Skip to main content

manager/generated/operations.ts

Source: sdks/typescript/packages/sdk/src/manager/generated/operations.ts. Back to the TypeScript SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Class AgentTemplatesApi​

Agent templates. The registry of the agent templates (Service Templates of the Navin products such as the Navin Enterprise RAG Agent): each template with its name, publisher, version, status and the catalog service that installs it. A template is published only when that service exists in the catalog and the template was published, by the release (status published) or on this Manager by an administrator (POST .../publish, the validation of the customer: the service definition joins the catalog of this Manager); otherwise reason says why it cannot be deployed and publishable whether it can be published here. Reading is open to any signed in user, like the stack catalog; publishing and withdrawing need agent_templates:publish. Operations of this group of the Navin Manager API.

ManagerResource

AgentTemplatesApi.agentTemplate​

agentTemplate(templateId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get an agent template. One agent template by its identifier: name and description (fr and en), publisher, version, status, catalog service, documentation and source paths, components, published, reason, publication, publishable and publish_blocker. Any signed in user; 404 for an unknown template.

Route: /api/v1/agent-templates/{template_id} (GET).

NameTypeDefaultRequiredDescription
templateIdstringyesIdentifier of the agent template, equal to the name of its descriptor file.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get an agent template".

Raises: the typed errors of the transport (Errors).

AgentTemplatesApi.agentTemplates​

agentTemplates(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the agent templates. Every agent template of the registry, sorted by identifier, with published computed against the loaded catalog and the publications of this Manager, reason (fr and en) when it cannot be deployed, publication (version, who, when) when it was published here, publishable and publish_blocker. Returns items and count. Any signed in user.

Route: /api/v1/agent-templates (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the agent templates".

Raises: the typed errors of the transport (Errors).

AgentTemplatesApi.publishAgentTemplate​

publishAgentTemplate(templateId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Validate and publish an agent template. The validation of the customer: the service definition and the templates of the agent are checked by the catalog loader together with the whole catalog (on a staging copy, nothing is written when a check fails), then copied under published_templates_dir; the service joins the catalog of this Manager, the template answers published: true and its Deploy button opens the install wizard. Publishing again replaces the files with the current sources. Returns the template. Permission agent_templates:publish; audited as agent_template.publish. Errors: 404 agent_template_unknown, 409 agent_template_not_publishable (planned or in development), 409 agent_template_sources_missing, 409 agent_template_already_published (service shipped with the catalog), 422 agent_template_invalid (the problems found are in details.problems).

Route: /api/v1/agent-templates/{template_id}/publish (POST).

NameTypeDefaultRequiredDescription
templateIdstringyesIdentifier of the agent template.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Validate and publish an agent template".

Raises: the typed errors of the transport (Errors).

AgentTemplatesApi.withdrawAgentTemplate​

withdrawAgentTemplate(templateId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Withdraw the publication of an agent template. Removes the service definition and the templates published on this Manager and the publication record: the service leaves the catalog and the template is awaiting validation again. Refused while an instance of the service is installed in a cluster (409 agent_template_in_use, the instances are in details.instances). Returns the template. Permission agent_templates:publish; audited as agent_template.unpublish. Errors: 404 agent_template_unknown, 404 agent_template_not_published.

Route: /api/v1/agent-templates/{template_id}/publication (DELETE).

NameTypeDefaultRequiredDescription
templateIdstringyesIdentifier of the agent template.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Withdraw the publication of an agent template".

Raises: the typed errors of the transport (Errors).

Class AlertsApi​

Alerts and notifications. Alerts raised by the Manager from its alert definitions (host down, disk full, service unhealthy, certificate about to expire...), and the notification targets that receive them. Operations of this group of the Navin Manager API.

ManagerResource

AlertsApi.ackAlert​

ackAlert(alertId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Acknowledge an alert. Records who acknowledged the alert, when, and the note; the alert stays open until its condition clears. Returns the alert. Permission alerts:manage on its cluster. Audited as alert.ack.

Route: /api/v1/alerts/{alert_id}/ack (POST).

NameTypeDefaultRequiredDescription
alertIdstringyesIdentifier of the alert.
bodyunknown{}noOptional note.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Acknowledge an alert".

Raises: the typed errors of the transport (Errors).

AlertsApi.createTarget​

createTarget(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Add a notification target. Creates a target and returns it (201). An email target needs config.to, a webhook target config.url (http:// or https://); a syslog target uses the syslog server of the settings. Permission alerts:manage; 422 notification_target_invalid. Audited as notification_target.create.

Route: /api/v1/notification-targets (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noName, kind, configuration and minimum severity of the target.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Add a notification target".

Raises: the typed errors of the transport (Errors).

AlertsApi.deleteTarget​

deleteTarget(targetId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete a notification target. Deletes the target. Answers 204. Permission alerts:manage; 404 notification_target_not_found. Audited as notification_target.delete.

Route: /api/v1/notification-targets/{target_id} (DELETE).

NameTypeDefaultRequiredDescription
targetIdstringyesIdentifier of the notification target.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete a notification target".

Raises: the typed errors of the transport (Errors).

AlertsApi.getAlert​

getAlert(alertId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get an alert. Returns one alert with the history of its state changes (the last 200: ts, from_state, to_state, value, text). Permission alerts:read on its cluster; 404 alert_not_found.

Route: /api/v1/alerts/{alert_id} (GET).

NameTypeDefaultRequiredDescription
alertIdstringyesIdentifier of the alert.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get an alert".

Raises: the typed errors of the transport (Errors).

AlertsApi.listAlerts​

listAlerts(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the alerts of a cluster. Alerts of the cluster, last changed first (at most 500): definition, label, fingerprint, host, service, component, state, text, value, first and last seen, acknowledgement and resolution. Open alerts only unless include_resolved. Permission alerts:read.

Route: /api/v1/clusters/{cluster_id}/alerts (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the alerts of a cluster".

Raises: the typed errors of the transport (Errors).

AlertsApi.listDefinitions​

listDefinitions(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the alert definitions. Every definition with its name, scope, kind, label, description, enabled, interval_s, warning and critical thresholds and params. Permission alerts:read.

Route: /api/v1/alert-definitions (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the alert definitions".

Raises: the typed errors of the transport (Errors).

AlertsApi.listTargets​

listTargets(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the notification targets. Every target with its kind, config, min_severity, enabled and whether an HMAC secret is set (never its value). Permission alerts:manage.

Route: /api/v1/notification-targets (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the notification targets".

Raises: the typed errors of the transport (Errors).

AlertsApi.patchDefinition​

patchDefinition(definitionId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Tune an alert definition. Turns a definition on or off and changes its thresholds or its evaluation interval; a field left out is kept. Returns the definition. Permission alerts:manage; 404 alert_definition_not_found. Audited as alert_definition.update.

Route: /api/v1/alert-definitions/{definition_id} (PATCH).

NameTypeDefaultRequiredDescription
definitionIdstringyesIdentifier of the alert definition.
bodyunknown{}noFields of the definition to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Tune an alert definition".

Raises: the typed errors of the transport (Errors).

AlertsApi.patchTarget​

patchTarget(targetId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update a notification target. Changes the fields given and returns the target. Permission alerts:manage. Errors: 404 notification_target_not_found, 422 notification_target_invalid. Audited as notification_target.update.

Route: /api/v1/notification-targets/{target_id} (PATCH).

NameTypeDefaultRequiredDescription
targetIdstringyesIdentifier of the notification target.
bodyunknown{}noFields of the target to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update a notification target".

Raises: the typed errors of the transport (Errors).

AlertsApi.testTarget​

testTarget(targetId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Send a test notification. Sends a test message (state warning, fingerprint test) to the target now and returns {"ok": true}. Permission alerts:manage. Errors: 404 notification_target_not_found, 502 notification_failed (the target refused or could not be reached). Audited as notification_target.test.

Route: /api/v1/notification-targets/{target_id}/test (POST).

NameTypeDefaultRequiredDescription
targetIdstringyesIdentifier of the notification target.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Send a test notification".

Raises: the typed errors of the transport (Errors).

