at most 15 minutes and is consumed by the first enrollment that presents a CSR of that exact key. Returns id, token, expires_at, ttl_s, host_fingerprint and agent_url (201). Permission hosts:manage. Audited as host.enroll_token.

Route: /api/v1/hosts/enroll (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Cluster, FQDN and key fingerprint of the host.

Returns: Any. Decoded JSON answer of the operation "Issue an enrollment token for one agent key".

Raises: the typed errors of the transport (Errors).

HostsApi.get_host

get_host(host_id: str) -> Any

Get a host with its facts. Returns the host with the full facts reported by its agent. Permission cluster:read on its cluster; 404 host_not_found.

Route: /api/v1/hosts/{host_id} (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Get a host with its facts".

Raises: the typed errors of the transport (Errors).

HostsApi.get_parameters

get_parameters(host_id: str) -> Any

Get the kernel parameters of a host. The sysctl settings and the resource limits (nofile, nproc, memlock) of the host, each with its current value (reported by the agent), its desired value (set with PUT) and its recommended value (from the installed services), plus the firewall backend and the ports in use. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/parameters (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Get the kernel parameters of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.health

health(host_id: str) -> Any

Get a node agent. The node view plus its last 10 certificates and diagnostics (facts, last metrics, last 20 receipts). Permission cluster:read; 404 host_not_found.

Route: /api/v1/agents/nodes/{host_id} (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Get a node agent".

Raises: the typed errors of the transport (Errors).

HostsApi.host_components

host_components(host_id: str) -> Any

List the components of a host. Component instances placed on the host: service, component, desired_state, state, health and its details, version, config_version, stale_config (the configuration changed since the last restart), maintenance, pid, since, updated_at. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/components (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "List the components of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.host_metrics

host_metrics(host_id: str, from_: string | null = None, to: string | null = None, step: integer = None) -> Any

Read the metrics of a host. Time series of the host over [from, to] (default: the last hour) in buckets of step seconds: cpu_pct, mem_used_mb, load1, disk_pct, net_rx, net_tx, each a list of [time, value]. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/metrics (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
from_	string | null	None	no	Start of the window, ISO 8601. Default: one hour before to.
to	string | null	None	no	End of the window, ISO 8601. Default: now.
step	integer	None	no	Width of a bucket in seconds, 10 to 86400. Default 60.

Returns: Any. Decoded JSON answer of the operation "Read the metrics of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.list_hosts

list_hosts(cluster_id: str) -> Any

List the hosts of a cluster. Hosts of the cluster sorted by hostname, with their state, operating system, resources, labels, components, open alerts, agent version, certificate expiry, latest metrics and network rates. Permission cluster:read; 404 cluster_not_found.

Route: /api/v1/clusters/{cluster_id}/hosts (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the hosts of a cluster".

Raises: the typed errors of the transport (Errors).

HostsApi.patch_host

patch_host(host_id: str, body: Any = None) -> Any

Update the rack, labels or maintenance of a host. Changes the fields given and returns the host. Turning maintenance on moves the host to the maintenance state, turning it off brings it back to healthy. Permission hosts:manage; 422 host_environment_unknown. Audited as host.update.

Route: /api/v1/hosts/{host_id} (PATCH).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Fields of the host to change.

Returns: Any. Decoded JSON answer of the operation "Update the rack, labels or maintenance of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.preflight

preflight(body: Any = None) -> Any

Run the preflight of a host before its bootstrap. Reads the host over SSH and from the Manager (DNS forward and reverse, TCP reachability, required ports free, disks, operating system) and returns the checks graded pass, warning or blocking, the blocking and warnings counts, a reproducible digest and the credential verdict. Nothing is installed. Permission hosts:manage. Errors: 422 ssh_policy_refused. Audited as host.preflight.

Route: /api/v1/hosts/preflight (POST).

Name	Type	Default	Required	Description
body	Any	None	no	SSH access, expected identity, ports and disks to check.

Returns: Any. Decoded JSON answer of the operation "Run the preflight of a host before its bootstrap".

Raises: the typed errors of the transport (Errors).

HostsApi.preflight_results

preflight_results(host_id: str) -> Any

Get the preflight results of a host. Result of every preflight check of the host (check, status, message_i18n, details, checked_at), evaluated from its last facts. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/preflight (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Get the preflight results of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.put_parameters

put_parameters(host_id: str, body: Any = None) -> Any

Apply kernel parameters to a host. Stores the sysctl settings and resource limits and starts an operation that writes them to /etc/sysctl.d/90-navin-manager.conf and /etc/security/limits.d/90-navin-manager.conf. Answers 202 with operation_id. Permission hosts:manage. Errors: 422 validation_error (invalid key or empty request), 409 host_rootless (agent without root rights). Audited as host.parameters.

Route: /api/v1/hosts/{host_id}/parameters (PUT).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Sysctl settings and resource limits.

Returns: Any. Decoded JSON answer of the operation "Apply kernel parameters to a host".

Raises: the typed errors of the transport (Errors).

HostsApi.refresh_facts

refresh_facts(host_id: str) -> Any

Collect the facts of a host again. Starts an operation where the agent collects and reports its facts again (the preflight checks are evaluated on them). Answers 202 with operation_id. Permission hosts:manage. Audited as host.facts_refresh.

Route: /api/v1/hosts/{host_id}/facts/refresh (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Collect the facts of a host again".

Raises: the typed errors of the transport (Errors).

HostsApi.revoke

revoke(host_id: str, body: Any = None) -> Any

Revoke the agent of a host. Sets the trust state to revoked, revokes the certificates of the agent and expires its pending commands. Only a new enrollment brings it back. Returns the node. Permission hosts:manage. Audited as host.revoke with the number of certificates revoked.

Route: /api/v1/hosts/{host_id}/revoke (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Reason of the change.

Returns: Any. Decoded JSON answer of the operation "Revoke the agent of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.run_preflight

run_preflight(host_id: str) -> Any

Run the preflight checks of a host. Starts an operation that collects fresh facts; the preflight checks are evaluated when they arrive. Read the results with GET /hosts/{host_id}/preflight. Answers 202 with operation_id. Permission hosts:manage. Audited as host.preflight.

Route: /api/v1/hosts/{host_id}/preflight (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Run the preflight checks of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.ssh_bootstrap

ssh_bootstrap(cluster_id: str, body: Any = None) -> Any

Install agents over SSH. Starts an operation with one task per host: the Manager connects over SSH (the host key must match the fingerprint given), installs the agent and registers it with a bootstrap token created for this operation (valid 2 hours, one use per host). The private key is kept in memory for the tasks only, never stored nor logged. A failed host does not stop the others. Answers 202 with operation_id. Permission hosts:manage. Errors: 422 validation_error (invalid name or missing fingerprint), 404 cluster_not_found. Audited as host.ssh_bootstrap.

Route: /api/v1/clusters/{cluster_id}/hosts/ssh-bootstrap (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Hosts, SSH account, private key and host key fingerprints.

Returns: Any. Decoded JSON answer of the operation "Install agents over SSH".

Raises: the typed errors of the transport (Errors).

Class HubApi

Navin Trusted Hub. Client of the Navin Trusted Hub: the Manager fetches (online) or imports (offline) the signed distribution document of the customer, verifies it, keeps its targets (approved packages and images with their digests) and feeds the mirror with the approved images. Operations of this group of the Navin Manager API.

Resource

HubApi.get_status

get_status() -> Any

Get the Hub status. Returns configured, the public settings (the token is never returned), the state of the last accepted document and a packages_summary. Permission system:read.

Route: /api/v1/hub (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the Hub status".

Raises: the typed errors of the transport (Errors).

HubApi.import_offline

import_offline(body: Any = None) -> Any

Import a distribution document offline. Verifies and stores a signed document brought on removable media (air-gapped site). Needs the customer and the pinned keys in the settings. Returns metadata_version, targets, images_loaded and changes. Permission settings:manage; 422 hub_document_invalid when a check fails. Audited as hub.import.

Route: /api/v1/hub/import (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The signed distribution document, as JSON.

Returns: Any. Decoded JSON answer of the operation "Import a distribution document offline".

Raises: the typed errors of the transport (Errors).

HubApi.list_packages

list_packages() -> Any

List the approved packages. Targets of the accepted document (project, name, version, image, revocation), each with whether it is the latest approved version and whether it is installed on a cluster. Returns items. Permission system:read.

Route: /api/v1/hub/packages (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the approved packages".

Raises: the typed errors of the transport (Errors).

HubApi.put_settings

put_settings(body: Any = None) -> Any

Save the Hub settings. Saves the connection to the Hub and returns the status. The token is sealed; leave it null to keep the stored one. Permission settings:manage; 422 hub_document_invalid when trusted_keys_pem holds no Ed25519 public key. Audited as hub.settings (key identifiers only).

Route: /api/v1/hub/settings (PUT).

Name	Type	Default	Required	Description
body	Any	None	no	Hub address, customer, keys and token.

Returns: Any. Decoded JSON answer of the operation "Save the Hub settings".

Raises: the typed errors of the transport (Errors).

HubApi.sync

sync() -> Any

Sync with the Hub. Downloads the document of the customer from the Hub, verifies and stores it. Needs the URL, the customer and the pinned keys in the settings. Returns metadata_version, targets, images_loaded and changes. Permission settings:manage. Audited as hub.sync.

Route: /api/v1/hub/sync (POST).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Sync with the Hub".

Raises: the typed errors of the transport (Errors).

Class KubernetesApi

Kubernetes clusters. A cluster of the Manager can be a Kubernetes cluster instead of a set of hosts. The Manager talks to it through its API server only (never over SSH) with a sealed kubeconfig, and runs catalog services there as ManagedComponent resources of the group platform.navin.ai: it writes the desired state (server side apply, field manager navin-manager), the Navin Platform Operator applies the charts, and every answer about a component is read from the status of its resource. The Navin Cluster Agent, deployed in the cluster, receives signed commands and reports back. Operations of this group of the Navin Manager API.

Resource

KubernetesApi.agent_manifests

agent_manifests(cluster_id: str, image: string = None, replicas: integer = None) -> Any

Get the manifests of the cluster agent. ServiceAccount, RBAC and Deployment of the cluster agent for the managed namespace, as objects (manifests) and as YAML (yaml) ready for kubectl apply. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent/manifests (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
image	string	None	no	Image of the agent pinned by digest, for example <registry-host>/navin/cluster-agent@sha256:<64 hex>.
replicas	integer	None	no	Replicas of the agent Deployment (leader election), 2 to 5. Default 2.

Returns: Any. Decoded JSON answer of the operation "Get the manifests of the cluster agent".

Raises: the typed errors of the transport (Errors).

KubernetesApi.component_action

component_action(cluster_id: str, name: str, body: Any = None) -> Any

Run an action on a Kubernetes component. Changes the desired state: start, stop, restart or rolling_restart (a restart timestamp), scale (fixed replicas or autoscaling, never below the disruption budget) or maintenance (enabled). Answers 202 with component and requested. Permission services:operate. Errors: 409 k8s_maintenance, 409 k8s_component_stopped, 409 k8s_replicas_below_pdb. Audited as k8s.component.<action>.

Route: /api/v1/clusters/{cluster_id}/kubernetes/components/{name}/actions (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
name	str		yes	Name of the component.
body	Any	None	no	Action and its arguments.

Returns: Any. Decoded JSON answer of the operation "Run an action on a Kubernetes component".

Raises: the typed errors of the transport (Errors).

KubernetesApi.configure_component

configure_component(cluster_id: str, name: str, body: Any = None) -> Any

Configure a Kubernetes component. Changes the version, source, values, secret references or disruption budget of the component (server side apply). Values that look like secrets are refused: use secret_refs. Permission configs:edit. Errors: 422 k8s_values_secret, 409 k8s_maintenance, 404 k8s_component_not_found. Audited as k8s.component.configure (field names only).

Route: /api/v1/clusters/{cluster_id}/kubernetes/components/{name} (PATCH).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
name	str		yes	Name of the component.
body	Any	None	no	Fields of the component to change.

Returns: Any. Decoded JSON answer of the operation "Configure a Kubernetes component".

Raises: the typed errors of the transport (Errors).

KubernetesApi.get_agent

get_agent(cluster_id: str) -> Any

Get the cluster agent. State of the identity of the Navin Cluster Agent and its last report. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Get the cluster agent".

Raises: the typed errors of the transport (Errors).

KubernetesApi.get_component

get_component(cluster_id: str, name: str) -> Any

Get a Kubernetes component. Reads the resource and returns its observed state. Permission cluster:read; 404 k8s_component_not_found (the record is dropped when the resource is gone).

Route: /api/v1/clusters/{cluster_id}/kubernetes/components/{name} (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
name	str		yes	Name of the component.

Returns: Any. Decoded JSON answer of the operation "Get a Kubernetes component".

Raises: the typed errors of the transport (Errors).

KubernetesApi.get_target

get_target(cluster_id: str) -> Any

Get a Kubernetes target. Returns the API server, the namespace, the server version, the discovered mode, distribution and number of nodes, the discovery time, the last error and the kubeconfig as {"secret": true, "set": true}. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Get a Kubernetes target".

Raises: the typed errors of the transport (Errors).

KubernetesApi.import_rbac

import_rbac(cluster_id: str, namespace: string = None, identity: string = None) -> Any

Get the RBAC of the import identity. Least privilege RBAC of the identity the Manager uses for the cluster, as objects and YAML, with the resulting user name: read what the discovery needs, write only platform.navin.ai resources in the managed namespace; no Secret, RBAC object, workload, exec nor impersonation. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/import-rbac (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
namespace	string	None	no	Managed namespace. Default navin-platform.
identity	string	None	no	Name of the ServiceAccount of the import. Default navin-import.

Returns: Any. Decoded JSON answer of the operation "Get the RBAC of the import identity".

Raises: the typed errors of the transport (Errors).

KubernetesApi.install_component

install_component(cluster_id: str, body: Any = None) -> Any

Install a catalog service on Kubernetes. Creates the ManagedComponent resource of a catalog service (chart from a path or an OCI reference pinned by digest) and returns its state (201). Values that look like secrets are refused. Permission services:install. Errors: 409 k8s_component_exists, 422 k8s_values_secret, 409 k8s_replicas_below_pdb. Audited as k8s.component.install.

Route: /api/v1/clusters/{cluster_id}/kubernetes/components (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Service, source, values, replicas and policies of the component.

Returns: Any. Decoded JSON answer of the operation "Install a catalog service on Kubernetes".

Raises: the typed errors of the transport (Errors).

KubernetesApi.issue

issue(cluster_id: str, body: Any = None) -> Any

Issue the cluster agent identity. Issues the client certificate and the configuration of the Navin Cluster Agent: certificate_pem, private_key_pem (returned once, never stored), ca_pem, manager_public_key_pem, config, fingerprint and not_after (201). Permission cluster:manage; 422 k8s_agent_gateway_url_invalid. Audited as k8s.agent.issue.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Gateway URL, tenant and offline delay of the agent.

Returns: Any. Decoded JSON answer of the operation "Issue the cluster agent identity".

Raises: the typed errors of the transport (Errors).