Class AuditApi​

Audit. The audit trail of the Manager: every change, sign in, refusal and sensitive read, with the actor (user, API token, agent or system), the action (for example service.install), the target, the cluster, the outcome (success, failure, denied), the client address and details. Events are chained: each one carries the hash of the previous one, so a modified or deleted event breaks the chain. Operations of this group of the Navin Manager API.

ManagerResource

AuditApi.export​

export(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Export the audit trail. Streams every event of the period in sequence order as a file download: audit.ndjson (one JSON object per line) or audit.csv (cells a spreadsheet would read as a formula are prefixed with a quote). Permission audit:read; 422 export_format_invalid for another format. Audited as audit.export.

Route: /api/v1/audit/export (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Export the audit trail".

Raises: the typed errors of the transport (Errors).

AuditApi.listAudit​

listAudit(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Page<Doc>>

Search the audit trail. Events matching every filter given, newest first: seq, id, ts, actor_type, actor_id, actor_name, action, target_type, target_id, cluster_id, outcome, ip, details, prev_hash, hash. Paginated with limit and cursor. Permission audit:read.

Route: /api/v1/audit (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Page<Doc>>. Decoded JSON answer of the operation "Search the audit trail".

Raises: the typed errors of the transport (Errors).

AuditApi.verify​

verify(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Verify the hash chain of the audit trail. Recomputes the hash of every event and checks the link to the previous one. Returns valid, the number of events checked and first_broken_seq (null when the chain is intact). Permission audit:read. Audited as audit.verify (outcome failure when the chain is broken).

Route: /api/v1/audit/verify (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Verify the hash chain of the audit trail".

Raises: the typed errors of the transport (Errors).

Class AuthApi​

Authentication. Sign in and sign out of the console: identity providers, first run setup, local and LDAP login, second factor (TOTP), password change, session and OIDC login. Operations of this group of the Navin Manager API.

ManagerResource

AuthApi.providers​

providers(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the sign in methods. Public endpoint used by the login page. Returns local (always true), ldap (enabled, name), oidc (the enabled providers, id and name), setup_required (true while no user exists: call POST /auth/setup) and mfa (whether the TOTP second factor is turned on for this Manager).

Route: /api/v1/auth/providers (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the sign in methods".

Raises: the typed errors of the transport (Errors).

AuthApi.session​

session(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Read the current session. Returns the authenticated user (user), its effective permissions (permissions.global and permissions.clusters by cluster identifier), the csrf_token of the session (null for an API token) and expires_at (of the session or of the token). Any authenticated caller; 401 otherwise.

Route: /api/v1/auth/session (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Read the current session".

Raises: the typed errors of the transport (Errors).

Class AuthConfigApi​

Identity providers and security policy. Configuration of how users sign in: the LDAP directory, the OIDC providers and the security policy (passwords, lockout, session timeouts, roles that require MFA). Operations of this group of the Navin Manager API.

ManagerResource

AuthConfigApi.createOidc​

createOidc(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Add an OIDC provider. Creates a provider and returns it (201). The scopes must include openid. Permission auth:manage. Errors: 409 provider_name_taken, 422 oidc_config_invalid, 422 role_invalid. Audited.

Route: /api/v1/auth-config/oidc (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noSettings of the provider.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Add an OIDC provider".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.deleteOidc​

deleteOidc(providerId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete an OIDC provider. Removes the provider; its users can no longer sign in through it. Answers 204. Permission auth:manage; 404 oidc_provider_not_found. Audited as auth_config.oidc_delete.

Route: /api/v1/auth-config/oidc/{provider_id} (DELETE).

NameTypeDefaultRequiredDescription
providerIdstringyesIdentifier of the OIDC provider.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete an OIDC provider".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.getLdap​

getLdap(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the LDAP configuration. Returns the LDAP settings with their defaults, the bind password as {"secret": true, "set": ...} and the role mappings. Permission auth:manage.

Route: /api/v1/auth-config/ldap (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the LDAP configuration".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.getOidc​

getOidc(providerId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get an OIDC provider. Returns one provider with its settings and mappings. Permission auth:manage; 404 oidc_provider_not_found.

Route: /api/v1/auth-config/oidc/{provider_id} (GET).

NameTypeDefaultRequiredDescription
providerIdstringyesIdentifier of the OIDC provider.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get an OIDC provider".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.getPolicy​

getPolicy(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the security policy. Returns the current policy, defaults included: password minimum length 12, history 5, no maximum age, lockout after 5 failures for 15 minutes, sessions of 30 idle minutes and 12 hours at most, MFA required for admin and security_admin. Permission auth:manage.

Route: /api/v1/auth-config/policy (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the security policy".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.listOidc​

listOidc(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the OIDC providers. Every OIDC provider, enabled or not, with its settings and mappings; client secrets are never returned. Permission auth:manage.

Route: /api/v1/auth-config/oidc (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the OIDC providers".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.putLdap​

putLdap(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Save the LDAP configuration. Replaces the LDAP settings and role mappings and returns them. Every URL must be protected by TLS (ldaps://, or ldap:// with start_tls), at least one URL is needed when enabled, filters must be balanced in parentheses. Permission auth:manage. Errors: 422 ldap_config_invalid (with details.problems), 422 role_invalid. Audited as auth_config.ldap.

Route: /api/v1/auth-config/ldap (PUT).

NameTypeDefaultRequiredDescription
bodyunknown{}noComplete LDAP settings.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Save the LDAP configuration".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.putOidc​

putOidc(providerId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update an OIDC provider. Replaces the settings and mappings of the provider and returns it; the client secret is kept unless a new one is sent. Permission auth:manage. Errors: 404 oidc_provider_not_found, 409 provider_name_taken, 422 oidc_config_invalid. Audited.

Route: /api/v1/auth-config/oidc/{provider_id} (PUT).

NameTypeDefaultRequiredDescription
providerIdstringyesIdentifier of the OIDC provider.
bodyunknown{}noComplete settings of the provider.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update an OIDC provider".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.putPolicy​

putPolicy(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Save the security policy. Replaces the whole policy and returns it. It applies to the next password change, sign in and session check. Permission auth:manage; 422 role_invalid for an unknown role in mfa_required_roles. Audited as auth_config.policy.

Route: /api/v1/auth-config/policy (PUT).

NameTypeDefaultRequiredDescription
bodyunknown{}noEvery field of the policy.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Save the security policy".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.testLdap​

testLdap(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Test the LDAP configuration. Binds with the stored settings and, when a test account is given, searches the user, checks its password and reads its groups. Returns ok, bind, user_found, groups and error_code. Nothing is changed. Permission auth:manage; 404 ldap_not_configured. Audited as auth_config.ldap_test.

Route: /api/v1/auth-config/ldap/test (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noOptional test account.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Test the LDAP configuration".

Raises: the typed errors of the transport (Errors).

AuthConfigApi.testOidc​

testOidc(providerId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Test an OIDC provider. Reads the discovery document of the issuer and its signing keys. Returns ok, issuer, jwks_keys (number of keys) and error_code. Permission auth:manage; 404 oidc_provider_not_found. Audited as auth_config.oidc_test.

Route: /api/v1/auth-config/oidc/{provider_id}/test (POST).

NameTypeDefaultRequiredDescription
providerIdstringyesIdentifier of the OIDC provider.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Test an OIDC provider".

Raises: the typed errors of the transport (Errors).

Class AvailabilityApi​

High availability groups. A high availability group describes how one component of a cluster stays available: its HA mode (single, active_passive, active_active, quorum), its profile (standalone, ha with at least 2 replicas in 2 fault domains, critical-ha with at least 3 in 3), its members and their fault domains, its failover policy and its recovery objectives (RTO, RPO). The group reports its HA status from the heartbeats of its members. Operations of this group of the Navin Manager API.

ManagerResource

AvailabilityApi.createGroup​

createGroup(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a high availability group. Declares a group and its members and returns it (201). The profile must be met by desired_replicas and fault_domains, two members cannot share a host. Permission cluster:manage on the cluster. Errors: 422 ha_profile_unmet, 422 ha_mode_unsupported, 422 ha_members_same_host, 404 cluster_not_found, 404 host_not_found. Audited as ha_group.create.

Route: /api/v1/ha-groups (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe group, its policy and its members.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a high availability group".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.getGroup​

getGroup(groupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a high availability group. Returns the group with its members, its HA status and its last test run. Permission cluster:read on its cluster; 404 ha_group_not_found.

Route: /api/v1/ha-groups/{group_id} (GET).

NameTypeDefaultRequiredDescription
groupIdstringyesIdentifier of the HA group.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a high availability group".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.haModes​

haModes(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the deployment modes and their support. Every deployment mode with supported, ha_possible and the reason in both languages. Any signed in user.

Route: /api/v1/ha-modes (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the deployment modes and their support".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.listGroups​

listGroups(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the high availability groups. Groups of every cluster the caller may read (cluster:read), sorted by name, each with its members, its HA status and its last test run.

Route: /api/v1/ha-groups (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the high availability groups".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.operations​

operations(groupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the failover history of a group. Returns test_runs (status, fencing token, observed RTO and RPO in seconds, evidence, times), fencing_operations (member, method, verified, token) and the last 200 events. Permission cluster:read.

Route: /api/v1/ha-groups/{group_id}/operations (GET).

NameTypeDefaultRequiredDescription
groupIdstringyesIdentifier of the HA group.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the failover history of a group".

Raises: the typed errors of the transport (Errors).

AvailabilityApi.testFailover​

testFailover(groupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run a failover test. Takes the failover lease of the group, records a test run with a new fencing token and, when the group is bound to installed components, starts the failover. Answers 202 with run_id, status, fencing_token, executed and the started operations. Permission services:operate. Errors: 409 ha_operation_locked (another failover holds the lease), 409 ha_client_managed_refused. Audited as ha_group.test_failover.

Route: /api/v1/ha-groups/{group_id}/test-failover (POST).

NameTypeDefaultRequiredDescription
groupIdstringyesIdentifier of the HA group.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run a failover test".

Raises: the typed errors of the transport (Errors).

Class BackupApi​

Backup, restore and disaster recovery. The Backup & Recovery Manager: backup targets and plans, backup artefacts with their verifications, retention, restore tests, restores and disaster recovery (sites, plans, exercises, failovers, DNS and load balancer switches). Operations of this group of the Navin Manager API.

ManagerResource

BackupApi.approveExercise​

approveExercise(exerciseId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Approve a DR exercise or failover. Approves the request; the approver must not be the requester. Permission dr:manage. Errors: 403 restore_self_approval, 404 dr_exercise_not_found. Audited as dr.approve.

Route: /api/v1/dr-exercises/{exercise_id}/approve (POST).

NameTypeDefaultRequiredDescription
exerciseIdstringyesIdentifier of the exercise or failover request.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Approve a DR exercise or failover".

Raises: the typed errors of the transport (Errors).

BackupApi.approveRestore​

approveRestore(planId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Approve a restore plan. Adds the approval of the caller; two approvals by people other than the requester are needed. Permission restore:execute. Errors: 403 restore_self_approval, 409 restore_not_approvable. Audited as restore.approve.

Route: /api/v1/restores/{plan_id}/approve (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the restore plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Approve a restore plan".

Raises: the typed errors of the transport (Errors).

BackupApi.backupConsistency​

backupConsistency(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Check the consistency of a backup target. Compares the database rows, the stored objects and the artefact registry of a filesystem target (its bucket is the root directory). With reconcile, rows whose object is gone are marked missing and orphan objects are moved into a quarantine directory, never deleted. Permission backup:manage. Errors: 404 backup_target_not_found, 422 backup_provider_unsupported (not filesystem).

Route: /api/v1/backups/consistency (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noTarget, registry digests and reconcile flag.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Check the consistency of a backup target".

Raises: the typed errors of the transport (Errors).

BackupApi.completeExercise​

completeExercise(exerciseId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Complete a DR exercise with its measures. Records the observed RPO and RTO, the result and the evidence of an approved exercise or failover. Permission dr:manage; 409 dr_not_approved. Audited as dr.complete.

Route: /api/v1/dr-exercises/{exercise_id}/complete (POST).

NameTypeDefaultRequiredDescription
exerciseIdstringyesIdentifier of the exercise or failover request.
bodyunknown{}noObserved measures, result and evidence.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Complete a DR exercise with its measures".

Raises: the typed errors of the transport (Errors).

BackupApi.createDrPlan​

createDrPlan(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a DR plan. Creates a plan between a primary and a secondary site (created when unknown) and returns it (201). Permission dr:manage. Errors: 422 dr_mode_invalid, 422 dr_same_site. Audited as dr.plan.create.

Route: /api/v1/dr-plans (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noName, mode, sites, targets and sequence of the plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a DR plan".

Raises: the typed errors of the transport (Errors).

BackupApi.createPlan​

createPlan(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a backup plan. Creates a backup plan on a target and returns it (201). With immutability_required the target must have verified object lock and retention capabilities. Permission backup:manage. Errors: 404 backup_target_not_found, 409 backup_worm_unsupported. Audited as backup.plan.create.

Route: /api/v1/backup-plans (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noTarget, scope, schedule, encryption and retention of the plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a backup plan".

Raises: the typed errors of the transport (Errors).

BackupApi.createTarget​

createTarget(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Declare a backup target. Creates a target and returns it (201). Permission backup:manage; 422 backup_provider_unsupported. Audited as backup.target.create.

Route: /api/v1/backup-targets (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noProvider, location and capabilities of the target.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Declare a backup target".

Raises: the typed errors of the transport (Errors).

BackupApi.declareTraffic​

declareTraffic(planId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Declare a traffic switch of a DR plan. Declares (or replaces) a DNS record or a load balancer of the plan with its value per site and the health check that must pass before a switch (201). Permission dr:manage. Errors: 422 dr_traffic_invalid, 404 dr_plan_not_found. Audited as dr.traffic.declare.

Route: /api/v1/dr-plans/{plan_id}/traffic (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the DR plan.
bodyunknown{}noKind, name and specification of the switch.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Declare a traffic switch of a DR plan".

Raises: the typed errors of the transport (Errors).

BackupApi.deleteBackup​

deleteBackup(backupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete a backup. Deletes a backup artefact whose retention is over. Permission backup:manage. Errors: 409 backup_retention_active (before expires_at), 404 backup_artifact_not_found. Audited as backup.delete.

Route: /api/v1/backups/{backup_id} (DELETE).

NameTypeDefaultRequiredDescription
backupIdstringyesIdentifier of the backup artefact.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete a backup".

Raises: the typed errors of the transport (Errors).

BackupApi.dryRunRestore​

dryRunRestore(planId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Dry run a restore plan. Checks the digest, decryption and compatibility without writing to the destination, and returns the recorded approvers. For a named destination it also checks its identity, emptiness and restricted role (checks.destination, checks.executor). A successful dry run does not authorize execution: two approvals are still required. Permission restore:execute. Audited as restore.dry_run.

Route: /api/v1/restores/{plan_id}/dry-run (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the restore plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Dry run a restore plan".

Raises: the typed errors of the transport (Errors).

BackupApi.enforceRetention​

enforceRetention(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Apply the retention now. Removes the artefacts past their expires_at and marks them expired. Returns expired. Permission backup:manage. Audited as backup.expire.

Route: /api/v1/backups/retention/enforce (POST).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Apply the retention now".

Raises: the typed errors of the transport (Errors).

BackupApi.executeRestore​

executeRestore(planId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Execute an approved restore. Runs an approved plan with a destination: status executing and a durable execution_token are committed before any write. The artefact is checked again (size, digest, decryption), restored with pg_restore --single-transaction by the restricted role, then its rows are read back and compared with the backup inventory (result.inventory, rows, tables). Success: executed. Recorded failure: failed, rollback_performed: false, HTTP 502 restore_execution_failed; its nested result.error identifies the cause, including backup_corrupted, restore_target_busy or restore_execution_timeout. A process interruption can leave executing for manual inspection. Nothing is automatically rolled back or replayed. Pre-execution refusals include 409 restore_not_approved, 501 restore_executor_unavailable and 409 restore_target_changed. Permission restore:execute. Audited as restore.execute.started and restore.execute.