KubernetesApi.last_discovery

last_discovery(cluster_id: str) -> Any

Get the last discovery of a Kubernetes cluster. Returns the inventory of the last discovery. Permission cluster:read; 404 k8s_not_discovered.

Route: /api/v1/clusters/{cluster_id}/kubernetes/discovery (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Get the last discovery of a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

KubernetesApi.list_commands

list_commands(cluster_id: str) -> Any

List the cluster agent commands. The last 200 commands queued for the cluster agent, each with its receipts. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent/commands (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the cluster agent commands".

Raises: the typed errors of the transport (Errors).

KubernetesApi.list_components

list_components(cluster_id: str) -> Any

List the Kubernetes components. Live list: every ManagedComponent of the namespace with its status, which is also written into the model of the Manager. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/components (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the Kubernetes components".

Raises: the typed errors of the transport (Errors).

KubernetesApi.patch_target

patch_target(cluster_id: str, body: Any = None) -> Any

Update a Kubernetes target. Changes the API server, the kubeconfig (send the read back object to keep it) or the namespace (refused while components remain); the kubeconfig guard runs again. Permission cluster:manage. Errors: 422 validation_error, 409 k8s_components_remain. Audited as k8s.cluster.update.

Route: /api/v1/clusters/{cluster_id}/kubernetes (PATCH).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Fields of the target to change.

Returns: Any. Decoded JSON answer of the operation "Update a Kubernetes target".

Raises: the typed errors of the transport (Errors).

KubernetesApi.queue_command

queue_command(cluster_id: str, body: Any = None) -> Any

Queue a signed command for the cluster agent. Records the authorization decision, then queues a signed command (managedcomponent.apply, managedcomponent.delete or inventory.report) the agent picks up. Answers 202 with the command. Permission services:operate. Audited as k8s.agent.policy.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent/commands (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Operation, parameters, idempotency key and validity.

Returns: Any. Decoded JSON answer of the operation "Queue a signed command for the cluster agent".

Raises: the typed errors of the transport (Errors).

KubernetesApi.register

register(cluster_id: str, body: Any = None) -> Any

Register a Kubernetes cluster. Checks the kubeconfig against the API server given, calls /version, seals the kubeconfig and turns the cluster into a Kubernetes cluster. The cluster must have no host. Returns the target (201). Permission cluster:manage. Errors: 409 k8s_already_registered, 409 k8s_cluster_has_hosts, kubeconfig guard and API errors. Audited as k8s.cluster.register.

Route: /api/v1/clusters/{cluster_id}/kubernetes (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	API server, kubeconfig and namespace.

Returns: Any. Decoded JSON answer of the operation "Register a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

KubernetesApi.remove_component

remove_component(cluster_id: str, name: str) -> Any

Remove a Kubernetes component. Deletes the ManagedComponent resource; the operator uninstalls the chart. Answers 202 with {"name", "state": "removed"} once the resource is gone, else the component still being deleted. Permission services:install. Errors: 404 k8s_component_not_found, 409 k8s_maintenance. Audited as k8s.component.remove.

Route: /api/v1/clusters/{cluster_id}/kubernetes/components/{name} (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
name	str		yes	Name of the component (the ManagedComponent resource).

Returns: Any. Decoded JSON answer of the operation "Remove a Kubernetes component".

Raises: the typed errors of the transport (Errors).

KubernetesApi.revoke

revoke(cluster_id: str) -> Any

Revoke the cluster agent identity. Revokes the identity of the Navin Cluster Agent. Answers 204. Permission cluster:manage; 404 k8s_agent_not_registered. Audited as k8s.agent.revoke.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Revoke the cluster agent identity".

Raises: the typed errors of the transport (Errors).

KubernetesApi.run_discovery

run_discovery(cluster_id: str) -> Any

Discover a Kubernetes cluster. Reads, with read only calls, the version, the distribution (bring your own or managed), the nodes with their capacity and GPUs, the storage and ingress classes, CoreDNS and the platform add-ons (cert-manager, Cilium, Kyverno, Argo CD, KEDA...). Stores and returns the inventory. Permission hosts:manage. Audited as k8s.discovery.

Route: /api/v1/clusters/{cluster_id}/kubernetes/discovery (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Discover a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

KubernetesApi.unregister

unregister(cluster_id: str) -> Any

Unregister a Kubernetes cluster. Forgets the API server and the kubeconfig; the cluster becomes a host cluster again. Refused while components remain (409 k8s_components_remain). Answers 204. Permission cluster:manage. Audited as k8s.cluster.unregister.

Route: /api/v1/clusters/{cluster_id}/kubernetes (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Unregister a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

Class LifecycleApi

Lifecycle. The lifecycle of a cluster and of its services after the install: installation profile and approvals, preflight, liveness, readiness and smoke checks, upgrades with rollback and restore, coordinated backups and restores, drift detection, sanitized support bundles, signed acceptance reports and the uniform component sheet. Operations of this group of the Navin Manager API.

Resource

LifecycleApi.acceptance_key

acceptance_key() -> Any

Get the public key that signs the acceptance reports. Returns algorithm (Ed25519), key_id and public_key_pem, to verify a report offline. Any signed in user.

Route: /api/v1/acceptance/public-key (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the public key that signs the acceptance reports".

Raises: the typed errors of the transport (Errors).

LifecycleApi.cluster_profile

cluster_profile(cluster_id: str, profile: string | null = None) -> Any

Evaluate the profile of a cluster. Every rule of the cluster profile (or of profile, to compare before choosing one) evaluated against the real state, each with status (pass or fail), label and reason; the status is blocked when one rule fails. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/profile (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
profile	string | null	None	no	Profile to evaluate instead of the current one: development, standard, banking-secure, air-gapped or hybrid.

Returns: Any. Decoded JSON answer of the operation "Evaluate the profile of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.component_sheet

component_sheet(cluster_id: str, service: str) -> Any

Get the component sheet of a service. Every tab of the uniform component sheet from the observed state: overview, instances, config, dependencies, logs, metrics, security (TLS, endpoints, secrets set or not, ports, certificates, run users, profile), operations, upgrade, backups, audit and support. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/sheet (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Get the component sheet of a service".

Raises: the typed errors of the transport (Errors).

LifecycleApi.create_backup

create_backup(cluster_id: str, body: Any = None) -> Any

Take a coordinated backup. Starts one operation that backs up the services given (every backupable service by default) in dependency order, sharing one set_id; the set succeeds only when every member succeeded. Returns operation_id, set_id and backup_ids. Permission services:operate. Audited as backup.create.

Route: /api/v1/clusters/{cluster_id}/backups (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Services to back up.

Returns: Any. Decoded JSON answer of the operation "Take a coordinated backup".

Raises: the typed errors of the transport (Errors).

LifecycleApi.create_bundle

create_bundle(cluster_id: str) -> Any

Build a support bundle. Starts an operation that collects log tails, the profile, the hosts, the service versions and states, the rendered configuration, the open alerts, the drift findings and the operation history into a tar.gz archive in which every secret and personal datum is masked. Returns operation_id and bundle_id. Permission cluster:manage. Audited as support.bundle.

Route: /api/v1/clusters/{cluster_id}/support-bundles (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Build a support bundle".

Raises: the typed errors of the transport (Errors).

LifecycleApi.create_report

create_report(cluster_id: str) -> Any

Run an acceptance. Starts the acceptance.run operation: cluster preflight, liveness of every running instance, readiness and smoke test of every managed service (each stage tolerates its failures so that every check runs), then the signed report. Returns operation_id and report_id. Permission services:install. Audited as acceptance.run.

Route: /api/v1/clusters/{cluster_id}/acceptance-reports (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Run an acceptance".

Raises: the typed errors of the transport (Errors).

LifecycleApi.decide_approval

decide_approval(cluster_id: str, approval_id: str, body: Any = None) -> Any

Approve or reject an approval request. Decides a pending request; the requester cannot decide its own. Returns the approval. Permission cluster:manage. Errors: 404 approval_invalid, 409 approval_not_pending, 403 approval_self. Audited as approval.approve or approval.reject.

Route: /api/v1/clusters/{cluster_id}/approvals/{approval_id}/decision (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
approval_id	str		yes	Identifier of the approval request.
body	Any	None	no	The decision.

Returns: Any. Decoded JSON answer of the operation "Approve or reject an approval request".

Raises: the typed errors of the transport (Errors).

LifecycleApi.download_bundle

download_bundle(cluster_id: str, bundle_id: str) -> Any

Download a support bundle. Returns the navin-support-<time>.tar.gz archive of a succeeded bundle. Permission cluster:manage; 404 bundle_not_found. Audited as support.bundle_download.

Route: /api/v1/clusters/{cluster_id}/support-bundles/{bundle_id}/download (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bundle_id	str		yes	Identifier of the support bundle.

Returns: Any. Decoded JSON answer of the operation "Download a support bundle".

Raises: the typed errors of the transport (Errors).

LifecycleApi.drift_reconcile

drift_reconcile(cluster_id: str, finding_id: str, body: Any = None) -> Any

Reconcile a drift finding. Rewrites the files and units of the drifted instance from the Manager configuration (and restarts it when asked). Returns operation_id. Permission configs:edit. Errors: 404 drift_not_found, 409 drift_not_reconcilable (a file that belongs to no service). Audited as drift.reconcile.

Route: /api/v1/clusters/{cluster_id}/drift/{finding_id}/reconcile (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
finding_id	str		yes	Identifier of the drift finding.
body	Any	None	no	Restart option and optional approval.

Returns: Any. Decoded JSON answer of the operation "Reconcile a drift finding".

Raises: the typed errors of the transport (Errors).

LifecycleApi.drift_report

drift_report(cluster_id: str, resolved: boolean = None) -> Any

Get the drift report of a cluster. Findings of the last scans: managed files and units changed, removed or replaced outside the Manager, with host, service, component and path. Open findings raise the config_drift alert. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/drift (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
resolved	boolean	None	no	Also return the resolved findings. Default false.

Returns: Any. Decoded JSON answer of the operation "Get the drift report of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.drift_scan

drift_scan(cluster_id: str, body: Any = None) -> Any

Scan the cluster for drift. Starts an operation with one digest task per host over the files and units the Manager wrote; differences open findings. Returns operation_id. Permission services:operate. Audited as drift.scan.

Route: /api/v1/clusters/{cluster_id}/drift/scan (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Hosts to scan.

Returns: Any. Decoded JSON answer of the operation "Scan the cluster for drift".

Raises: the typed errors of the transport (Errors).

LifecycleApi.get_report

get_report(cluster_id: str, report_id: str) -> Any

Get a signed acceptance report. Returns the signed document: one item per check with PASS, FAIL or BLOCKED and its evidence, the verdict (FAIL when one item failed, BLOCKED when none failed and one is blocked, else PASS) and the signature. Permission cluster:read; 404 acceptance_not_found until the run succeeded.

Route: /api/v1/clusters/{cluster_id}/acceptance-reports/{report_id} (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
report_id	str		yes	Identifier of the acceptance report.

Returns: Any. Decoded JSON answer of the operation "Get a signed acceptance report".

Raises: the typed errors of the transport (Errors).

LifecycleApi.list_approvals

list_approvals(cluster_id: str) -> Any

List the approvals of a cluster. The last 200 approvals, newest first: action, service, reason, status (pending, approved, rejected, expired or used), requester, decider, the operation that used it and the times. Approvals past their expiry are marked expired first. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/approvals (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the approvals of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.list_backups

list_backups(cluster_id: str, service: string | null = None) -> Any

List the service backups of a cluster. Returns backupable (the installed services whose catalog declares a backup) and the last 300 backups with their service, host, set, status, files and digests. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/backups (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	string | null	None	no	Only the backups of this service.

Returns: Any. Decoded JSON answer of the operation "List the service backups of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.list_bundles

list_bundles(cluster_id: str) -> Any

List the support bundles of a cluster. The last 50 bundles with their status, size, SHA-256, contents, redactions and operation. Permission cluster:manage.

Route: /api/v1/clusters/{cluster_id}/support-bundles (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the support bundles of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.list_profiles

list_profiles() -> Any

List the installation profiles. Every profile with its label and description in both languages, its rules, whether it requires approvals and the severity of the network rules. Any signed in user.

Route: /api/v1/profiles (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the installation profiles".

Raises: the typed errors of the transport (Errors).

LifecycleApi.list_reports

list_reports(cluster_id: str) -> Any

List the acceptance reports of a cluster. The last 100 acceptance runs of the cluster, newest first, with their status, verdict and operation. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/acceptance-reports (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the acceptance reports of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.list_upgrades

list_upgrades(cluster_id: str) -> Any

List the upgrades of a cluster. The last 200 upgrades of every service with their versions, status, backup and operations. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/upgrades (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the upgrades of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.report_html

report_html(cluster_id: str, report_id: str, lang: "en" | "fr" = None) -> Any

Get an acceptance report as HTML. Renders the report as a self contained HTML page in the language asked, for printing or archiving. Permission cluster:read; 404 acceptance_not_found.

Route: /api/v1/clusters/{cluster_id}/acceptance-reports/{report_id}/html (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
report_id	str		yes	Identifier of the acceptance report.
lang	"en" | "fr"	None	no	Language of the page: en (default) or fr.

Returns: Any. Decoded JSON answer of the operation "Get an acceptance report as HTML".

Raises: the typed errors of the transport (Errors).

LifecycleApi.request_approval

request_approval(cluster_id: str, body: Any = None) -> Any

Request an approval. Records a pending request for a disruptive action on a service; another user decides it. Returns the approval (201). Permission services:operate. Audited as approval.request.

Route: /api/v1/clusters/{cluster_id}/approvals (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Action, service and reason.

Returns: Any. Decoded JSON answer of the operation "Request an approval".

Raises: the typed errors of the transport (Errors).

LifecycleApi.restore_backup

restore_backup(cluster_id: str, backup_id: str, body: Any = None) -> Any

Restore a service backup. Starts the restore operation: stop the instances, check the digests, run the restore steps, start the instances, run the health checks, the verify steps, the service check and the smoke test. Returns operation_id. Permission services:install; an approval under banking-secure. Audited as backup.restore.

Route: /api/v1/clusters/{cluster_id}/backups/{backup_id}/restore (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
backup_id	str		yes	Identifier of the service backup.
body	Any	None	no	Optional approval.

Returns: Any. Decoded JSON answer of the operation "Restore a service backup".

Raises: the typed errors of the transport (Errors).

LifecycleApi.restore_upgrade

restore_upgrade(cluster_id: str, upgrade_id: str, body: Any = None) -> Any

Restore the backup taken before an upgrade. Starts the operation that brings back the previous release and its data from the backup taken before the upgrade, when a rollback is not possible. Returns operation_id. Permission services:install; 404 upgrade_not_found; an approval under banking-secure. Audited as service.restore.

Route: /api/v1/clusters/{cluster_id}/upgrades/{upgrade_id}/restore (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
upgrade_id	str		yes	Identifier of the upgrade.
body	Any	None	no	Optional approval.

Returns: Any. Decoded JSON answer of the operation "Restore the backup taken before an upgrade".

Raises: the typed errors of the transport (Errors).