Route: /api/v1/restores/{plan_id}/execute (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the restore plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Execute an approved restore".

Raises: the typed errors of the transport (Errors).

BackupApi.getRestore​

getRestore(planId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a restore plan. Returns the plan with its compatibility, steps, approvers and required_approvals (2). Permission backup:read; 404 restore_plan_not_found.

Route: /api/v1/restores/{plan_id} (GET).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the restore plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a restore plan".

Raises: the typed errors of the transport (Errors).

BackupApi.listBackups​

listBackups(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the backups. The last 200 backup artefacts, newest first: location, SHA-256, size, versions, expiry, plan and the outcome of their last verification. Permission backup:read.

Route: /api/v1/backups (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the backups".

Raises: the typed errors of the transport (Errors).

BackupApi.listDrPlans​

listDrPlans(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the DR plans. Every disaster recovery plan with its mode, its primary and secondary sites, its RPO and RTO targets and its sequence. Permission backup:read.

Route: /api/v1/dr-plans (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the DR plans".

Raises: the typed errors of the transport (Errors).

BackupApi.listExercises​

listExercises(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the DR exercises and failovers. The last 200 exercises and failover requests with their report: status, requester, approver, observed RPO and RTO compared with the targets, evidence. Permission backup:read.

Route: /api/v1/dr-exercises (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the DR exercises and failovers".

Raises: the typed errors of the transport (Errors).

BackupApi.listJobs​

listJobs(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the backup jobs. The last 200 backup jobs, newest first, with their plan name, status and error. Permission backup:read.

Route: /api/v1/backup-jobs (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the backup jobs".

Raises: the typed errors of the transport (Errors).

BackupApi.listPlans​

listPlans(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the backup plans. Every backup plan, and alerts: the plans whose last successful backup is older than the interval plus the window, or whose last job failed. Permission backup:read.

Route: /api/v1/backup-plans (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the backup plans".

Raises: the typed errors of the transport (Errors).

BackupApi.listRestoreTargets​

listRestoreTargets(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the restore destinations. The restore destinations declared by the operator in the restore_targets setting: name, environment, kind (pg_dump) and declared versions. Connection strings and secret variable names never leave the server. Permission restore:execute.

Route: /api/v1/restore-targets (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the restore destinations".

Raises: the typed errors of the transport (Errors).

BackupApi.listRestoreTests​

listRestoreTests(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the restore tests. The last 200 restore tests with their outcome and signed report. Permission backup:read.

Route: /api/v1/restore-tests (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the restore tests".

Raises: the typed errors of the transport (Errors).

BackupApi.listRestores​

listRestores(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the restore plans. The last 200 restore plans with their status and number of approvals. Permission backup:read.

Route: /api/v1/restores (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the restore plans".

Raises: the typed errors of the transport (Errors).

BackupApi.listSites​

listSites(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the DR sites. Sites known to the disaster recovery plans, with their role (primary or secondary). Sites are created by the plans. Permission backup:read.

Route: /api/v1/dr-sites (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the DR sites".

Raises: the typed errors of the transport (Errors).

BackupApi.listTraffic​

listTraffic(planId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the traffic switches of a DR plan. DNS records and load balancers declared for the plan, with their value per site and health check. Permission backup:read.

Route: /api/v1/dr-plans/{plan_id}/traffic (GET).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the DR plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the traffic switches of a DR plan".

Raises: the typed errors of the transport (Errors).

BackupApi.listVerifications​

listVerifications(backupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the verifications of a backup. Every verification of the artefact, newest first, with its outcome (passed or failed) and details (expected and observed digest, size, reason). Permission backup:read.

Route: /api/v1/backups/{backup_id}/verifications (GET).

NameTypeDefaultRequiredDescription
backupIdstringyesIdentifier of the backup artefact.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the verifications of a backup".

Raises: the typed errors of the transport (Errors).

BackupApi.planRestore​

planRestore(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Plan a restore. Creates a restore plan for a backup artefact: checks the compatibility of the backed up versions with the target versions (same major version) and lists the steps (verify artefact, verify destination, restore, verify restored). With target_name, the artefact must be an available pg_dump with a verification_inventory and the destination an empty PostgreSQL database owned by a restricted role; its identity is frozen in target_snapshot. Returns the plan (201). Permission restore:execute. Errors: 404 backup_artifact_not_found, 501 restore_executor_unavailable (unknown destination), 409 restore_target_invalid, 409 restore_target_not_empty, 422 restore_inventory_required. Audited as restore.plan.

Route: /api/v1/restores/plan (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noArtefact, environment, destination and target versions.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Plan a restore".

Raises: the typed errors of the transport (Errors).

BackupApi.recordBackup​

recordBackup(planId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Record a backup. Records one job and its artefact: the Manager hashes the file at location, stores its digest, size and versions, and sets expires_at from the retention of the plan. When the file cannot be read the job is recorded as failed. Returns the job with its artifact (201). Permission backup:manage; 404 backup_policy_not_found. Audited as backup.job.

Route: /api/v1/backup-plans/{plan_id}/backups (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the backup plan.
bodyunknown{}noLocation, kind and versions of the artefact.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Record a backup".

Raises: the typed errors of the transport (Errors).

BackupApi.requestExercise​

requestExercise(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Request a DR exercise. Records an exercise request for a plan (201); another person must approve it before it can be completed. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.exercise.request.

Route: /api/v1/dr-exercises (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe DR plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Request a DR exercise".

Raises: the typed errors of the transport (Errors).

BackupApi.requestFailover​

requestFailover(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Request a DR failover. Records a real failover request for a plan (201); it follows the same approval and completion as an exercise. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.failover.request.

Route: /api/v1/dr-failovers/request (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe DR plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Request a DR failover".

Raises: the typed errors of the transport (Errors).

BackupApi.runRestoreTest​

runRestoreTest(backupId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run a restore test. Copies the artefact into an isolated directory, optionally injects a corruption, verifies the digest and the decryption and signs the report (Ed25519). A failure raises an audited alarm. Returns the test (201). Permission backup:manage. Audited as backup.restore_test.

Route: /api/v1/backups/{backup_id}/restore-tests (POST).

NameTypeDefaultRequiredDescription
backupIdstringyesIdentifier of the backup artefact.
bodyunknown{}noWhether to inject a corruption (to prove the test catches it).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run a restore test".

Raises: the typed errors of the transport (Errors).

BackupApi.setDrTargets​

setDrTargets(planId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Set the RPO and RTO targets of a DR plan. Sets your own recovery objectives (seconds, or null to clear); the product never proposes them. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.plan.targets.

Route: /api/v1/dr-plans/{plan_id}/targets (PUT).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the DR plan.
bodyunknown{}noRPO and RTO targets.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Set the RPO and RTO targets of a DR plan".

Raises: the typed errors of the transport (Errors).

BackupApi.trafficSwitchPlan​

trafficSwitchPlan(planId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Plan a traffic switch to a site. Runs the health checks of the declared switches against the target site (real HTTP requests) and returns the ordered DNS and load balancer changes. Nothing is applied: applying needs the API of your DNS and load balancer (status requires_client_provider). Permission dr:manage.

Route: /api/v1/dr-plans/{plan_id}/switch-plan (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the DR plan.
bodyunknown{}noSite to switch the traffic to.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Plan a traffic switch to a site".

Raises: the typed errors of the transport (Errors).

BackupApi.verifyBackup​

verifyBackup(backupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Verify a backup. Hashes the file again, compares digest and size with the recorded ones and, when they match, decrypts it with its key. Returns the verification with its outcome (passed or failed). Permission backup:manage; 404 backup_artifact_not_found. Audited as backup.verify.

Route: /api/v1/backups/{backup_id}/verify (POST).

NameTypeDefaultRequiredDescription
backupIdstringyesIdentifier of the backup artefact.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Verify a backup".

Raises: the typed errors of the transport (Errors).

Class BackupsApi​

Backup, restore and disaster recovery. The Backup & Recovery Manager: backup targets and plans, backup artefacts with their verifications, retention, restore tests, restores and disaster recovery (sites, plans, exercises, failovers, DNS and load balancer switches). Operations of this group of the Navin Manager API.

ManagerResource

BackupsApi.createPlan​

createPlan(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a backup plan. Creates a backup plan on a target and returns it (201). With immutability_required the target must have verified object lock and retention capabilities. Permission backup:manage. Errors: 404 backup_target_not_found, 409 backup_worm_unsupported. Audited as backup.plan.create.

Route: /api/v1/backup-plans (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noTarget, scope, schedule, encryption and retention of the plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a backup plan".

Raises: the typed errors of the transport (Errors).

BackupsApi.list​

list(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the backups. The last 200 backup artefacts, newest first: location, SHA-256, size, versions, expiry, plan and the outcome of their last verification. Permission backup:read.

Route: /api/v1/backups (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the backups".

Raises: the typed errors of the transport (Errors).

BackupsApi.run​

run(planId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Record a backup. Records one job and its artefact: the Manager hashes the file at location, stores its digest, size and versions, and sets expires_at from the retention of the plan. When the file cannot be read the job is recorded as failed. Returns the job with its artifact (201). Permission backup:manage; 404 backup_policy_not_found. Audited as backup.job.

Route: /api/v1/backup-plans/{plan_id}/backups (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the backup plan.
bodyunknown{}noLocation, kind and versions of the artefact.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Record a backup".

Raises: the typed errors of the transport (Errors).

BackupsApi.verify​

verify(backupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Verify a backup. Hashes the file again, compares digest and size with the recorded ones and, when they match, decrypts it with its key. Returns the verification with its outcome (passed or failed). Permission backup:manage; 404 backup_artifact_not_found. Audited as backup.verify.

Route: /api/v1/backups/{backup_id}/verify (POST).

NameTypeDefaultRequiredDescription
backupIdstringyesIdentifier of the backup artefact.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Verify a backup".

Raises: the typed errors of the transport (Errors).

Class BlueprintApi​

Blueprints. A blueprint describes the services of a cluster in a portable form, to rebuild the same platform on another cluster: the services with their mode, method, non secret configuration and bindings, and host groups (sets of components that run together, with their number of hosts). Its shape: Operations of this group of the Navin Manager API.

ManagerResource

BlueprintApi.applyBlueprint​

applyBlueprint(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Apply a blueprint to a cluster. Turns the blueprint and the host mapping into install requests and creates one install operation (type blueprint.apply), with the same checks as a service install. Returns operation_id and the ha checks. Permissions cluster:manage and services:install. Errors: 422 blueprint_invalid (with details.errors), and the errors of an install. Audited as blueprint.apply.

Route: /api/v1/clusters/{cluster_id}/blueprint/apply (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noBlueprint, host mapping and install options.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Apply a blueprint to a cluster".

Raises: the typed errors of the transport (Errors).

BlueprintApi.exportBlueprint​

exportBlueprint(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Export the blueprint of a cluster. Returns the blueprint of the cluster: its managed services with their non secret configuration (secrets are never exported) and host groups built from the components that run together; hosts of a group lists the hosts of this cluster for information. Permission cluster:manage.

Route: /api/v1/clusters/{cluster_id}/blueprint (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Export the blueprint of a cluster".

Raises: the typed errors of the transport (Errors).

BlueprintApi.validateBlueprint​

validateBlueprint(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Validate a blueprint for a cluster. Checks the shape of the blueprint and, when a host_mapping is given, the mapping and the resulting install requests. Returns ok and errors (each with service, field, code, message_i18n). Nothing is changed. Permission cluster:manage.

Route: /api/v1/clusters/{cluster_id}/blueprint/validate (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noBlueprint and optional host mapping.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Validate a blueprint for a cluster".

Raises: the typed errors of the transport (Errors).

Class ClustersApi​

Platform Manager clusters operations.

ManagerResource

ClustersApi.createCluster​

createCluster(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a cluster. Creates an empty cluster on the current catalog version and returns it (201). Without a profile, production and preprod clusters get standard, the other modes development. Permission clusters:create; 409 cluster_name_taken (names are case insensitive). Audited as cluster.create.

Route: /api/v1/clusters (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noName, mode, description and profile of the cluster.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.createToken​

createToken(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a bootstrap token for new hosts. Creates a token that lets agents register in this cluster and returns id, token (shown only here), expires_at, register_command (the nm-agent register command with the server URL, the token and the fingerprint of the CA) and install_command (a script that installs the agent from the mirror and registers it). Answers 201. Permission hosts:manage. Audited as bootstrap_token.create.

Route: /api/v1/clusters/{cluster_id}/bootstrap-tokens (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noLifetime and number of uses of the token.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a bootstrap token for new hosts".

Raises: the typed errors of the transport (Errors).

ClustersApi.deleteCluster​

deleteCluster(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete an empty cluster. Deletes a cluster that has no service and no host other than decommissioned ones. Answers 204. Permission cluster:manage. Errors: 404 cluster_not_found, 409 cluster_not_empty. Audited as cluster.delete.

Route: /api/v1/clusters/{cluster_id} (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete an empty cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.getCluster​

getCluster(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a cluster. Returns the cluster. Permission cluster:read; 404 cluster_not_found.

Route: /api/v1/clusters/{cluster_id} (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.importKubernetes​

importKubernetes(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Register a Kubernetes cluster. Checks the kubeconfig against the API server given, calls /version, seals the kubeconfig and turns the cluster into a Kubernetes cluster. The cluster must have no host. Returns the target (201). Permission cluster:manage. Errors: 409 k8s_already_registered, 409 k8s_cluster_has_hosts, kubeconfig guard and API errors. Audited as k8s.cluster.register.

Route: /api/v1/clusters/{cluster_id}/kubernetes (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noAPI server, kubeconfig and namespace.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Register a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.listClusters​

listClusters(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the clusters. Clusters the caller may read (cluster:read globally or on the cluster), sorted by name: id, name, mode, description, stack_version, profile, kind (hosts or kubernetes), created_at, updated_at.

Route: /api/v1/clusters (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the clusters".

Raises: the typed errors of the transport (Errors).

ClustersApi.listTokens​

listTokens(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the bootstrap tokens of a cluster. Tokens of the cluster, newest first, with prefix, expires_at, max_uses, uses, created_at and revoked_at; the secret is never returned. Permission hosts:manage.

Route: /api/v1/clusters/{cluster_id}/bootstrap-tokens (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the bootstrap tokens of a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.patchCluster​

patchCluster(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Rename a cluster or change its profile. Changes the name, the description or the profile; a field left out is kept. Returns the cluster. Permission cluster:manage. Errors: 404 cluster_not_found, 409 cluster_name_taken. Audited as cluster.update.

Route: /api/v1/clusters/{cluster_id} (PATCH).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noFields of the cluster to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Rename a cluster or change its profile".

Raises: the typed errors of the transport (Errors).

ClustersApi.register​

register(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a cluster. Creates an empty cluster on the current catalog version and returns it (201). Without a profile, production and preprod clusters get standard, the other modes development. Permission clusters:create; 409 cluster_name_taken (names are case insensitive). Audited as cluster.create.

Route: /api/v1/clusters (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noName, mode, description and profile of the cluster.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.revokeToken​

revokeToken(clusterId: string, tokenId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Revoke a bootstrap token. Revokes the token: no new agent can register with it; hosts already registered are not affected. Answers 204. Permission hosts:manage; 404 bootstrap_token_not_found (unknown or already revoked). Audited as bootstrap_token.revoke.

Route: /api/v1/clusters/{cluster_id}/bootstrap-tokens/{token_id} (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
tokenIdstringyesIdentifier of the bootstrap token.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Revoke a bootstrap token".

Raises: the typed errors of the transport (Errors).