LifecycleApi.rollback

rollback(cluster_id: str, upgrade_id: str, body: Any = None) -> Any

Roll an upgrade back. Starts the operation that replays the sealed tasks of the previous release and restores the previous configuration version. Refused when the descriptor declares it impossible or an irreversible migration ran (use the restore instead). Returns operation_id. Permission services:install; 404 upgrade_not_found. Audited as service.rollback.

Route: /api/v1/clusters/{cluster_id}/upgrades/{upgrade_id}/rollback (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
upgrade_id	str		yes	Identifier of the upgrade.
body	Any	None	no	Optional approval.

Returns: Any. Decoded JSON answer of the operation "Roll an upgrade back".

Raises: the typed errors of the transport (Errors).

LifecycleApi.run_preflight

run_preflight(cluster_id: str, body: Any = None) -> Any

Run the installation preflight of a cluster. Every check that must pass before a service is installed or upgraded, with its severity, evidence and a blocking verdict: host facts, DNS, catalog preflight entries, firewall, capacity, versions, TLS and profile rules. A check in fail blocks. Nothing is changed. Permission services:install.

Route: /api/v1/clusters/{cluster_id}/preflight (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Services and hosts to check.

Returns: Any. Decoded JSON answer of the operation "Run the installation preflight of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.service_checks

service_checks(cluster_id: str, service: str) -> Any

Get the checks of a service. Liveness of every instance (health checks of the agent), readiness (service check) and functional smoke test, each with its status, results, error and time. Only a passed smoke test proves that the service works. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/checks (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Get the checks of a service".

Raises: the typed errors of the transport (Errors).

LifecycleApi.set_profile

set_profile(cluster_id: str, body: Any = None) -> Any

Change the profile of a cluster. Sets the installation profile and returns its evaluation. Permission cluster:manage. Audited as cluster.profile with the previous and the new profile.

Route: /api/v1/clusters/{cluster_id}/profile (PUT).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	The new profile.

Returns: Any. Decoded JSON answer of the operation "Change the profile of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.start_upgrade

start_upgrade(cluster_id: str, service: str, body: Any = None) -> Any

Upgrade a service. Upgrades the service to the catalog release in one operation:

Route: /api/v1/clusters/{cluster_id}/services/{service}/upgrade (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Canary host and optional approval.

Returns: Any. Decoded JSON answer of the operation "Upgrade a service".

Raises: the typed errors of the transport (Errors).

LifecycleApi.upgrade_info

upgrade_info(cluster_id: str, service: str) -> Any

Check whether a service can be upgraded. Returns from (installed release), to (catalog release), allowed with the problems, stateful, backup_before, the migrations, whether a rollback is possible, the upgrade matrix and the history of the last 50 upgrades. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/upgrade (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Check whether a service can be upgraded".

Raises: the typed errors of the transport (Errors).

LifecycleApi.verify_report

verify_report(body: Any = None) -> Any

Verify the signature of an acceptance report. Checks the Ed25519 signature of a report document against the key of this Manager and returns valid, trusted, key_id and the reason of a refusal. Any signed in user.

Route: /api/v1/acceptance/verify (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The signed report document.

Returns: Any. Decoded JSON answer of the operation "Verify the signature of an acceptance report".

Raises: the typed errors of the transport (Errors).

Class McpApi

MCP servers. The MCP (Model Context Protocol) servers of a tenant project: created from a preset of the Navin library or typed by an administrator, tested, and optionally hosted on the mcp-host service of a cluster. Operations of this group of the Navin Manager API.

Resource

McpApi.create_server

create_server(body: Any = None) -> Any

Create an MCP server. Creates a server from a preset (its required fields are mandatory) or a custom one, and returns it (201). A preset whose URL is not internal needs url set to the internal address of its server. Permission mcp:manage. Errors: 422 mcp_fields_missing, 422 mcp_fields_unknown, 422 mcp_target_required, 422 mcp_online_forbidden, 404 mcp_preset_not_found, 409 mcp_server_name_taken. Audited as mcp.create.

Route: /api/v1/mcp/servers (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Tenant, project and definition of the server.

Returns: Any. Decoded JSON answer of the operation "Create an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.delete_server

delete_server(server_id: str, tenant: string = None, project: string = None) -> Any

Delete an MCP server. Deletes the server; a hosted server is withdrawn from its hosting first. Answers 204. Permission mcp:manage; 404 mcp_server_not_found. Audited as mcp.delete.

Route: /api/v1/mcp/servers/{server_id} (DELETE).

Name	Type	Default	Required	Description
server_id	str		yes	Identifier of the MCP server.
tenant	string	None	no	Tenant slug of the server: lower case letters, digits and -, at most 63 characters.
project	string	None	no	Project slug of the server.

Returns: Any. Decoded JSON answer of the operation "Delete an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.get_server

get_server(server_id: str, tenant: string = None, project: string = None) -> Any

Get an MCP server. Returns the server with its transport, URL or command, allowed tools, configured and secret field names, last test and hosting (state, cluster, URL; never the token). Permission mcp:read; 404 mcp_server_not_found.

Route: /api/v1/mcp/servers/{server_id} (GET).

Name	Type	Default	Required	Description
server_id	str		yes	Identifier of the MCP server.
tenant	string	None	no	Tenant slug of the server.
project	string	None	no	Project slug of the server.

Returns: Any. Decoded JSON answer of the operation "Get an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.host_server

host_server(server_id: str, body: Any = None, tenant: string = None, project: string = None) -> Any

Host a stdio MCP server on a cluster. Hosts a stdio server on the mcp-host service of a cluster: a new bearer token (sealed; the runtime only receives its SHA-256), status deploying, then the mcp.hosting.apply operation that writes servers.json on every instance; the status becomes hosted or failed. Answers 202 with the server and operation_id. Permission mcp:manage. Errors: 422 mcp_hosting_stdio_only, 409 mcp_hosting_disabled, 409 mcp_host_not_installed. Audited as mcp.host.

Route: /api/v1/mcp/servers/{server_id}/hosting (POST).

Name	Type	Default	Required	Description
server_id	str		yes	Identifier of the MCP server.
body	Any	None	no	Cluster and limits of the hosting.
tenant	string	None	no	Tenant slug of the server.
project	string	None	no	Project slug of the server.

Returns: Any. Decoded JSON answer of the operation "Host a stdio MCP server on a cluster".

Raises: the typed errors of the transport (Errors).

McpApi.hosted_servers

hosted_servers(tenant: string = None, project: string | null = None) -> Any

List the hosted MCP servers with their tokens. Hosted servers of a tenant (one project or all) with url, bearer token, allowed_tools, status and hosted_at, for the Navin Enterprise platform. Permission mcp:publish (admin role only). Audited as mcp.hosted_list (identifiers only, never a token).

Route: /api/v1/mcp/hosted (GET).

Name	Type	Default	Required	Description
tenant	string	None	no	Tenant slug.
project	string | null	None	no	Project slug; every project of the tenant when absent.

Returns: Any. Decoded JSON answer of the operation "List the hosted MCP servers with their tokens".

Raises: the typed errors of the transport (Errors).

McpApi.hosting_infrastructure

hosting_infrastructure(cluster_id: string | null = None) -> Any

Get the MCP hosting infrastructure. Per cluster: whether mcp-host is installed, its instances (FQDN, base URL, state) and the number of servers each one hosts. A server is placed on one instance by a hash of its identifier. Permission mcp:read.

Route: /api/v1/mcp/hosting (GET).

Name	Type	Default	Required	Description
cluster_id	string | null	None	no	Only this cluster (UUID).

Returns: Any. Decoded JSON answer of the operation "Get the MCP hosting infrastructure".

Raises: the typed errors of the transport (Errors).

McpApi.list_presets

list_presets() -> Any

List the MCP presets. Presets of the Navin library (name, category, transport, hosting, fields to fill), sorted by category and name. Permission mcp:read; 503 mcp_presets_unavailable.

Route: /api/v1/mcp/presets (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the MCP presets".

Raises: the typed errors of the transport (Errors).

McpApi.list_servers

list_servers(tenant: string = None, project: string = None) -> Any

List the MCP servers of a project. Servers of one project of one tenant (both required), without any secret value. Permission mcp:read.

Route: /api/v1/mcp/servers (GET).

Name	Type	Default	Required	Description
tenant	string	None	no	Tenant slug.
project	string	None	no	Project slug.

Returns: Any. Decoded JSON answer of the operation "List the MCP servers of a project".

Raises: the typed errors of the transport (Errors).

McpApi.renew_token

renew_token(server_id: str, tenant: string = None, project: string = None) -> Any

Renew the token of a hosted MCP server. Issues a new bearer token and applies it; the previous token stops working once applied. Answers 202. Permission mcp:manage. Errors: 409 mcp_not_hosted, 409 mcp_hosting_disabled. Audited as mcp.hosting_token.

Route: /api/v1/mcp/servers/{server_id}/hosting/token (POST).

Name	Type	Default	Required	Description
server_id	str		yes	Identifier of the MCP server.
tenant	string	None	no	Tenant slug of the server.
project	string	None	no	Project slug of the server.

Returns: Any. Decoded JSON answer of the operation "Renew the token of a hosted MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.test_server

test_server(server_id: str, tenant: string = None, project: string = None) -> Any

Test an MCP server. Speaks MCP to the server (initialize, notifications/initialized, tools/list) over streamable HTTP, SSE, or stdin and stdout of the command when it is on the PATH (no shell, with a timeout); a hosted server is tested at its hosted URL with its token. Returns and keeps in last_test the result {ok, tools, server_info, error, tested_at}; an error never repeats a secret value. Permission mcp:manage; 422 mcp_online_forbidden. Audited as mcp.test.

Route: /api/v1/mcp/servers/{server_id}/test (POST).

Name	Type	Default	Required	Description
server_id	str		yes	Identifier of the MCP server.
tenant	string	None	no	Tenant slug of the server.
project	string	None	no	Project slug of the server.

Returns: Any. Decoded JSON answer of the operation "Test an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.unhost_server

unhost_server(server_id: str, tenant: string = None, project: string = None) -> Any

Stop hosting an MCP server. Takes the server out of its hosting: status removing, then the mcp.hosting.apply operation without it (none at the end). Answers 202 with the server and operation_id. Permission mcp:manage; 409 mcp_not_hosted. Audited as mcp.unhost.

Route: /api/v1/mcp/servers/{server_id}/hosting (DELETE).

Name	Type	Default	Required	Description
server_id	str		yes	Identifier of the MCP server.
tenant	string	None	no	Tenant slug of the server.
project	string	None	no	Project slug of the server.

Returns: Any. Decoded JSON answer of the operation "Stop hosting an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.update_server

update_server(server_id: str, body: Any = None, tenant: string = None, project: string = None) -> Any

Update an MCP server. Changes the fields given and returns the server. values is merged with the stored ones; url, command, args, headers and env apply to custom servers only (422 mcp_custom_only). Disabling a hosted server withdraws it from its hosting. Permission mcp:manage. Errors: 422 mcp_fields_unknown, 422 mcp_online_forbidden. Audited as mcp.update.

Route: /api/v1/mcp/servers/{server_id} (PATCH).

Name	Type	Default	Required	Description
server_id	str		yes	Identifier of the MCP server.
body	Any	None	no	Fields of the server to change.
tenant	string	None	no	Tenant slug of the server.
project	string	None	no	Project slug of the server.

Returns: Any. Decoded JSON answer of the operation "Update an MCP server".

Raises: the typed errors of the transport (Errors).

Class McpRuntimeApi

MCP runtime. The MCP runtime of a Kubernetes cluster: the ToolHive Kubernetes Operator, installed from pinned charts, and the ephemeral MCP server instances the lifecycle controller of the Control Plane creates in it. Operations of this group of the Navin Manager API.

Resource

McpRuntimeApi.destroy_instance

destroy_instance(cluster_id: str, namespace: str, name: str) -> Any

Delete a managed MCP instance. Deletes one managed MCPServer (uid precondition); the Control Plane controller then revokes its credentials and closes it. Returns namespace, name, instance_id and state (deleting). Permission services:operate. Errors: 404 mcp_runtime_instance_not_found, 502 mcp_runtime_forbidden (the identity of the Manager lacks the right). Audited as mcp_runtime.instance.destroy.

Route: /api/v1/clusters/{cluster_id}/mcp-runtime/instances/{namespace}/{name} (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
namespace	str		yes	Project namespace of the instance, mcp-<12 hex>.
name	str		yes	Name of the MCPServer object.

Returns: Any. Decoded JSON answer of the operation "Delete a managed MCP instance".

Raises: the typed errors of the transport (Errors).

McpRuntimeApi.install_toolhive

install_toolhive(cluster_id: str) -> Any

Install the ToolHive operator. Writes the two ManagedComponent resources of ToolHive (CRDs, then operator) in toolhive-system, pinned by digest. Returns namespace, version and the components written (201). Permission services:install; 409 mcp_runtime_installed. Audited as mcp_runtime.install.

Route: /api/v1/clusters/{cluster_id}/mcp-runtime/install (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Install the ToolHive operator".

Raises: the typed errors of the transport (Errors).

McpRuntimeApi.restart_instance

restart_instance(cluster_id: str, namespace: str, name: str) -> Any

Restart a managed MCP instance. Restarts one managed MCPServer without changing its spec: a merge patch of the annotation mcpserver.toolhive.stacklok.dev/restarted-at to a new RFC 3339 time (rolling restart by the operator), with the uid as precondition. Returns namespace, name, instance_id, state (restarting) and restarted_at. Permission services:operate; 404 mcp_runtime_instance_not_found. Audited as mcp_runtime.instance.restart.

Route: /api/v1/clusters/{cluster_id}/mcp-runtime/instances/{namespace}/{name}/restart (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
namespace	str		yes	Project namespace of the instance, mcp-<12 hex>.
name	str		yes	Name of the MCPServer object.

Returns: Any. Decoded JSON answer of the operation "Restart a managed MCP instance".

Raises: the typed errors of the transport (Errors).

McpRuntimeApi.runtime_state

runtime_state(cluster_id: str, tenant: string | null = None, project: string | null = None) -> Any

Get the MCP runtime state. Returns the operator state (with crd_installed), the ToolHive components, the preset, the managed instances items (filtered by tenant and project), the ignored objects, the aggregates by tenant and project (always over every managed instance) and observed_at. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/mcp-runtime (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
tenant	string | null	None	no	Only the instances of this tenant (label value, at most 63 characters).
project	string | null	None	no	Only the instances of this project (label value, at most 63 characters).

Returns: Any. Decoded JSON answer of the operation "Get the MCP runtime state".

Raises: the typed errors of the transport (Errors).

Class MeApi

My profile. The profile of the signed in user and its personal API tokens. Operations of this group of the Navin Manager API.

Resource

MeApi.list_tokens

list_tokens() -> Any

List my API tokens. Lists every token of the caller, newest first, revoked ones included: id, name, prefix, permissions (null: every permission of the user), expires_at, last_used_at, revoked_at, created_at. The secret is never returned.

Route: /api/v1/me/tokens (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List my API tokens".

Raises: the typed errors of the transport (Errors).

MeApi.me

me() -> Any

Read my profile. Returns the account of the caller: identifier, username, display name, email, source (local, ldap, oidc), role bindings, MFA state, language, lock and last sign in.

Route: /api/v1/me (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Read my profile".