ClustersApi.status​

status(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the summary of a cluster. Counters for the home page of a cluster: hosts by state, services by state and by health, open alerts (critical, warning) and running operations. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/summary (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the summary of a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.summary​

summary(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the summary of a cluster. Counters for the home page of a cluster: hosts by state, services by state and by health, open alerts (critical, warning) and running operations. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/summary (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the summary of a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.topology​

topology(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the topology of a cluster. Hosts (id, hostname, state, rack) and component instances (service, component, host_id, state, health) of the cluster, to draw where every component runs. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/topology (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the topology of a cluster".

Raises: the typed errors of the transport (Errors).

ClustersApi.validate​

validate(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run the installation preflight of a cluster. Every check that must pass before a service is installed or upgraded, with its severity, evidence and a blocking verdict: host facts, DNS, catalog preflight entries, firewall, capacity, versions, TLS and profile rules. A check in fail blocks. Nothing is changed. Permission services:install.

Route: /api/v1/clusters/{cluster_id}/preflight (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noServices and hosts to check.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run the installation preflight of a cluster".

Raises: the typed errors of the transport (Errors).

Class ConfigsApi​

Configurations. The configuration of a managed service: its parameters (declared by the catalog with their types, defaults and sections), saved as numbered versions, with config groups that override values on some hosts. Operations of this group of the Navin Manager API.

ManagerResource

ConfigsApi.apply​

apply(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Apply the configuration to the hosts. Starts the operation that writes the current configuration to the hosts and restarts the components as asked (rolling by batch_size, all, or none). Returns operation_id. Permission configs:edit. Under banking-secure an approval is needed (409 approval_required). Audited as config.apply.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/apply (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noRestart policy of the apply.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Apply the configuration to the hosts".

Raises: the typed errors of the transport (Errors).

ConfigsApi.createGroup​

createGroup(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a config group. Creates a group of hosts with values that override the service configuration on them. A host belongs to one group at most. Permission configs:edit. Errors: 409 config_group_name_taken, 409 config_group_host_conflict, 422 config_group_host_invalid, 422 config_invalid. Audited as config_group.create.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/groups (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noName, hosts and overrides of the group.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a config group".

Raises: the typed errors of the transport (Errors).

ConfigsApi.deleteGroup​

deleteGroup(clusterId: string, service: string, groupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete a config group. Deletes the group; its hosts fall back to the service configuration at the next apply. Answers 204. Permission configs:edit; 404 config_group_not_found. Audited as config_group.delete.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/groups/{group_id} (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
groupIdstringyesIdentifier of the config group.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete a config group".

Raises: the typed errors of the transport (Errors).

ConfigsApi.diff​

diff(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Compare two configuration versions. Lists the parameters whose value differs between the two versions, each with param, secret, from and to; for a secret only whether it is set is shown. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/diff (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Compare two configuration versions".

Raises: the typed errors of the transport (Errors).

ConfigsApi.getConfig​

getConfig(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the configuration of a service. Returns the current version, the effective properties (defaults merged, secrets masked), the parameter definitions params and sections of the catalog, the recommendations computed for the hosts, the config groups and the stale_hosts. Permission configs:read; 409 service_unmanaged for a service the Manager does not manage.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the configuration of a service".

Raises: the typed errors of the transport (Errors).

ConfigsApi.getVersion​

getVersion(clusterId: string, service: string, version: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a configuration version. Returns the values of one version (secrets masked) with its note and author. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/versions/{version} (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
versionstringyesVersion number, starting at 1.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a configuration version".

Raises: the typed errors of the transport (Errors).

ConfigsApi.listGroups​

listGroups(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the config groups of a service. Every config group with its id, name, hosts, overrides (secrets masked) and updated_at. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/groups (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the config groups of a service".

Raises: the typed errors of the transport (Errors).

ConfigsApi.listVersions​

listVersions(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Page<Doc>>

List the configuration versions. Versions of the configuration, newest first: version, note, restored_from, secret_keys, created_by, created_at. Paginated with limit and cursor. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/versions (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Page<Doc>>. Decoded JSON answer of the operation "List the configuration versions".

Raises: the typed errors of the transport (Errors).

ConfigsApi.preview​

preview(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Preview the files of a component instance. Renders the configuration files one instance would receive with the current version and its groups: path, mode, owner, group, content, secrets redacted. Nothing is written. Permission configs:read; 404 host_component_not_found.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/preview (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Preview the files of a component instance".

Raises: the typed errors of the transport (Errors).

ConfigsApi.putConfig​

putConfig(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Save a new configuration version. Merges the properties sent over the current values, validates them against the parameter definitions and saves a new version. Returns version and stale_hosts. Permission configs:edit. Errors: 422 config_invalid (with the fields), 409 service_unmanaged. Audited as config.update (parameter names only).

Route: /api/v1/clusters/{cluster_id}/services/{service}/config (PUT).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noChanged properties and a note.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Save a new configuration version".

Raises: the typed errors of the transport (Errors).

ConfigsApi.restore​

restore(clusterId: string, service: string, version: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Restore a configuration version. Saves the values of an old version as a new version (note restore of version N) and returns version and stale_hosts; apply it to reach the hosts. Permission configs:edit. Audited as config.restore.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/versions/{version}/restore (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
versionstringyesVersion number to restore.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Restore a configuration version".

Raises: the typed errors of the transport (Errors).

ConfigsApi.updateGroup​

updateGroup(clusterId: string, service: string, groupId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update a config group. Replaces the name, hosts and overrides of the group. Permission configs:edit. Errors: 404 config_group_not_found, 409 config_group_name_taken, 409 config_group_host_conflict, 422 config_group_host_invalid. Audited as config_group.update.

Route: /api/v1/clusters/{cluster_id}/services/{service}/config/groups/{group_id} (PUT).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
groupIdstringyesIdentifier of the config group.
bodyunknown{}noName, hosts and overrides of the group.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update a config group".

Raises: the typed errors of the transport (Errors).

Class ConnectionsApi​

External connections. Connections to systems outside the clusters that services can use: databases (PostgreSQL, MySQL, ClickHouse), search engines (Elasticsearch, OpenSearch, Qdrant), messaging (Kafka, NATS, Redis), S3 object storage, LDAP and OIDC directories, SMTP, syslog and plain HTTP endpoints. A service binds to a connection through its bindings (kind connection). Operations of this group of the Navin Manager API.

ManagerResource

ConnectionsApi.createConnection​

createConnection(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a connection. Saves a connection and returns it (201). Permission connections:manage. Errors: 409 connection_name_taken, 422 connection_params_invalid (fields in details.fields). Audited as connection.create.

Route: /api/v1/connections (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noName, type, parameters and secret of the connection.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.deleteConnection​

deleteConnection(connectionId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete a connection. Deletes a connection no service is bound to. Answers 204. Permission connections:manage. Errors: 404 connection_not_found, 409 connection_in_use (services in details.services). Audited as connection.delete.

Route: /api/v1/connections/{connection_id} (DELETE).

NameTypeDefaultRequiredDescription
connectionIdstringyesIdentifier of the connection.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete a connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.getConnection​

getConnection(connectionId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a connection. Returns one connection, its secret masked. Permission connections:read; 404 connection_not_found.

Route: /api/v1/connections/{connection_id} (GET).

NameTypeDefaultRequiredDescription
connectionIdstringyesIdentifier of the connection.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.listConnections​

listConnections(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Page<Doc>>

List the external connections. Connections sorted by name: id, name, type, params, secret (set or not), description, last_test, created_at, updated_at. Paginated with limit and cursor. Permission connections:read.

Route: /api/v1/connections (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Page<Doc>>. Decoded JSON answer of the operation "List the external connections".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.patchConnection​

patchConnection(connectionId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update a connection. Changes the fields given; the type cannot change. Returns the connection. Permission connections:manage. Errors: 404 connection_not_found, 409 connection_name_taken, 422 connection_params_invalid. Audited as connection.update.

Route: /api/v1/connections/{connection_id} (PATCH).

NameTypeDefaultRequiredDescription
connectionIdstringyesIdentifier of the connection.
bodyunknown{}noFields of the connection to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update a connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.testConnection​

testConnection(connectionId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Test a saved connection. Runs the protocol test with the stored parameters and secret, stores the result with its time in last_test and returns it (ok, error_code, latency_ms...). Permission connections:manage; 404 connection_not_found. Audited as connection.test.

Route: /api/v1/connections/{connection_id}/test (POST).

NameTypeDefaultRequiredDescription
connectionIdstringyesIdentifier of the connection.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Test a saved connection".

Raises: the typed errors of the transport (Errors).

ConnectionsApi.validateConnection​

validateConnection(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Test a connection before saving it. Dry run: checks the parameters of the type, then runs the real protocol test with the given secret. Returns the test result (ok, error_code, latency_ms...). Nothing is stored; the secret is never sent back nor audited. Permission connections:manage. Audited as connection.validate.

Route: /api/v1/connections/validate (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noType, parameters and secret to test.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Test a connection before saving it".

Raises: the typed errors of the transport (Errors).

Class ConsolesApi​

Service consoles. The local web interfaces of the installed services (for example the administration console of Keycloak or of a message broker), opened from the Manager. Operations of this group of the Navin Manager API.

ManagerResource

ConsolesApi.listConsoles​

listConsoles(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the service consoles of a cluster. Every console of the catalog with its state on the cluster: installed or not, health, internal address, compliance checks, whether the caller may open it and, for the vault administrators, the vault entry holding its credentials. Services without a web interface are listed apart with their HTTP endpoints. Permission services:operate. Audited as consoles.list.

Route: /api/v1/clusters/{cluster_id}/consoles (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the service consoles of a cluster".

Raises: the typed errors of the transport (Errors).

ConsolesApi.openConsole​

openConsole(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Open a service console. Returns url, the checks and compliant. Needs services:operate and the permission of the console (vault:manage for an identity or secrets console). Errors: 404 console_unknown, 409 console_not_installed, 409 console_no_url, 409 console_not_compliant (production or pre-production). Audited as console.open.

Route: /api/v1/clusters/{cluster_id}/consoles/{service}/open (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Open a service console".

Raises: the typed errors of the transport (Errors).

ConsolesApi.putAccess​

putAccess(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Publish the internal address of a console. Sets the internal address of the console (behind the HTTPS gateway of the bank) and its protection; both null go back to the discovered address. Returns the console; the vault entry of the service is updated with the new address. Permission cluster:manage; 422 console_url_invalid. Audited as console.access.

Route: /api/v1/clusters/{cluster_id}/consoles/{service}/access (PUT).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noPublished address and protection.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Publish the internal address of a console".

Raises: the typed errors of the transport (Errors).

ConsolesApi.rotateCredentials​

rotateCredentials(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Rotate the password of a console account. Sets a new password (generated when omitted) for the console account read from the configuration: creates a new configuration version and starts the apply operation; the vault entry follows when the apply succeeds. Answers 202 with operation_id and version. The password is never logged. Permissions configs:edit and vault:manage. Errors: 409 console_no_credential, 409 console_rotation_manual, 409 service_unmanaged, 422 config_invalid. Audited as console.credentials.rotate.

Route: /api/v1/clusters/{cluster_id}/consoles/{service}/credentials/rotate (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noNew password and restart policy.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Rotate the password of a console account".

Raises: the typed errors of the transport (Errors).

Class DRApi​

Backup, restore and disaster recovery. The Backup & Recovery Manager: backup targets and plans, backup artefacts with their verifications, retention, restore tests, restores and disaster recovery (sites, plans, exercises, failovers, DNS and load balancer switches). Operations of this group of the Navin Manager API.

ManagerResource

DRApi.approve​

approve(exerciseId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Approve a DR exercise or failover. Approves the request; the approver must not be the requester. Permission dr:manage. Errors: 403 restore_self_approval, 404 dr_exercise_not_found. Audited as dr.approve.

Route: /api/v1/dr-exercises/{exercise_id}/approve (POST).

NameTypeDefaultRequiredDescription
exerciseIdstringyesIdentifier of the exercise or failover request.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Approve a DR exercise or failover".

Raises: the typed errors of the transport (Errors).

DRApi.complete​

complete(exerciseId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Complete a DR exercise with its measures. Records the observed RPO and RTO, the result and the evidence of an approved exercise or failover. Permission dr:manage; 409 dr_not_approved. Audited as dr.complete.

Route: /api/v1/dr-exercises/{exercise_id}/complete (POST).

NameTypeDefaultRequiredDescription
exerciseIdstringyesIdentifier of the exercise or failover request.
bodyunknown{}noObserved measures, result and evidence.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Complete a DR exercise with its measures".

Raises: the typed errors of the transport (Errors).

DRApi.listPlans​

listPlans(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the DR plans. Every disaster recovery plan with its mode, its primary and secondary sites, its RPO and RTO targets and its sequence. Permission backup:read.

Route: /api/v1/dr-plans (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the DR plans".

Raises: the typed errors of the transport (Errors).

DRApi.plan​

plan(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a DR plan. Creates a plan between a primary and a secondary site (created when unknown) and returns it (201). Permission dr:manage. Errors: 422 dr_mode_invalid, 422 dr_same_site. Audited as dr.plan.create.

Route: /api/v1/dr-plans (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noName, mode, sites, targets and sequence of the plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a DR plan".

Raises: the typed errors of the transport (Errors).

DRApi.requestFailover​

requestFailover(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Request a DR failover. Records a real failover request for a plan (201); it follows the same approval and completion as an exercise. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.failover.request.

Route: /api/v1/dr-failovers/request (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe DR plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Request a DR failover".

Raises: the typed errors of the transport (Errors).

DRApi.status​

status(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the DR exercises and failovers. The last 200 exercises and failover requests with their report: status, requester, approver, observed RPO and RTO compared with the targets, evidence. Permission backup:read.

Route: /api/v1/dr-exercises (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the DR exercises and failovers".

Raises: the typed errors of the transport (Errors).

DRApi.test​

test(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Request a DR exercise. Records an exercise request for a plan (201); another person must approve it before it can be completed. Permission dr:manage; 404 dr_plan_not_found. Audited as dr.exercise.request.

Route: /api/v1/dr-exercises (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe DR plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Request a DR exercise".

Raises: the typed errors of the transport (Errors).

Class HAApi​

High availability groups. A high availability group describes how one component of a cluster stays available: its HA mode (single, active_passive, active_active, quorum), its profile (standalone, ha with at least 2 replicas in 2 fault domains, critical-ha with at least 3 in 3), its members and their fault domains, its failover policy and its recovery objectives (RTO, RPO). The group reports its HA status from the heartbeats of its members. Operations of this group of the Navin Manager API.

ManagerResource

HAApi.list​

list(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the high availability groups. Groups of every cluster the caller may read (cluster:read), sorted by name, each with its members, its HA status and its last test run.

Route: /api/v1/ha-groups (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the high availability groups".

Raises: the typed errors of the transport (Errors).

HAApi.plan​

plan(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a high availability group. Declares a group and its members and returns it (201). The profile must be met by desired_replicas and fault_domains, two members cannot share a host. Permission cluster:manage on the cluster. Errors: 422 ha_profile_unmet, 422 ha_mode_unsupported, 422 ha_members_same_host, 404 cluster_not_found, 404 host_not_found. Audited as ha_group.create.

Route: /api/v1/ha-groups (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe group, its policy and its members.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a high availability group".

Raises: the typed errors of the transport (Errors).

HAApi.status​

status(groupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a high availability group. Returns the group with its members, its HA status and its last test run. Permission cluster:read on its cluster; 404 ha_group_not_found.

Route: /api/v1/ha-groups/{group_id} (GET).

NameTypeDefaultRequiredDescription
groupIdstringyesIdentifier of the HA group.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a high availability group".

Raises: the typed errors of the transport (Errors).

HAApi.testFailover​

testFailover(groupId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run a failover test. Takes the failover lease of the group, records a test run with a new fencing token and, when the group is bound to installed components, starts the failover. Answers 202 with run_id, status, fencing_token, executed and the started operations. Permission services:operate. Errors: 409 ha_operation_locked (another failover holds the lease), 409 ha_client_managed_refused. Audited as ha_group.test_failover.

Route: /api/v1/ha-groups/{group_id}/test-failover (POST).