Raises: the typed errors of the transport (Errors).

MeApi.revoke_token

revoke_token(token_id: str) -> Any

Revoke one of my API tokens. Revokes the token at once (revoking it again is harmless). Browser session only. Answers 204; 404 token_not_found when the token is not one of yours. Audited as token.revoke.

Route: /api/v1/me/tokens/{token_id} (DELETE).

Name	Type	Default	Required	Description
token_id	str		yes	Identifier of the API token, from GET /me/tokens.

Returns: Any. Decoded JSON answer of the operation "Revoke one of my API tokens".

Raises: the typed errors of the transport (Errors).

Class MetaApi

Version. Public metadata of the Manager. No authentication is needed. Operations of this group of the Navin Manager API.

Resource

MetaApi.version

version() -> Any

Get the version of the Manager. Returns name (navin-manager), version, environment and the stack of the catalog (name, version, number of services). Public.

Route: /api/v1/version (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the version of the Manager".

Raises: the typed errors of the transport (Errors).

Class MirrorApi

Local mirror. The local mirror holds the packages, container images and Python wheels the agents install from, so that a site without Internet access (or under the banking-secure and air-gapped profiles) never downloads from outside. It is filled from an offline bundle described by a manifest. Operations of this group of the Navin Manager API.

Resource

MirrorApi.reload

reload(verify: boolean = None) -> Any

Reload the mirror manifest. Reads the manifest of the mirror again and replaces the recorded artifacts with its content; every file must exist. Returns what was loaded. Permission settings:manage. Errors: 409 mirror_manifest_missing, 422 mirror_manifest_invalid. Audited as mirror.reload (outcome failure with the error code when the manifest is refused).

Route: /api/v1/mirror/reload (POST).

Name	Type	Default	Required	Description
verify	boolean	None	no	Also check the SHA-256 digest of every file against the manifest (slower). Default false.

Returns: Any. Decoded JSON answer of the operation "Reload the mirror manifest".

Raises: the typed errors of the transport (Errors).

MirrorApi.status

status() -> Any

Get the mirror status. Returns the mirror url and registry, manifest_loaded, loaded_at, the number of artifacts, images and python packages loaded, and missing, what the catalog needs that the mirror lacks. Permission system:read.

Route: /api/v1/mirror (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the mirror status".

Raises: the typed errors of the transport (Errors).

Class NavinSmApi

Navin SM. Navin SM is the Navin desktop and CLI build an organization gives to its staff, with a file that points Navin at the organization's own LiteLLM proxy and models (Azure, Bedrock, vLLM... behind LiteLLM), optionally exclusive (no other provider allowed). A profile is that file: the organization, the gateway (base URL, authentication, headers, CA bundle, models, default model, routes, exclusive flag) and the managed policy Navin enforces (permissions, MCP allowlist, plugins, hooks, bypass, pinned environment). Operations of this group of the Navin Manager API.

Resource

NavinSmApi.assignable_users

assignable_users(q: string = None) -> Any

List the users a key can be assigned to. Enabled users of the Manager (50 at most, sorted by name) whose user name, display name or email contains q, with id, username, display_name, email and source. Permission navin_sm:keys.

Route: /api/v1/navin-sm/users (GET).

Name	Type	Default	Required	Description
q	string	None	no	Text searched in the user name, display name and email (100 characters at most).

Returns: Any. Decoded JSON answer of the operation "List the users a key can be assigned to".

Raises: the typed errors of the transport (Errors).

NavinSmApi.block_key

block_key(profile_id: str, key_id: str) -> Any

Block a key. Blocks the key at the proxy (POST /key/block): it is refused at once and can be unblocked. Returns the key with status blocked. Permission navin_sm:keys. Errors: 404 navin_sm_key_not_found, 409 navin_sm_key_revoked, 409 navin_sm_key_gone, 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.block.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/{key_id}/block (POST).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
key_id	str		yes	Identifier of the key in the Manager.

Returns: Any. Decoded JSON answer of the operation "Block a key".

Raises: the typed errors of the transport (Errors).

NavinSmApi.create_key

create_key(profile_id: str, body: Any = None) -> Any

Issue a virtual key. Issues a key at the LiteLLM service the profile is linked to (POST /key/generate with the master key kept in the server) for a user of the Manager or a group of the identity provider, and answers 201 {key, item}: key is returned here and never again, the Manager keeps only the alias and the sha256 LiteLLM uses as identifier. The LiteLLM user is navin-sm:<org_id>:<kind>:<assignee>, the alias navin-sm.<org_id>.<assignee>.<random>. Permission navin_sm:keys. Errors: 404 navin_sm_profile_not_found, 404 navin_sm_user_not_found, 422 navin_sm_assignee_required, 422 navin_sm_key_models_unknown (a model outside the profile), 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 409 navin_sm_key_alias_taken, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.create (id and alias, never the key).

Route: /api/v1/navin-sm/profiles/{profile_id}/keys (POST).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
body	Any	None	no	Assignee, models and limits of the new key.

Returns: Any. Decoded JSON answer of the operation "Issue a virtual key".

Raises: the typed errors of the transport (Errors).

NavinSmApi.create_profile

create_profile(body: Any = None) -> Any

Create a Navin SM profile. Creates the profile and returns it (201). Permission settings:manage, plus vault:manage with a shared_key_ref. Errors (422 unless noted): navin_sm_org_id_invalid, navin_sm_value_empty, navin_sm_value_duplicate, navin_sm_base_url_invalid, navin_sm_base_url_chat, navin_sm_shared_key_ref_required, navin_sm_shared_key_ref_forbidden, navin_sm_vault_entry_not_found, navin_sm_header_invalid, navin_sm_header_secret, navin_sm_models_count, navin_sm_model_duplicate, navin_sm_default_model_unknown, navin_sm_route_invalid, navin_sm_route_unknown, navin_sm_env_invalid, navin_sm_env_secret, 409 navin_sm_org_taken. Audited as navin_sm.create.

Route: /api/v1/navin-sm/profiles (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The profile.

Returns: Any. Decoded JSON answer of the operation "Create a Navin SM profile".

Raises: the typed errors of the transport (Errors).

NavinSmApi.delete_package

delete_package(filename: str) -> Any

Remove a stored package. Removes the stored file; its published SHA256 stays recorded. Answers 204. Permission settings:manage. Errors: 404 navin_sm_package_unknown, 404 navin_sm_package_missing. Audited as navin_sm.package.delete.

Route: /api/v1/navin-sm/distribution/packages/{filename} (DELETE).

Name	Type	Default	Required	Description
filename	str		yes	File name of the package.

Returns: Any. Decoded JSON answer of the operation "Remove a stored package".

Raises: the typed errors of the transport (Errors).

NavinSmApi.delete_profile

delete_profile(profile_id: str) -> Any

Delete a Navin SM profile. Deletes the profile (the vault entry of its key is kept). Answers 204. Permission settings:manage; 404 navin_sm_profile_not_found. Audited as navin_sm.delete.

Route: /api/v1/navin-sm/profiles/{profile_id} (DELETE).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.

Returns: Any. Decoded JSON answer of the operation "Delete a Navin SM profile".

Raises: the typed errors of the transport (Errors).

NavinSmApi.discover_models

discover_models(body: Any = None) -> Any

Discover the models of a LiteLLM proxy. Calls GET <base>/v1/models then GET <base>/model/info of the proxy (5 second timeout, TLS 1.2 or later, public roots plus the ca_pem given, no redirect) and returns {models: [{id, context_window?, max_output_tokens?, vision?, reasoning?}], info_available, info_error}. With litellm_cluster_id and litellm_service, the LiteLLM service installed by the Manager is read with its master key and the CA of the Manager, both kept in the server (an empty base_url then means its address); otherwise the key of the vault entry or the key typed for this call only. /model/info is optional (an admin route a virtual key may not reach). Permission settings:manage, plus vault:manage with a shared_key_ref. Errors: 422 navin_sm_base_url_invalid, 422 navin_sm_header_invalid, 422 navin_sm_litellm_link_incomplete (one of the two link fields only), 422 navin_sm_litellm_source_not_found, 409 navin_sm_master_key_missing, 409 navin_sm_shared_key_missing, 502 navin_sm_discover_failed (details reason: timeout, tls_failed, refused, unreachable, auth_failed, not_found, http_status, protocol_error). Audited as navin_sm.discover.

Route: /api/v1/navin-sm/discover (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The proxy to read.

Returns: Any. Decoded JSON answer of the operation "Discover the models of a LiteLLM proxy".

Raises: the typed errors of the transport (Errors).

NavinSmApi.distribution

distribution() -> Any

State of the Navin SM distribution. The release of Navin SM the catalog names (service: name, version, GitHub repository and tag, settings and CA paths per system), its packages with their published SHA256, stored state, size and download link, the number stored, the last ten fetches and whether one is running. Permission settings:manage; 409 navin_sm_service_missing without the navin-sm service in the catalog.

Route: /api/v1/navin-sm/distribution (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "State of the Navin SM distribution".

Raises: the typed errors of the transport (Errors).

NavinSmApi.download_package

download_package(filename: str) -> Any

Download a stored package. The package as stored (application/octet-stream, Cache-Control: no-store), its SHA256 in the X-Checksum-Sha256 header. Permission settings:manage. Errors: 404 navin_sm_package_unknown, 404 navin_sm_package_missing (not stored).

Route: /api/v1/navin-sm/distribution/packages/{filename}/download (GET).

Name	Type	Default	Required	Description
filename	str		yes	File name of the package.

Returns: Any. Decoded JSON answer of the operation "Download a stored package".

Raises: the typed errors of the transport (Errors).

NavinSmApi.export_profile

export_profile(profile_id: str, os: string | null = None) -> Any

Export the managed-settings.json of a profile. Returns the file as an attachment (managed-settings.json, Cache-Control: no-store), valid against the contract. gateway.apiKey is present only for shared_key, unsealed from the vault for this answer. Permission settings:manage, plus vault:manage for shared_key. Errors: 404 navin_sm_profile_not_found, 409 navin_sm_shared_key_missing (vault entry gone or without key), 422 navin_sm_os_required (profile with use_manager_ca exported without os), 500 navin_sm_export_invalid. Audited as navin_sm.export (never the key).

Route: /api/v1/navin-sm/profiles/{profile_id}/export (GET).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
os	string | null	None	no	System the file is for (linux, macos, windows); required when the profile ships the CA of the Manager (use_manager_ca), since it fixes the path of gateway.caBundle.

Returns: Any. Decoded JSON answer of the operation "Export the managed-settings.json of a profile".

Raises: the typed errors of the transport (Errors).

NavinSmApi.fetch_release

fetch_release(body: Any = None) -> Any

Fetch the release from GitHub. Starts a background fetch of the release (202, the import): the checksum files first, then every package not stored yet, each verified against its published SHA256. The GitHub token is the API key of the vault entry, read in the server and never returned, logged or audited. Permissions settings:manage and vault:manage. Errors: 409 navin_sm_service_missing, 422 navin_sm_vault_entry_not_found, 422 navin_sm_github_token_missing, 409 navin_sm_import_running. Audited as navin_sm.package.fetch (name of the vault entry only). Follow it with GET /navin-sm/distribution/imports/{import_id}.

Route: /api/v1/navin-sm/distribution/fetch (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The vault entry holding the GitHub token.

Returns: Any. Decoded JSON answer of the operation "Fetch the release from GitHub".

Raises: the typed errors of the transport (Errors).

NavinSmApi.get_import

get_import(import_id: str) -> Any

State of a fetch. {id, version, state, files, error, created_at, finished_at}: state is running, done or failed; each file is pending, downloading, stored, skipped (already stored) or failed with its error (never the token). Permission settings:manage; 404 navin_sm_import_not_found.

Route: /api/v1/navin-sm/distribution/imports/{import_id} (GET).

Name	Type	Default	Required	Description
import_id	str		yes	Identifier of the fetch, returned by POST /navin-sm/distribution/fetch.

Returns: Any. Decoded JSON answer of the operation "State of a fetch".

Raises: the typed errors of the transport (Errors).

NavinSmApi.get_profile

get_profile(profile_id: str) -> Any

Get a Navin SM profile. Returns one profile without any key. Permission settings:manage; 404 navin_sm_profile_not_found.

Route: /api/v1/navin-sm/profiles/{profile_id} (GET).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.

Returns: Any. Decoded JSON answer of the operation "Get a Navin SM profile".

Raises: the typed errors of the transport (Errors).

NavinSmApi.list_keys

list_keys(profile_id: str) -> Any

List the virtual keys of a profile. LiteLLM virtual keys issued for the profile, active and blocked first, then revoked: assignee, alias, status, models and limits, never a key value nor its hash. Permission navin_sm:keys; 404 navin_sm_profile_not_found.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys (GET).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.

Returns: Any. Decoded JSON answer of the operation "List the virtual keys of a profile".

Raises: the typed errors of the transport (Errors).

NavinSmApi.list_profiles

list_profiles() -> Any

List the Navin SM profiles. Profiles sorted by organization name, with the name of the vault entry of their shared key but never the key (shared_key_set). Permission settings:manage.

Route: /api/v1/navin-sm/profiles (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the Navin SM profiles".

Raises: the typed errors of the transport (Errors).

NavinSmApi.litellm_sources

litellm_sources() -> Any

List the installed LiteLLM gateways. LiteLLM services installed by the Manager with their address and the vault entry of their key, to prefill the gateway of a profile or link it (litellm_cluster_id, litellm_service). The vault entry is listed only to a holder of vault:manage; an installed service without an entry yet has vault_entry_id null (POST /vault/import creates it). Permission settings:manage.

Route: /api/v1/navin-sm/litellm-sources (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the installed LiteLLM gateways".

Raises: the typed errors of the transport (Errors).

NavinSmApi.load_checksums

load_checksums(body: Any = None) -> Any

Load the published checksums of the release. Records the published SHA256 of the packages from the lines <sha256> <filename> of the SHA256SUMS and .sha256 files of the release, pasted together (offline sites). Returns {updated, unchanged, conflicts, ignored}: the files recorded or already identical, the stored packages whose SHA256 would change (reported and left as they are) and the names outside the release. Permission settings:manage. Errors: 409 navin_sm_service_missing, 422 navin_sm_checksums_invalid (no usable line). Audited as navin_sm.package.checksums.

Route: /api/v1/navin-sm/distribution/checksums (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The checksum lines.

Returns: Any. Decoded JSON answer of the operation "Load the published checksums of the release".

Raises: the typed errors of the transport (Errors).

NavinSmApi.preview_profile

preview_profile(profile_id: str, os: string | null = None) -> Any

Preview the managed-settings.json of a profile. The file the export would produce, checked against the contract, without its key: a shared_key is replaced by <vault: entry name>. Returns {os, settings_path, ca_path, document, problems, valid}; problems lists the rules the document breaks (a vault entry without key, a profile with use_manager_ca previewed without os). Permission settings:manage; 404 navin_sm_profile_not_found. Not audited (nothing leaves the server).

Route: /api/v1/navin-sm/profiles/{profile_id}/preview (GET).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
os	string | null	None	no	System the file is for (linux, macos, windows): fixes settings_path and, with use_manager_ca, the path of gateway.caBundle.

Returns: Any. Decoded JSON answer of the operation "Preview the managed-settings.json of a profile".

Raises: the typed errors of the transport (Errors).

NavinSmApi.profile_bundle

profile_bundle(profile_id: str, os: string = None) -> Any

Download the deployment bundle of a profile. Zip for one system (navin-sm-<org_id>-<os>.zip, Cache-Control: no-store): managed-settings.json (the shared key included, audited as navin_sm.export with purpose bundle), the CA of the Manager when the profile ships it (use_manager_ca), and the deployment files of the system: shell script and Ansible playbook on Linux, shell script and MDM notes on macOS, PowerShell script with GPO and Intune notes on Windows. The packages are downloaded apart (GET /navin-sm/distribution/packages/{filename}/download). Permission settings:manage, plus vault:manage for shared_key. Errors: 404 navin_sm_profile_not_found, 409 navin_sm_service_missing (no navin-sm service in the catalog), 409 navin_sm_shared_key_missing.

Route: /api/v1/navin-sm/profiles/{profile_id}/bundle (GET).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
os	string	None	no	System of the bundle: linux, macos or windows.

Returns: Any. Decoded JSON answer of the operation "Download the deployment bundle of a profile".

Raises: the typed errors of the transport (Errors).

NavinSmApi.revoke_all_keys

revoke_all_keys(profile_id: str) -> Any

Revoke every key of a profile. Deletes every active or blocked key of the profile at the proxy in one call (POST /key/delete) and records them as revoked. Returns {revoked, items}. Permission navin_sm:keys. Errors: 404 navin_sm_profile_not_found, 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.revoke_all (count and ids of the keys).

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/revoke-all (POST).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.

Returns: Any. Decoded JSON answer of the operation "Revoke every key of a profile".

Raises: the typed errors of the transport (Errors).

NavinSmApi.revoke_key

revoke_key(profile_id: str, key_id: str) -> Any

Revoke a key. Deletes the key at the proxy (POST /key/delete, immediate) and keeps it in the Manager with status revoked and revoked_at; a key the proxy no longer knows is revoked all the same. Returns the key. Permission navin_sm:keys. Errors: 404 navin_sm_key_not_found, 409 navin_sm_key_revoked, 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.revoke.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/{key_id} (DELETE).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
key_id	str		yes	Identifier of the key in the Manager.

Returns: Any. Decoded JSON answer of the operation "Revoke a key".

Raises: the typed errors of the transport (Errors).

NavinSmApi.unblock_key

unblock_key(profile_id: str, key_id: str) -> Any

Unblock a key. Unblocks a blocked key at the proxy (POST /key/unblock) and returns it with status active. Permission navin_sm:keys. Same errors as the block. Audited as navin_sm.key.unblock.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/{key_id}/unblock (POST).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
key_id	str		yes	Identifier of the key in the Manager.

Returns: Any. Decoded JSON answer of the operation "Unblock a key".

Raises: the typed errors of the transport (Errors).

NavinSmApi.update_key

update_key(profile_id: str, key_id: str, body: Any = None) -> Any

Change the models and limits of a key. Applies the models and limits at the proxy (POST /key/update), then in the Manager, and returns the key. Permission navin_sm:keys. Errors: 404 navin_sm_profile_not_found, 404 navin_sm_key_not_found, 409 navin_sm_key_revoked, 409 navin_sm_key_gone (the proxy no longer knows the key, which is then recorded as revoked), 422 navin_sm_key_models_unknown, 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.update.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/{key_id} (PUT).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
key_id	str		yes	Identifier of the key in the Manager (never its value).
body	Any	None	no	New models and limits.

Returns: Any. Decoded JSON answer of the operation "Change the models and limits of a key".

Raises: the typed errors of the transport (Errors).

NavinSmApi.update_profile

update_profile(profile_id: str, body: Any = None) -> Any

Replace a Navin SM profile. Replaces the whole profile and returns it. Same rules and errors as the creation, plus 404 navin_sm_profile_not_found. Audited as navin_sm.update (names of the fields changed).

Route: /api/v1/navin-sm/profiles/{profile_id} (PUT).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
body	Any	None	no	The whole profile.

Returns: Any. Decoded JSON answer of the operation "Replace a Navin SM profile".

Raises: the typed errors of the transport (Errors).

NavinSmApi.upload_package

upload_package(filename: str) -> Any

Upload a package of the release. Raw body of one package of the release, streamed to <mirror_dir>/navin-sm/<version>/ and hashed while it is written; kept (201, the package as the distribution lists it) only when its SHA256 is the one published (loaded beforehand) or the one of the X-Checksum-Sha256 header. Permission settings:manage. Errors: 404 navin_sm_package_unknown (not a package of the release), 422 navin_sm_package_checksum_unknown (no published SHA256 and no header), 422 navin_sm_package_checksum_mismatch (the file is removed), 422 navin_sm_package_too_large (2 GiB), 409 navin_sm_disk_full. Audited as navin_sm.package.store, refusals included.

Route: /api/v1/navin-sm/distribution/packages/{filename} (PUT).

Name	Type	Default	Required	Description
filename	str		yes	File name of the package, as the catalog lists it for this version.

Returns: Any. Decoded JSON answer of the operation "Upload a package of the release".

Raises: the typed errors of the transport (Errors).

NavinSmApi.usage

usage(profile_id: str, days: integer = None) -> Any

Tracking of the keys of a profile. Reads the proxy through the server (GET /key/info per live key, GET /spend/logs over the period) and returns {available, reason, period, keys, models, totals, truncated, last_use}: for each key its live state, spend, budget and reset date, and over the period its calls, tokens, errors, models and last use; the same figures per model and in total. truncated is true when the proxy capped the logs at 10000 rows (the figures of the period are then partial). When the profile is not linked, the master key is missing or the proxy is out of reach, available is false with reason and no figure: zeros are never invented. Permission navin_sm:keys; 404 navin_sm_profile_not_found.

Route: /api/v1/navin-sm/profiles/{profile_id}/usage (GET).

Name	Type	Default	Required	Description
profile_id	str		yes	Identifier of the profile.
days	integer	None	no	Length of the period in days, 1 to 366 (default 30), ending today.

Returns: Any. Decoded JSON answer of the operation "Tracking of the keys of a profile".

Raises: the typed errors of the transport (Errors).

Class NetworkApi

Network flows. The network flows of a cluster, computed from what the Manager knows, for the network team that opens them in its security groups or host firewalls. Each flow belongs to a scope: Operations of this group of the Navin Manager API.

Resource

NetworkApi.network_flows

network_flows(cluster_id: str, format: "json" | "csv" = None, service: string | null = None, host_id: string | null = None, scope: "platform" | "service" | "intra_service" | "egress" | null = None) -> Any

Get the network flow matrix of a cluster. Flows to open between the hosts, the Manager, the clients and the external endpoints of the cluster. JSON: cluster_id, items, summary and generated_at; with format=csv, a network-flows-<cluster>.csv attachment. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/network/flows (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
format	"json" | "csv"	None	no	Answer format: json (default) or csv.
service	string | null	None	no	Only the flows of this service.
host_id	string | null	None	no	Only the flows from or to this host.
scope	"platform" | "service" | "intra_service" | "egress" | null	None	no	Only the flows of this scope: platform, service, intra_service or egress.

Returns: Any. Decoded JSON answer of the operation "Get the network flow matrix of a cluster".

Raises: the typed errors of the transport (Errors).

NetworkApi.network_rules

network_rules(cluster_id: str, provider: "auto" | "aws" | "azure" | "gcp" | "ibm" | "openstack" | "ovh" | "firewalld" | "ufw" = None, service: string | null = None, host_id: string | null = None, scope: "platform" | "service" | "intra_service" | "egress" | null = None) -> Any

Get the firewall rules that open the flows. Commands opening the flows in the security groups of a cloud provider or in a host firewall. With auto, the provider of each host is used (the environment chosen for the host, else the detected platform). Nothing is applied. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/network/rules (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
provider	"auto" | "aws" | "azure" | "gcp" | "ibm" | "openstack" | "ovh" | "firewalld" | "ufw"	None	no	Target of the rules: auto, aws, azure, gcp, ibm, openstack, ovh, firewalld or ufw.
service	string | null	None	no	Only the flows of this service.
host_id	string | null	None	no	Only the flows from or to this host.
scope	"platform" | "service" | "intra_service" | "egress" | null	None	no	Only the flows of this scope: platform, service, intra_service or egress.

Returns: Any. Decoded JSON answer of the operation "Get the firewall rules that open the flows".

Raises: the typed errors of the transport (Errors).

Class NodeSecurityApi

Node security. The security of the managed hosts and of their node agents: inventory, SSH policy, preflight and SSH bootstrap of the agent, enrollment tokens bound to the agent key, trust state (quarantine, revocation, recovery), management mode, signed agent commands and their receipts, agent update and SSH break glass. Operations of this group of the Navin Manager API.

Resource

NodeSecurityApi.agent_update

agent_update(host_id: str, body: Any = None) -> Any

Update the agent of a host. Verifies the signed agent binary of the mirror, then issues a signed agent.update command with its digest and signature (idempotency key derived from the digest). Returns the command envelope (201). Permission hosts:manage. Errors: 422 agent_package_untrusted, 409 host_not_trusted, 409 host_client_managed.

Route: /api/v1/hosts/{host_id}/agent-update (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Validity of the command and health timeout of the new agent.

Returns: Any. Decoded JSON answer of the operation "Update the agent of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.bootstrap_plan

bootstrap_plan(body: Any = None) -> Any

Preview the bootstrap of a node agent. Checks the credential against the SSH policy and returns the plan without connecting: SSH user, target, jumps, credential verdict, the sudoers file and its validation, the allowlist, the systemd unit and the staging directory. Permission hosts:manage; 422 ssh_policy_refused.

Route: /api/v1/hosts/bootstrap/plan (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Same body as a bootstrap.

Returns: Any. Decoded JSON answer of the operation "Preview the bootstrap of a node agent".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglass_approve

breakglass_approve(request_id: str) -> Any

Approve a break glass request. Adds an approval. Two distinct approvers, both different from the requester, are needed; the second approval signs an OpenSSH user certificate valid for the TTL. Permission hosts:manage. Errors: 403 breakglass_self_approval, 409 breakglass_not_pending, 409 breakglass_already_approved, 404 breakglass_not_found. Audited as host.breakglass.approve.

Route: /api/v1/breakglass/{request_id}/approve (POST).

Name	Type	Default	Required	Description
request_id	str		yes	Identifier of the break glass request.

Returns: Any. Decoded JSON answer of the operation "Approve a break glass request".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglass_evidence

breakglass_evidence(request_id: str, body: Any = None) -> Any

Add evidence to a break glass session. Appends a redacted evidence record (session start, command digest, session end or recording) to the request. Permission hosts:manage; 404 breakglass_not_found.

Route: /api/v1/breakglass/{request_id}/evidence (POST).

Name	Type	Default	Required	Description
request_id	str		yes	Identifier of the break glass request.
body	Any	None	no	Kind, digest and summary of the evidence.

Returns: Any. Decoded JSON answer of the operation "Add evidence to a break glass session".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglass_list

breakglass_list(host_id: str) -> Any

List the break glass requests of a host. The last 50 break glass requests of the host with their status, approvers, validity and evidence. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/breakglass (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "List the break glass requests of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglass_request

breakglass_request(host_id: str, body: Any = None) -> Any

Request an emergency SSH access. Records a break glass request for the host with the reason, the public key of the requester and the TTL; two other users must approve it. Returns the request (201). Permission hosts:manage. Errors: 422 breakglass_key_refused, 409 host_not_trusted, 409 host_client_managed. Audited as host.breakglass.request.

Route: /api/v1/hosts/{host_id}/breakglass (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Reason, public key, account and validity.

Returns: Any. Decoded JSON answer of the operation "Request an emergency SSH access".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglass_revoke

breakglass_revoke(request_id: str) -> Any

Revoke a break glass access early. Ends the access before its TTL: the certificate is added to the key revocation list the hosts load. Permission hosts:manage. Errors: 404 breakglass_not_found, 409 breakglass_not_active.

Route: /api/v1/breakglass/{request_id}/revoke (POST).

Name	Type	Default	Required	Description
request_id	str		yes	Identifier of the break glass request.

Returns: Any. Decoded JSON answer of the operation "Revoke a break glass access early".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.get_ssh_policy

get_ssh_policy(cluster_id: str) -> Any

Get the SSH policy of a cluster. Returns allow_rsa, rsa_min_bits, approved_user_cas, bootstrap_user, spiffe_trust_domain and rotate_before_days. Permission cluster:read; 404 cluster_not_found.

Route: /api/v1/clusters/{cluster_id}/ssh-policy (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Get the SSH policy of a cluster".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.host_bootstrap

host_bootstrap(body: Any = None) -> Any

Bootstrap a node agent over SSH. Starts an operation that installs and registers the agent on one host:

Route: /api/v1/hosts/bootstrap (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Target host, jump hosts, SSH account, private key or certificate.

Returns: Any. Decoded JSON answer of the operation "Bootstrap a node agent over SSH".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.host_enroll

host_enroll(body: Any = None) -> Any

Issue an enrollment token for one agent key. Issues a single use token for one host and one key: host_fingerprint is the SHA-256 (hex) of the public key of the agent (nm-agent prints it before enrolling). The token expires after at most 15 minutes and is consumed by the first enrollment that presents a CSR of that exact key. Returns id, token, expires_at, ttl_s, host_fingerprint and agent_url (201). Permission hosts:manage. Audited as host.enroll_token.

Route: /api/v1/hosts/enroll (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Cluster, FQDN and key fingerprint of the host.

Returns: Any. Decoded JSON answer of the operation "Issue an enrollment token for one agent key".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.host_inventory

host_inventory(host_id: str) -> Any

Get the inventory of a host. Returns host_id, the inventory reconciled from the agent facts (hardware, GPUs, platform) and updated_at. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/inventory (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Get the inventory of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.host_preflight

host_preflight(body: Any = None) -> Any

Run the preflight of a host before its bootstrap. Reads the host over SSH and from the Manager (DNS forward and reverse, TCP reachability, required ports free, disks, operating system) and returns the checks graded pass, warning or blocking, the blocking and warnings counts, a reproducible digest and the credential verdict. Nothing is installed. Permission hosts:manage. Errors: 422 ssh_policy_refused. Audited as host.preflight.

Route: /api/v1/hosts/preflight (POST).

Name	Type	Default	Required	Description
body	Any	None	no	SSH access, expected identity, ports and disks to check.

Returns: Any. Decoded JSON answer of the operation "Run the preflight of a host before its bootstrap".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.host_receipts

host_receipts(host_id: str) -> Any

List the command receipts of a host. Receipts of the signed commands run by the agent, last completed first: operation, start and end, exit code, observed state, error code and evidence, redacted. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/receipts (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "List the command receipts of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.issue_command

issue_command(host_id: str, body: Any = None) -> Any

Send a signed command to an agent. Issues a command envelope signed with the Ed25519 key of the Manager for the agent of the host (the same idempotency key returns the stored envelope). Allowed operations: facts.collect, health.check, logs.tail, files.digest, service.control, command.run, agent.update; the last three are refused on client managed hosts. Returns the envelope (201). Permission hosts:manage. Errors: 422 command_operation_unknown, 409 host_not_trusted, 409 host_client_managed. Audited as host.command.issue.

Route: /api/v1/hosts/{host_id}/commands (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Operation, parameters, validity and idempotency key.

Returns: Any. Decoded JSON answer of the operation "Send a signed command to an agent".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.list_all_hosts

list_all_hosts(cluster_id: string | null = None) -> Any

List the hosts of every cluster. Hosts of every cluster the caller may read (or of one cluster), sorted by FQDN, with their trust state, management mode, identity, metrics, inventory and platform.

Route: /api/v1/hosts (GET).

Name	Type	Default	Required	Description
cluster_id	string | null	None	no	Only the hosts of this cluster.

Returns: Any. Decoded JSON answer of the operation "List the hosts of every cluster".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.list_nodes

list_nodes() -> Any

List the node agents. Hosts not decommissioned of every cluster the caller may read, with their trust state, management mode, agent version, last heartbeat, identity (certificate serial and expiry, SPIFFE ID, rotation_due), metrics and platform.

Route: /api/v1/agents/nodes (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the node agents".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.node_detail

node_detail(host_id: str) -> Any

Get a node agent. The node view plus its last 10 certificates and diagnostics (facts, last metrics, last 20 receipts). Permission cluster:read; 404 host_not_found.

Route: /api/v1/agents/nodes/{host_id} (GET).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.

Returns: Any. Decoded JSON answer of the operation "Get a node agent".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.put_ssh_policy

put_ssh_policy(cluster_id: str, body: Any = None) -> Any

Set the SSH policy of a cluster. Replaces the SSH policy and returns it. The bootstrap user and every approved CA key are checked first. Permission hosts:manage. Errors: 422 ssh_policy_refused (weak or invalid key, refused user), 404 cluster_not_found. Audited as cluster.ssh_policy.

Route: /api/v1/clusters/{cluster_id}/ssh-policy (PUT).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	The SSH policy.

Returns: Any. Decoded JSON answer of the operation "Set the SSH policy of a cluster".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.quarantine_host

quarantine_host(host_id: str, body: Any = None) -> Any

Quarantine a host. Sets the trust state to quarantined: the Manager stops trusting the agent for new commands until it is recovered. Returns the node. Permission hosts:manage. Audited as host.quarantine.

Route: /api/v1/hosts/{host_id}/quarantine (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Reason of the change.

Returns: Any. Decoded JSON answer of the operation "Quarantine a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.recover_host

recover_host(host_id: str, body: Any = None) -> Any

Trust a quarantined host again. Sets the trust state back to trusted. A revoked host cannot be recovered: it must enroll again (409 agent_revoked). Returns the node. Permission hosts:manage. Audited as host.recover.

Route: /api/v1/hosts/{host_id}/recover (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Reason of the change.

Returns: Any. Decoded JSON answer of the operation "Trust a quarantined host again".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.revoke_host

revoke_host(host_id: str, body: Any = None) -> Any

Revoke the agent of a host. Sets the trust state to revoked, revokes the certificates of the agent and expires its pending commands. Only a new enrollment brings it back. Returns the node. Permission hosts:manage. Audited as host.revoke with the number of certificates revoked.

Route: /api/v1/hosts/{host_id}/revoke (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Reason of the change.

Returns: Any. Decoded JSON answer of the operation "Revoke the agent of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.set_management

set_management(host_id: str, body: Any = None) -> Any

Set who manages a host. Sets the management mode: platform (the Manager acts on the host) or client (the dangerous commands and break glass are refused). Returns the node. Permission hosts:manage. Audited as host.management.

Route: /api/v1/hosts/{host_id}/management (PUT).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	The management mode.

Returns: Any. Decoded JSON answer of the operation "Set who manages a host".

Raises: the typed errors of the transport (Errors).

Class OperationsApi

Operations. An operation is the unit of every change the Manager makes: an install, a restart, an upgrade, a backup, a host bootstrap... It is made of ordered stages; each stage holds tasks, usually one per host, run by the Navin agents. Status of an operation: pending, running, succeeded, failed or aborted; progress goes from 0 to 100. Operations of this group of the Navin Manager API.

Resource

OperationsApi.abort

abort(operation_id: str) -> Any

Abort an operation. Asks a pending or running operation to stop: tasks not started are cancelled, the running ones are stopped by their agents. Returns id, status and abort_requested. Permission operations:abort; 409 operation_not_running when it is already finished. Audited as operation.abort.

Route: /api/v1/operations/{operation_id}/abort (POST).

Name	Type	Default	Required	Description
operation_id	str		yes	Identifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.

Returns: Any. Decoded JSON answer of the operation "Abort an operation".

Raises: the typed errors of the transport (Errors).

OperationsApi.get_operation

get_operation(operation_id: str) -> Any

Get an operation with its stages and tasks. Returns the operation and its stages in order; each stage gives seq, name_i18n, status, tolerate_failures and its tasks (host, type, service, component, status, attempts, exit code, summary, error, times). Permission operations:read on its cluster; 404 operation_not_found.

Route: /api/v1/operations/{operation_id} (GET).

Name	Type	Default	Required	Description
operation_id	str		yes	Identifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.

Returns: Any. Decoded JSON answer of the operation "Get an operation with its stages and tasks".

Raises: the typed errors of the transport (Errors).

OperationsApi.get_task

get_task(operation_id: str, task_id: str) -> Any

Get a task of an operation. Returns one task with its full output, attempts and max_attempts, timeout_s, exit_code, duration_ms and times. Permission operations:read; 404 operation_not_found or 404 task_not_found.

Route: /api/v1/operations/{operation_id}/tasks/{task_id} (GET).

Name	Type	Default	Required	Description
operation_id	str		yes	Identifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.
task_id	str		yes	Identifier of the task, from the stages of the operation.

Returns: Any. Decoded JSON answer of the operation "Get a task of an operation".

Raises: the typed errors of the transport (Errors).

OperationsApi.list_operations

list_operations(cluster_id: str, status: string | null = None, limit: int | None = None, cursor: str | None = None) -> Any

List the operations of a cluster. Operations of the cluster, newest first, without their stages: id, type, title_i18n, target, status, progress, error, created_by, created_at, started_at, finished_at, abort_requested. Paginated with limit and cursor. Permission operations:read.

Route: /api/v1/clusters/{cluster_id}/operations (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
status	string | null	None	no	Only the operations in this status: pending, running, succeeded, failed or aborted.
limit	int | None	None	no	Maximum number of operations in the page, from 1 to 500. Default 50.
cursor	str | None	None	no	The next_cursor of the previous page (an operation identifier). Omit it for the first page.

Returns: Any. Decoded JSON answer of the operation "List the operations of a cluster".

Raises: the typed errors of the transport (Errors).

OperationsApi.retry

retry(operation_id: str, approval_id: string | null = None) -> Any

Retry a failed operation. Creates a new operation from a failed or aborted one and returns its operation_id. The retry goes through the checks of a new operation: one change at a time per service, administrative state of the service, profile of the cluster and, under banking-secure, a new approval for a disruptive operation. Permission operations:abort; 409 operation_not_retryable in any other status. Audited as operation.retry.

Route: /api/v1/operations/{operation_id}/retry (POST).

Name	Type	Default	Required	Description
operation_id	str		yes	Identifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.
approval_id	string | null	None	no	Approval granted for the new operation under banking-secure, used once; omit it to use the approval granted to you.

Returns: Any. Decoded JSON answer of the operation "Retry a failed operation".

Raises: the typed errors of the transport (Errors).

OperationsApi.running

running() -> Any

List the running operations. Pending and running operations of every cluster where the caller holds operations:read (at most 200, newest first), with their count. Used by the activity indicator of the console.

Route: /api/v1/operations/running (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the running operations".

Raises: the typed errors of the transport (Errors).

OperationsApi.task_logs

task_logs(operation_id: str, task_id: str, after_seq: integer = None) -> Any

Read the log lines of a task. Returns the lines written after after_seq (each with seq, ts, stream and data), next_seq to pass as after_seq on the next call, and done: true once the task is finished and every line was read. To follow a task, call it again with after_seq=next_seq until done. Permission operations:read.

Route: /api/v1/operations/{operation_id}/tasks/{task_id}/logs (GET).

Name	Type	Default	Required	Description
operation_id	str		yes	Identifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.
task_id	str		yes	Identifier of the task.
after_seq	integer	None	no	Return the lines whose sequence number is greater than this one. Default -1 (from the first line).

Returns: Any. Decoded JSON answer of the operation "Read the log lines of a task".

Raises: the typed errors of the transport (Errors).

Class PKIApi

PKI and certificates. The certificate authority of the Manager and the certificates it issues: client certificates of the agents and TLS certificates of the service components. Operations of this group of the Navin Manager API.

Resource

PKIApi.get_ca

get_ca() -> Any

Get the certificate authority. Returns the CA certificate of the Manager (ca_pem), its expiry not_after and its sha256 fingerprint. Any signed in user.

Route: /api/v1/pki/ca (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the certificate authority".

Raises: the typed errors of the transport (Errors).

PKIApi.list_certificates

list_certificates(cluster_id: str) -> Any

List the certificates of a cluster. Certificates issued for the cluster, the first to expire first: kind (agent or service), host, service, component, serial, subject, sans, not_before, not_after, revoked_at. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/certificates (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the certificates of a cluster".

Raises: the typed errors of the transport (Errors).

PKIApi.rotate

rotate(cluster_id: str, body: Any = None, approval_id: string | null = None) -> Any

Rotate the service certificates of a cluster. Issues a new certificate for every component instance (of one service, or of all), then starts an operation that installs them on the hosts and restarts the components. Answers 202 with operation_id. Permission pki:manage. Errors: 404 cluster_not_found, 409 no_certificates_to_rotate. Audited as pki.rotate.

Route: /api/v1/clusters/{cluster_id}/certificates/rotate (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Optional service to limit the rotation to.
approval_id	string | null	None	no	Identifier of the approved request (four-eyes approval) that authorizes this action.

Returns: Any. Decoded JSON answer of the operation "Rotate the service certificates of a cluster".

Raises: the typed errors of the transport (Errors).

Class RestoresApi

Backup, restore and disaster recovery. The Backup & Recovery Manager: backup targets and plans, backup artefacts with their verifications, retention, restore tests, restores and disaster recovery (sites, plans, exercises, failovers, DNS and load balancer switches). Operations of this group of the Navin Manager API.

Resource

RestoresApi.approve

approve(plan_id: str) -> Any

Approve a restore plan. Adds the approval of the caller; two approvals by people other than the requester are needed. Permission restore:execute. Errors: 403 restore_self_approval, 409 restore_not_approvable. Audited as restore.approve.

Route: /api/v1/restores/{plan_id}/approve (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the restore plan.

Returns: Any. Decoded JSON answer of the operation "Approve a restore plan".

Raises: the typed errors of the transport (Errors).

RestoresApi.dry_run

dry_run(plan_id: str) -> Any

Dry run a restore plan. Checks the digest, decryption and compatibility without writing to the destination, and returns the recorded approvers. For a named destination it also checks its identity, emptiness and restricted role (checks.destination, checks.executor). A successful dry run does not authorize execution: two approvals are still required. Permission restore:execute. Audited as restore.dry_run.

Route: /api/v1/restores/{plan_id}/dry-run (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the restore plan.

Returns: Any. Decoded JSON answer of the operation "Dry run a restore plan".

Raises: the typed errors of the transport (Errors).

RestoresApi.execute

execute(plan_id: str) -> Any

Execute an approved restore. Runs an approved plan with a destination: status executing and a durable execution_token are committed before any write. The artefact is checked again (size, digest, decryption), restored with pg_restore --single-transaction by the restricted role, then its rows are read back and compared with the backup inventory (result.inventory, rows, tables). Success: executed. Recorded failure: failed, rollback_performed: false, HTTP 502 restore_execution_failed; its nested result.error identifies the cause, including backup_corrupted, restore_target_busy or restore_execution_timeout. A process interruption can leave executing for manual inspection. Nothing is automatically rolled back or replayed. Pre-execution refusals include 409 restore_not_approved, 501 restore_executor_unavailable and 409 restore_target_changed. Permission restore:execute. Audited as restore.execute.started and restore.execute.

Route: /api/v1/restores/{plan_id}/execute (POST).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the restore plan.

Returns: Any. Decoded JSON answer of the operation "Execute an approved restore".

Raises: the typed errors of the transport (Errors).

RestoresApi.list

list() -> Any

List the restore plans. The last 200 restore plans with their status and number of approvals. Permission backup:read.

Route: /api/v1/restores (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the restore plans".

Raises: the typed errors of the transport (Errors).

RestoresApi.plan

plan(body: Any = None) -> Any

Plan a restore. Creates a restore plan for a backup artefact: checks the compatibility of the backed up versions with the target versions (same major version) and lists the steps (verify artefact, verify destination, restore, verify restored). With target_name, the artefact must be an available pg_dump with a verification_inventory and the destination an empty PostgreSQL database owned by a restricted role; its identity is frozen in target_snapshot. Returns the plan (201). Permission restore:execute. Errors: 404 backup_artifact_not_found, 501 restore_executor_unavailable (unknown destination), 409 restore_target_invalid, 409 restore_target_not_empty, 422 restore_inventory_required. Audited as restore.plan.

Route: /api/v1/restores/plan (POST).

Name	Type	Default	Required	Description
body	Any	None	no	Artefact, environment, destination and target versions.

Returns: Any. Decoded JSON answer of the operation "Plan a restore".

Raises: the typed errors of the transport (Errors).

RestoresApi.verify

verify(plan_id: str) -> Any

Get a restore plan. Returns the plan with its compatibility, steps, approvers and required_approvals (2). Permission backup:read; 404 restore_plan_not_found.

Route: /api/v1/restores/{plan_id} (GET).

Name	Type	Default	Required	Description
plan_id	str		yes	Identifier of the restore plan.

Returns: Any. Decoded JSON answer of the operation "Get a restore plan".

Raises: the typed errors of the transport (Errors).

Class ServicesApi

Platform Manager services operations.

Resource

ServicesApi.action

action(cluster_id: str, service: str, body: Any = None) -> Any

Run an action on a service. Starts an operation that runs the action on the components and hosts chosen (all by default) and returns operation_id. A rolling restart handles batch_size hosts at a time. reinstall also needs services:install. Permission services:operate. Errors: 409 service_unmanaged, 409 service_check_missing, 409 smoke_test_missing, 404 host_component_not_found, 409 approval_required. Audited as service.<action>.

Route: /api/v1/clusters/{cluster_id}/services/{service}/actions (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Action, scope and batching.

Returns: Any. Decoded JSON answer of the operation "Run an action on a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.add_component

add_component(cluster_id: str, service: str, body: Any = None) -> Any

Add component instances to hosts. Starts an operation that installs the component on the hosts given (started unless the service is stopped) and returns operation_id with the ha checks. Permission services:install. Errors: 409 service_unmanaged, 404 component_unknown, 422 topology_invalid, 409 ha_requirements_not_met or ha_acknowledgement_required. Audited as service.component_add.

Route: /api/v1/clusters/{cluster_id}/services/{service}/components (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Component and target hosts.

Returns: Any. Decoded JSON answer of the operation "Add component instances to hosts".

Raises: the typed errors of the transport (Errors).

ServicesApi.check_connection

check_connection(cluster_id: str, service: str) -> Any

Check a connected service now. Runs the health check and the authenticated check of a connected service and records the result in its monitoring history. Returns service, health and health_details. Permission services:operate; 409 service_not_connected.

Route: /api/v1/clusters/{cluster_id}/services/{service}/connection/check (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Check a connected service now".

Raises: the typed errors of the transport (Errors).

ServicesApi.client_config

client_config(cluster_id: str, service: str) -> Any

Get the client configuration of a service. Files a client needs to reach the service (path, content, mode), rendered from the catalog with the secrets redacted. Empty files when the service has none. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/client-config (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Get the client configuration of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.cluster_action

cluster_action(cluster_id: str, body: Any = None) -> Any

Run an action on every service of a cluster. Starts one operation that runs the action on every managed service in scope (every service by default, or those of services, on every host or on hosts), in dependency order: a provider starts before its consumers and stops after them. restart stops every service in reverse order, then starts every service in order with the health checks; rolling_restart restarts each service by batches of batch_size hosts; restart_stale writes again the files and units of the instances whose configuration changed, then restarts them by batches; service_check runs the check of every service. Connected services, services being installed or uninstalled, an administrative state that forbids the action and instances in maintenance, being removed or on a decommissioned host are left out and listed in skipped with the reason. Returns services in dependency order, skipped, steps and operation_id; with dry_run nothing is created and operation_id is null. Permission services:operate. Errors: 409 bulk_nothing_to_do, 404 cluster_service_not_found, 409 profile_blocked, 409 approval_required (under banking-secure, stop and restarts need an approval for the service *). Audited as cluster.<action>.

Route: /api/v1/clusters/{cluster_id}/actions (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Action, scope, batching and dry run.

Returns: Any. Decoded JSON answer of the operation "Run an action on every service of a cluster".

Raises: the typed errors of the transport (Errors).

ServicesApi.configure

configure(cluster_id: str, service: str, body: Any = None) -> Any

Save a new configuration version. Merges the properties sent over the current values, validates them against the parameter definitions and saves a new version. Returns version and stale_hosts. Permission configs:edit. Errors: 422 config_invalid (with the fields), 409 service_unmanaged. Audited as config.update (parameter names only).

Route: /api/v1/clusters/{cluster_id}/services/{service}/config (PUT).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Changed properties and a note.

Returns: Any. Decoded JSON answer of the operation "Save a new configuration version".

Raises: the typed errors of the transport (Errors).

ServicesApi.connect_service

connect_service(cluster_id: str, body: Any = None) -> Any

Connect an existing service. Registers an existing service of yours against the connect section of its catalog descriptor: no host, never installed, started or stopped by the Manager. The health check and the authenticated check of the method run first; refused credentials give 422 connect_invalid. In a production or pre-production cluster HTTPS, a verified certificate and an allowed method are required. Secret fields are sealed. Returns the service summary (201). Permission services:install. Audited as service.connect.

Route: /api/v1/clusters/{cluster_id}/services/connect (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Address, authentication and TLS settings of the existing service.

Returns: Any. Decoded JSON answer of the operation "Connect an existing service".

Raises: the typed errors of the transport (Errors).

ServicesApi.disconnect_service

disconnect_service(cluster_id: str, service: str) -> Any

Disconnect a connected service. Forgets a connected service and its sealed credentials; the service itself is left untouched. Permission services:install. Errors: 409 service_not_connected, 409 service_in_use while a consumer is bound to it. Audited as service.disconnect.

Route: /api/v1/clusters/{cluster_id}/services/{service}/connection (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Disconnect a connected service".

Raises: the typed errors of the transport (Errors).

ServicesApi.get_mode

get_mode(cluster_id: str, service: str) -> Any

Get the administrative state of a service. Returns the administrative state (enabled, disabled, maintenance, quarantined, suspended), its reason, whether the service may run (run_authorized) the security lock of the cluster and modes, the documented effect of every mode. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/mode (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Get the administrative state of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.get_service

get_service(cluster_id: str, service: str) -> Any

Get a service. The summary of the service plus its host_components (every instance with its state, health and version), its bindings to other services and its quick_links (web consoles rendered from the catalog). Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service} (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Get a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.health

health(cluster_id: str, service: str) -> Any

Get the checks of a service. Liveness of every instance (health checks of the agent), readiness (service check) and functional smoke test, each with its status, results, error and time. Only a passed smoke test proves that the service works. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/checks (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.

Returns: Any. Decoded JSON answer of the operation "Get the checks of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.host_action

host_action(host_id: str, body: Any = None) -> Any

Run an action on every component of a host. Starts one operation that starts, stops or restarts every component placed on the host, or only the components whose configuration changed (restart_stale), service after service in dependency order. Instances in maintenance and services whose administrative state forbids the action are left out and listed in skipped; with dry_run nothing is created and operation_id is null. Permission services:operate on the cluster of the host. Errors: 404 host_not_found, 409 bulk_nothing_to_do, 409 approval_required (under banking-secure, stop and restarts need an approval for the service host:<host id>). Audited as host.<action>.

Route: /api/v1/hosts/{host_id}/actions (POST).

Name	Type	Default	Required	Description
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Action and dry run.

Returns: Any. Decoded JSON answer of the operation "Run an action on every component of a host".

Raises: the typed errors of the transport (Errors).

ServicesApi.host_component_action

host_component_action(cluster_id: str, service: str, component: str, host_id: str, body: Any = None) -> Any

Run an action on one component instance. Like the service actions, limited to the component on one host. Returns operation_id. Permission services:operate (services:install for reinstall). Audited as service.<action>.

Route: /api/v1/clusters/{cluster_id}/services/{service}/components/{component}/hosts/{host_id}/actions (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
component	str		yes	Name of the component.
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
body	Any	None	no	Action to run.

Returns: Any. Decoded JSON answer of the operation "Run an action on one component instance".

Raises: the typed errors of the transport (Errors).

ServicesApi.install

install(cluster_id: str, body: Any = None) -> Any

Install services. Validates, gates and plans the install of one or more services, then creates the operation. Returns operation_id and the ha checks.

Route: /api/v1/clusters/{cluster_id}/services (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Services to install with their placements and configuration.

Returns: Any. Decoded JSON answer of the operation "Install services".

Raises: the typed errors of the transport (Errors).

ServicesApi.install_services

install_services(cluster_id: str, body: Any = None) -> Any

Install services. Validates, gates and plans the install of one or more services, then creates the operation. Returns operation_id and the ha checks.

Route: /api/v1/clusters/{cluster_id}/services (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Services to install with their placements and configuration.

Returns: Any. Decoded JSON answer of the operation "Install services".

Raises: the typed errors of the transport (Errors).

ServicesApi.list_services

list_services(cluster_id: str) -> Any

List the services of a cluster. Every service of the cluster with its display_name, mode, method, managed, state, health, version, components and their hosts, hosts with a stale configuration, config_version, open alerts, administrative state, delivery (install or connect) and connection. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "List the services of a cluster".

Raises: the typed errors of the transport (Errors).

ServicesApi.lock_cluster

lock_cluster(cluster_id: str, body: Any = None) -> Any

Set the security lock of a cluster. Locks the cluster after a security incident: every new operation is refused with 423 cluster_security_locked, except a security suspension or an emergency stop, until a security administrator lifts it. Returns cluster_id and security_lock. Permission pki:manage. Audited as cluster.security_lock.

Route: /api/v1/clusters/{cluster_id}/security-lock (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Reason of the lock.

Returns: Any. Decoded JSON answer of the operation "Set the security lock of a cluster".

Raises: the typed errors of the transport (Errors).

ServicesApi.remove_component

remove_component(cluster_id: str, service: str, component: str, host_id: str, ha_acknowledged: boolean = None) -> Any

Remove a component instance from a host. Starts an operation that stops and removes the component on that host and returns operation_id with the ha checks. Permission services:install. Errors: 404 host_component_not_found, 422 topology_invalid (the topology would break the rules of the service), 409 ha_requirements_not_met or ha_acknowledgement_required. Audited as service.component_remove.

Route: /api/v1/clusters/{cluster_id}/services/{service}/components/{component}/hosts/{host_id} (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
component	str		yes	Name of the component, as declared by the catalog service, for example server.
host_id	str		yes	Identifier of the host, a machine registered by its Navin agent.
ha_acknowledged	boolean	None	no	Accept that the change leaves the service below its high availability requirements. Default false.

Returns: Any. Decoded JSON answer of the operation "Remove a component instance from a host".

Raises: the typed errors of the transport (Errors).

ServicesApi.rollback

rollback(cluster_id: str, upgrade_id: str, body: Any = None) -> Any

Roll an upgrade back. Starts the operation that replays the sealed tasks of the previous release and restores the previous configuration version. Refused when the descriptor declares it impossible or an irreversible migration ran (use the restore instead). Returns operation_id. Permission services:install; 404 upgrade_not_found. Audited as service.rollback.

Route: /api/v1/clusters/{cluster_id}/upgrades/{upgrade_id}/rollback (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
upgrade_id	str		yes	Identifier of the upgrade.
body	Any	None	no	Optional approval.

Returns: Any. Decoded JSON answer of the operation "Roll an upgrade back".

Raises: the typed errors of the transport (Errors).

ServicesApi.service_action

service_action(cluster_id: str, service: str, body: Any = None) -> Any

Run an action on a service. Starts an operation that runs the action on the components and hosts chosen (all by default) and returns operation_id. A rolling restart handles batch_size hosts at a time. reinstall also needs services:install. Permission services:operate. Errors: 409 service_unmanaged, 409 service_check_missing, 409 smoke_test_missing, 404 host_component_not_found, 409 approval_required. Audited as service.<action>.

Route: /api/v1/clusters/{cluster_id}/services/{service}/actions (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Action, scope and batching.

Returns: Any. Decoded JSON answer of the operation "Run an action on a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.service_command

service_command(cluster_id: str, service: str, command: str, body: Any = None) -> Any

Run a custom command of a service. Starts an operation running a command declared by the catalog service (for example a vacuum or a rebalance) with its parameters and returns operation_id. Permission services:operate. Errors: 409 service_unmanaged, 404 command_unknown, 422 command_params_invalid, 404 host_component_not_found. Audited as service.command (parameter names only).

Route: /api/v1/clusters/{cluster_id}/services/{service}/commands/{command} (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
command	str		yes	Name of the command, as declared by the catalog service.
body	Any	None	no	Parameters of the command and optional target host.

Returns: Any. Decoded JSON answer of the operation "Run a custom command of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.service_dashboard_view

service_dashboard_view(cluster_id: str, service: str, from_: string | null = None, to: string | null = None, step: integer = None) -> Any

Get the monitoring dashboard of a service. Monitoring dashboard of a service over [from, to] (default: the last hour): instances, health and latest checks, availability over the period, metrics of its hosts, alerts, operations, configuration and, for a connected service, its connection. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/dashboard (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
from_	string | null	None	no	Start of the window, ISO 8601. Default: one hour before to.
to	string | null	None	no	End of the window, ISO 8601. Default: now.
step	integer	None	no	Width of a metric bucket in seconds, 10 to 86400. Default 60.

Returns: Any. Decoded JSON answer of the operation "Get the monitoring dashboard of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.service_logs

service_logs(cluster_id: str, service: str, body: Any = None) -> Any

Fetch the logs of a component instance. Starts an operation where the agent of the host reads the last lines of the component logs. Returns operation_id and task_id: read the lines with GET /operations/{operation_id}/tasks/{task_id}/logs. Permission services:operate. Audited as service.logs.

Route: /api/v1/clusters/{cluster_id}/services/{service}/logs (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Host, component and number of lines.

Returns: Any. Decoded JSON answer of the operation "Fetch the logs of a component instance".

Raises: the typed errors of the transport (Errors).

ServicesApi.set_mode

set_mode(cluster_id: str, service: str, body: Any = None) -> Any

Apply an operating mode to a service. Applies one mode and returns the administrative state left behind, its documented effect on new requests and transactions in flight, the operation_id when the mode stops processes, and the informative ha impact:

Route: /api/v1/clusters/{cluster_id}/services/{service}/mode (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Mode, reason and drain timeout.

Returns: Any. Decoded JSON answer of the operation "Apply an operating mode to a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.uninstall_service

uninstall_service(cluster_id: str, service: str, purge_data: boolean = None, approval_id: string | null = None) -> Any

Uninstall a service. Starts the uninstall operation (stop, remove packages and, with purge_data, the data) and returns operation_id. Permission services:install. Errors: 409 service_in_use (consumers listed in details.consumers), 409 service_connected (use DELETE .../connection), 409 approval_required under banking-secure. Audited as service.uninstall.

Route: /api/v1/clusters/{cluster_id}/services/{service} (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
purge_data	boolean	None	no	Also delete the data directories of the service. Irreversible. Default false.
approval_id	string | null	None	no	Identifier of the approval granted for this uninstall (banking-secure). Omit it to use the approval granted to you, if any.

Returns: Any. Decoded JSON answer of the operation "Uninstall a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.unlock_cluster

unlock_cluster(cluster_id: str) -> Any

Lift the security lock of a cluster. Lifts the lock: new operations are accepted again. Returns cluster_id and security_lock (null). Permission pki:manage (security role). Audited as cluster.security_unlock.

Route: /api/v1/clusters/{cluster_id}/security-lock (DELETE).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Lift the security lock of a cluster".

Raises: the typed errors of the transport (Errors).

ServicesApi.update_connection

update_connection(cluster_id: str, service: str, body: Any = None) -> Any

Update a connected service. Changes the address, the credentials (rotation) or the TLS settings of a connected service; a value left out keeps the stored one. With dry_run the change is checked like a connect validation and not saved. Credentials the service refuses are never saved (422 connect_invalid). Permission services:install; 409 service_not_connected. Audited as service.connection.update (field names only, never values).

Route: /api/v1/clusters/{cluster_id}/services/{service}/connection (PATCH).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Fields of the connection to change.

Returns: Any. Decoded JSON answer of the operation "Update a connected service".

Raises: the typed errors of the transport (Errors).

ServicesApi.upgrade

upgrade(cluster_id: str, service: str, body: Any = None) -> Any

Upgrade a service. Upgrades the service to the catalog release in one operation:

Route: /api/v1/clusters/{cluster_id}/services/{service}/upgrade (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
service	str		yes	Name of the catalog service, for example postgresql or keycloak.
body	Any	None	no	Canary host and optional approval.

Returns: Any. Decoded JSON answer of the operation "Upgrade a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.validate_connect

validate_connect(cluster_id: str, body: Any = None) -> Any

Check a connection before saving it. Dry run of a connect: checks the request against the descriptor, then runs the health check and the authenticated check of the method. Returns the verdict with the errors; nothing is saved. Permission services:install.

Route: /api/v1/clusters/{cluster_id}/services/connect/validate (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Same body as a connect.

Returns: Any. Decoded JSON answer of the operation "Check a connection before saving it".

Raises: the typed errors of the transport (Errors).

ServicesApi.validate_services

validate_services(cluster_id: str, body: Any = None) -> Any

Validate an install without running it. Checks an install request and previews it without changing anything. Returns ok, errors (each with service, field, code, message_i18n), plan (order, number of stages, steps), ha (high availability checks) and dependencies (items and added). Permission services:install.

Route: /api/v1/clusters/{cluster_id}/services/validate (POST).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
body	Any	None	no	Same body as an install.

Returns: Any. Decoded JSON answer of the operation "Validate an install without running it".

Raises: the typed errors of the transport (Errors).

Class SettingsApi

Settings. General settings of the Manager: site name, default language, install defaults (preferred method, registry, mirror), SMTP and remote syslog for the alert notifications (syslog also serves the remote audit rule of banking-secure), data retention and the corporate proxy of the managed hosts. Every signed in user reads the non secret values; settings:manage (global) writes them. The SMTP password is read back as {"secret": true, "set": true|false}. Changes are audited (settings.update). Operations of this group of the Navin Manager API.

Resource

SettingsApi.get_settings_view

get_settings_view() -> Any

Get the settings. Returns site_name, default_language, install, smtp, syslog, retention and proxy, secrets masked. Any signed in user.

Route: /api/v1/settings (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the settings".

Raises: the typed errors of the transport (Errors).

SettingsApi.put_settings

put_settings(body: Any = None) -> Any

Update the settings. Changes the sections and fields given; a section or field left out is kept. Returns the settings. Permission settings:manage. Errors: 422 proxy_invalid (proxy URL with credentials or not http(s)), 422 validation_error. Audited as settings.update.

Route: /api/v1/settings (PUT).

Name	Type	Default	Required	Description
body	Any	None	no	Sections of the settings to change.

Returns: Any. Decoded JSON answer of the operation "Update the settings".

Raises: the typed errors of the transport (Errors).

Class StackApi

Stack catalog. The catalog of services the Manager can install (the stack): every service with its versions, components, install methods, parameters, dependencies and high availability rules. Any signed in user can read it; no permission is needed. Operations of this group of the Navin Manager API.

Resource

StackApi.high_availability

high_availability() -> Any

Get the high availability matrix of the catalog. High availability matrix of every catalog service, sorted by category then name: its modes (topologies) with the cardinality of each component, and its high availability block with the liveness and readiness checks. Returns items and count. Any signed in user.

Route: /api/v1/catalog/high-availability (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the high availability matrix of the catalog".

Raises: the typed errors of the transport (Errors).

StackApi.service

service(name: str) -> Any

Get a catalog service. Public description of one catalog service: components, modes, methods, delivery, layer and high availability. Any signed in user; 404 for an unknown service.

Route: /api/v1/stack/services/{name} (GET).

Name	Type	Default	Required	Description
name	str		yes	Name of the catalog service, for example postgresql.

Returns: Any. Decoded JSON answer of the operation "Get a catalog service".

Raises: the typed errors of the transport (Errors).

StackApi.stack

stack() -> Any

Get the catalog summary. Name, version and categories of the stack and a summary of every service it offers (components, modes, dependencies, licence). Any signed in user.

Route: /api/v1/stack (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the catalog summary".

Raises: the typed errors of the transport (Errors).

Class SystemApi

System. Self monitoring of the Manager: health of the database, the engine, the agents and the scheduled jobs, the list of supported operating systems and the Prometheus service discovery of a cluster. Permissions: system:read for the health, cluster:read for the service discovery; the supported systems are open to every signed in user. Operations of this group of the Navin Manager API.

Resource

SystemApi.health

health() -> Any

Get the health of the Manager. Returns version, database (ok, latency_ms), engine (leader, last_tick_at, lag_s, queued_tasks), agents (online: heartbeat in the last 60 seconds, lost, total) and scheduler.jobs (last run and last error of each job). Permission system:read.

Route: /api/v1/system/health (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the health of the Manager".

Raises: the typed errors of the transport (Errors).

SystemApi.prometheus_sd

prometheus_sd(cluster_id: str) -> Any

Prometheus service discovery of a cluster. Targets in the Prometheus HTTP service discovery format: one group per component instance exposing metrics, with targets (fqdn:port) and the labels __metrics_path__, __scheme__, nm_cluster, nm_service, nm_component, nm_host. Permission cluster:read; 404 cluster_not_found.

Route: /api/v1/clusters/{cluster_id}/sd/prometheus (GET).

Name	Type	Default	Required	Description
cluster_id	str		yes	Identifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).

Returns: Any. Decoded JSON answer of the operation "Prometheus service discovery of a cluster".

Raises: the typed errors of the transport (Errors).

SystemApi.supported_os

supported_os() -> Any

List the supported operating systems. Published list of the operating systems and versions the agents and the services support. Any signed in user.

Route: /api/v1/system/supported-os (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the supported operating systems".

Raises: the typed errors of the transport (Errors).

Class TelemetryApi

Telemetry. State of the real time export of the metrics and events of the Manager to ClickHouse. The platform ships no dashboard server (ADR-0169): machines and services are followed in the Manager itself and the exported tables are read with SQL. The export is off while no ClickHouse URL is configured. Any principal that reads at least one cluster (cluster:read, global or on a cluster). Operations of this group of the Navin Manager API.

Resource

TelemetryApi.telemetry

telemetry() -> Any

Get the telemetry export state. Returns enabled, database, flush_seconds, retention_days, stats (buffered, written, dropped, failures, last_error) and the exported tables. Permission cluster:read on at least one cluster.

Route: /api/v1/telemetry (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the telemetry export state".

Raises: the typed errors of the transport (Errors).

Class UsersApi

Users and roles. Administration of the console accounts and of their role bindings. Operations of this group of the Navin Manager API.

Resource

UsersApi.create_user

create_user(body: Any = None) -> Any

Create a local user. Creates a local account with its password and role bindings and returns it (201). Permission users:manage. Errors: 409 username_taken, 422 password_policy, 422 role_invalid, 422 role_global_only, 422 binding_cluster_not_found, 403 user_manage_denied (granting admin without being a full administrator). Audited as user.create.

Route: /api/v1/users (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The new account.

Returns: Any. Decoded JSON answer of the operation "Create a local user".

Raises: the typed errors of the transport (Errors).

UsersApi.delete_user

delete_user(user_id: str) -> Any

Delete a user. Deletes the account. Answers 204. Permission users:manage. Errors: 404 user_not_found, 409 cannot_delete_self, 409 last_admin, 403 user_manage_denied. Audited as user.delete.

Route: /api/v1/users/{user_id} (DELETE).

Name	Type	Default	Required	Description
user_id	str		yes	Identifier of the user account of the console.

Returns: Any. Decoded JSON answer of the operation "Delete a user".

Raises: the typed errors of the transport (Errors).

UsersApi.get_user

get_user(user_id: str) -> Any

Get a user. Returns the account with its role bindings (role, cluster_id, source). Permission users:read; 404 user_not_found.

Route: /api/v1/users/{user_id} (GET).

Name	Type	Default	Required	Description
user_id	str		yes	Identifier of the user account of the console.

Returns: Any. Decoded JSON answer of the operation "Get a user".

Raises: the typed errors of the transport (Errors).

UsersApi.list_users

list_users(q: string | null = None, source: "local" | "ldap" | "oidc" | null = None, limit: int | None = None, cursor: str | None = None) -> Any

List the users. Users sorted by username, each with its role bindings, MFA state, lock and last sign in. Paginated with limit and cursor. Permission users:read.

Route: /api/v1/users (GET).

Name	Type	Default	Required	Description
q	string | null	None	no	Text searched, case insensitive, in the username, the display name and the email.
source	"local" | "ldap" | "oidc" | null	None	no	Only the users of this source: local, ldap or oidc.
limit	int | None	None	no	Maximum number of users in the page, from 1 to 500. Default 50.
cursor	str | None	None	no	The next_cursor of the previous page (the last username, lower case). Omit it for the first page.

Returns: Any. Decoded JSON answer of the operation "List the users".

Raises: the typed errors of the transport (Errors).

UsersApi.patch_user

patch_user(user_id: str, body: Any = None) -> Any

Update or disable a user. Changes the fields given, keeps the others, and returns the user. Disabling an account revokes its sessions at once. Permission users:manage. Errors: 404 user_not_found, 409 cannot_disable_self, 409 last_admin, 403 user_manage_denied. Audited as user.update.

Route: /api/v1/users/{user_id} (PATCH).

Name	Type	Default	Required	Description
user_id	str		yes	Identifier of the user account of the console.
body	Any	None	no	Fields of the user to change.

Returns: Any. Decoded JSON answer of the operation "Update or disable a user".

Raises: the typed errors of the transport (Errors).

UsersApi.put_roles

put_roles(user_id: str, body: Any = None) -> Any

Replace the role bindings of a user. Replaces the manual bindings by the list given; bindings synchronized from LDAP or OIDC are kept. When a new role requires MFA and the user has none, its sessions are revoked. Returns the user. Permission users:manage. Errors: 409 last_admin, 422 role_invalid, 422 role_global_only, 422 binding_cluster_not_found, 403 user_manage_denied. Audited as user.roles with the bindings before and after.

Route: /api/v1/users/{user_id}/roles (PUT).

Name	Type	Default	Required	Description
user_id	str		yes	Identifier of the user account of the console.
body	Any	None	no	The complete list of manual bindings.

Returns: Any. Decoded JSON answer of the operation "Replace the role bindings of a user".

Raises: the typed errors of the transport (Errors).

UsersApi.reset_mfa

reset_mfa(user_id: str) -> Any

Reset the second factor of a user. Turns MFA off for the user, deletes its secret and recovery codes and revokes its sessions; the user enrolls again at the next sign in when its role requires MFA. Returns the user. Permission users:manage. Audited as user.mfa_reset.

Route: /api/v1/users/{user_id}/mfa/reset (POST).

Name	Type	Default	Required	Description
user_id	str		yes	Identifier of the user account of the console.

Returns: Any. Decoded JSON answer of the operation "Reset the second factor of a user".

Raises: the typed errors of the transport (Errors).

UsersApi.reset_password

reset_password(user_id: str, body: Any = None) -> Any

Set the password of a local user. Sets a new password following the policy, unlocks the account and revokes its sessions. Answers 204. Permission users:manage. Errors: 409 not_local_user, 422 password_policy, 404 user_not_found, 403 user_manage_denied. Audited as user.password_reset.

Route: /api/v1/users/{user_id}/password (POST).

Name	Type	Default	Required	Description
user_id	str		yes	Identifier of the user account of the console.
body	Any	None	no	The new password and whether it must be changed at the next sign in.

Returns: Any. Decoded JSON answer of the operation "Set the password of a local user".

Raises: the typed errors of the transport (Errors).

UsersApi.roles

roles() -> Any

List the roles and their permissions. Every role with its name, its label in both languages, its sorted permissions and its scopes (global, and cluster when it can be bound to one cluster). Permission users:read.

Route: /api/v1/roles (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the roles and their permissions".

Raises: the typed errors of the transport (Errors).

UsersApi.unlock_user

unlock_user(user_id: str) -> Any

Unlock a user. Clears the lock set after repeated failed sign ins and resets the failure counter. Returns the user. Permission users:manage. Audited as user.unlock.

Route: /api/v1/users/{user_id}/unlock (POST).

Name	Type	Default	Required	Description
user_id	str		yes	Identifier of the user account of the console.

Returns: Any. Decoded JSON answer of the operation "Unlock a user".

Raises: the typed errors of the transport (Errors).

Class VaultApi

Vault. The vault of the platform administrators: the credentials of the platform services. An entry is a service name, its URL, a login, a password and an API key or secret key. Only the name is stored in clear; URL, login, password and key are one document sealed with AES-256-GCM and the master key. Lists and sheets never carry the password nor the key (has_password, has_api_key); POST .../reveal returns them and is audited, the audit keeping the service name only, never a value. Operations of this group of the Navin Manager API.

Resource

VaultApi.create_entry

create_entry(body: Any = None) -> Any

Add a vault entry. Creates a manual entry and returns it (201). Permission vault:manage. Errors: 409 vault_name_taken, 422 vault_name_required. Audited as vault.create.

Route: /api/v1/vault/entries (POST).

Name	Type	Default	Required	Description
body	Any	None	no	The service and its credentials.

Returns: Any. Decoded JSON answer of the operation "Add a vault entry".

Raises: the typed errors of the transport (Errors).

VaultApi.delete_entry

delete_entry(entry_id: str) -> Any

Delete a vault entry. Deletes the entry. Answers 204. Permission vault:manage; 404 vault_entry_not_found. Audited as vault.delete.

Route: /api/v1/vault/entries/{entry_id} (DELETE).

Name	Type	Default	Required	Description
entry_id	str		yes	Identifier of the vault entry.

Returns: Any. Decoded JSON answer of the operation "Delete a vault entry".

Raises: the typed errors of the transport (Errors).

VaultApi.get_entry

get_entry(entry_id: str) -> Any

Get a vault entry. Returns the sheet of one entry without its password nor key. Permission vault:manage; 404 vault_entry_not_found.

Route: /api/v1/vault/entries/{entry_id} (GET).

Name	Type	Default	Required	Description
entry_id	str		yes	Identifier of the vault entry.

Returns: Any. Decoded JSON answer of the operation "Get a vault entry".

Raises: the typed errors of the transport (Errors).

VaultApi.import_entries

import_entries() -> Any

Import the credentials of the installed services. Creates or refreshes the entries of the installed services of every cluster; fields changed by hand are kept. Returns the names of the entries by outcome. Permission vault:manage. Audited as vault.import.

Route: /api/v1/vault/import (POST).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Import the credentials of the installed services".

Raises: the typed errors of the transport (Errors).

VaultApi.list_entries

list_entries() -> Any

List the vault entries. Services of the vault sorted by name, with their URL and login but without their password nor key. Permission vault:manage.

Route: /api/v1/vault/entries (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the vault entries".

Raises: the typed errors of the transport (Errors).

VaultApi.reveal_entry

reveal_entry(entry_id: str) -> Any

Reveal the password and key of an entry. Returns the password and the key of one service in clear, to show and copy them in the console. Permission vault:manage; 404 vault_entry_not_found. Audited as vault.reveal (service name only).

Route: /api/v1/vault/entries/{entry_id}/reveal (POST).

Name	Type	Default	Required	Description
entry_id	str		yes	Identifier of the vault entry.

Returns: Any. Decoded JSON answer of the operation "Reveal the password and key of an entry".

Raises: the typed errors of the transport (Errors).

VaultApi.update_entry

update_entry(entry_id: str, body: Any = None) -> Any

Update a vault entry. Changes the fields given and returns the entry. Permission vault:manage. Errors: 404 vault_entry_not_found, 409 vault_name_taken, 422 vault_name_required, 409 vault_entry_managed (credentials of a console the Manager rotates). Audited as vault.update (field names only).

Route: /api/v1/vault/entries/{entry_id} (PATCH).

Name	Type	Default	Required	Description
entry_id	str		yes	Identifier of the vault entry.
body	Any	None	no	Fields of the entry to change.

Returns: Any. Decoded JSON answer of the operation "Update a vault entry".

Raises: the typed errors of the transport (Errors).