NameTypeDefaultRequiredDescription
groupIdstringyesIdentifier of the HA group.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run a failover test".

Raises: the typed errors of the transport (Errors).

Class HostsApi​

Platform Manager hosts operations.

ManagerResource

HostsApi.bootstrap​

bootstrap(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Bootstrap a node agent over SSH. Starts an operation that installs and registers the agent on one host:

Route: /api/v1/hosts/bootstrap (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noTarget host, jump hosts, SSH account, private key or certificate.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Bootstrap a node agent over SSH".

Raises: the typed errors of the transport (Errors).

HostsApi.bootstrapPlan​

bootstrapPlan(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Preview the bootstrap of a node agent. Checks the credential against the SSH policy and returns the plan without connecting: SSH user, target, jumps, credential verdict, the sudoers file and its validation, the allowlist, the systemd unit and the staging directory. Permission hosts:manage; 422 ssh_policy_refused.

Route: /api/v1/hosts/bootstrap/plan (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noSame body as a bootstrap.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Preview the bootstrap of a node agent".

Raises: the typed errors of the transport (Errors).

HostsApi.decommission​

decommission(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Decommission a host. Starts an operation in two stages: the agent runs its decommission task, then the Manager marks the host decommissioned and revokes its certificates. The host must have no component left. Answers 202 with operation_id. Permission hosts:manage; 409 host_has_components. Audited as host.decommission.

Route: /api/v1/hosts/{host_id}/decommission (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Decommission a host".

Raises: the typed errors of the transport (Errors).

HostsApi.deleteHost​

deleteHost(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete a host. Removes the host from the Manager and revokes its agent certificates, without contacting the agent (use decommission to clean the machine). Answers 204. Permission hosts:manage. Errors: 404 host_not_found, 409 host_has_components. Audited as host.delete.

Route: /api/v1/hosts/{host_id} (DELETE).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete a host".

Raises: the typed errors of the transport (Errors).

HostsApi.diagnostics​

diagnostics(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the inventory of a host. Returns host_id, the inventory reconciled from the agent facts (hardware, GPUs, platform) and updated_at. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/inventory (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the inventory of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.discover​

discover(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the hosts of every cluster. Hosts of every cluster the caller may read (or of one cluster), sorted by FQDN, with their trust state, management mode, identity, metrics, inventory and platform.

Route: /api/v1/hosts (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the hosts of every cluster".

Raises: the typed errors of the transport (Errors).

HostsApi.enroll​

enroll(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Issue an enrollment token for one agent key. Issues a single use token for one host and one key: host_fingerprint is the SHA-256 (hex) of the public key of the agent (nm-agent prints it before enrolling). The token expires after at most 15 minutes and is consumed by the first enrollment that presents a CSR of that exact key. Returns id, token, expires_at, ttl_s, host_fingerprint and agent_url (201). Permission hosts:manage. Audited as host.enroll_token.

Route: /api/v1/hosts/enroll (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noCluster, FQDN and key fingerprint of the host.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Issue an enrollment token for one agent key".

Raises: the typed errors of the transport (Errors).

HostsApi.getHost​

getHost(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a host with its facts. Returns the host with the full facts reported by its agent. Permission cluster:read on its cluster; 404 host_not_found.

Route: /api/v1/hosts/{host_id} (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a host with its facts".

Raises: the typed errors of the transport (Errors).

HostsApi.getParameters​

getParameters(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the kernel parameters of a host. The sysctl settings and the resource limits (nofile, nproc, memlock) of the host, each with its current value (reported by the agent), its desired value (set with PUT) and its recommended value (from the installed services), plus the firewall backend and the ports in use. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/parameters (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the kernel parameters of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.health​

health(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a node agent. The node view plus its last 10 certificates and diagnostics (facts, last metrics, last 20 receipts). Permission cluster:read; 404 host_not_found.

Route: /api/v1/agents/nodes/{host_id} (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a node agent".

Raises: the typed errors of the transport (Errors).

HostsApi.hostComponents​

hostComponents(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the components of a host. Component instances placed on the host: service, component, desired_state, state, health and its details, version, config_version, stale_config (the configuration changed since the last restart), maintenance, pid, since, updated_at. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/components (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the components of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.hostMetrics​

hostMetrics(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Read the metrics of a host. Time series of the host over [from, to] (default: the last hour) in buckets of step seconds: cpu_pct, mem_used_mb, load1, disk_pct, net_rx, net_tx, each a list of [time, value]. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/metrics (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Read the metrics of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.listHosts​

listHosts(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the hosts of a cluster. Hosts of the cluster sorted by hostname, with their state, operating system, resources, labels, components, open alerts, agent version, certificate expiry, latest metrics and network rates. Permission cluster:read; 404 cluster_not_found.

Route: /api/v1/clusters/{cluster_id}/hosts (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the hosts of a cluster".

Raises: the typed errors of the transport (Errors).

HostsApi.patchHost​

patchHost(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update the rack, labels or maintenance of a host. Changes the fields given and returns the host. Turning maintenance on moves the host to the maintenance state, turning it off brings it back to healthy. Permission hosts:manage; 422 host_environment_unknown. Audited as host.update.

Route: /api/v1/hosts/{host_id} (PATCH).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noFields of the host to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update the rack, labels or maintenance of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.preflight​

preflight(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run the preflight of a host before its bootstrap. Reads the host over SSH and from the Manager (DNS forward and reverse, TCP reachability, required ports free, disks, operating system) and returns the checks graded pass, warning or blocking, the blocking and warnings counts, a reproducible digest and the credential verdict. Nothing is installed. Permission hosts:manage. Errors: 422 ssh_policy_refused. Audited as host.preflight.

Route: /api/v1/hosts/preflight (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noSSH access, expected identity, ports and disks to check.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run the preflight of a host before its bootstrap".

Raises: the typed errors of the transport (Errors).

HostsApi.preflightResults​

preflightResults(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the preflight results of a host. Result of every preflight check of the host (check, status, message_i18n, details, checked_at), evaluated from its last facts. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/preflight (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the preflight results of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.putParameters​

putParameters(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Apply kernel parameters to a host. Stores the sysctl settings and resource limits and starts an operation that writes them to /etc/sysctl.d/90-navin-manager.conf and /etc/security/limits.d/90-navin-manager.conf. Answers 202 with operation_id. Permission hosts:manage. Errors: 422 validation_error (invalid key or empty request), 409 host_rootless (agent without root rights). Audited as host.parameters.

Route: /api/v1/hosts/{host_id}/parameters (PUT).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noSysctl settings and resource limits.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Apply kernel parameters to a host".

Raises: the typed errors of the transport (Errors).

HostsApi.refreshFacts​

refreshFacts(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Collect the facts of a host again. Starts an operation where the agent collects and reports its facts again (the preflight checks are evaluated on them). Answers 202 with operation_id. Permission hosts:manage. Audited as host.facts_refresh.

Route: /api/v1/hosts/{host_id}/facts/refresh (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Collect the facts of a host again".

Raises: the typed errors of the transport (Errors).

HostsApi.revoke​

revoke(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Revoke the agent of a host. Sets the trust state to revoked, revokes the certificates of the agent and expires its pending commands. Only a new enrollment brings it back. Returns the node. Permission hosts:manage. Audited as host.revoke with the number of certificates revoked.

Route: /api/v1/hosts/{host_id}/revoke (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noReason of the change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Revoke the agent of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.runPreflight​

runPreflight(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run the preflight checks of a host. Starts an operation that collects fresh facts; the preflight checks are evaluated when they arrive. Read the results with GET /hosts/{host_id}/preflight. Answers 202 with operation_id. Permission hosts:manage. Audited as host.preflight.

Route: /api/v1/hosts/{host_id}/preflight (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run the preflight checks of a host".

Raises: the typed errors of the transport (Errors).

HostsApi.sshBootstrap​

sshBootstrap(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Install agents over SSH. Starts an operation with one task per host: the Manager connects over SSH (the host key must match the fingerprint given), installs the agent and registers it with a bootstrap token created for this operation (valid 2 hours, one use per host). The private key is kept in memory for the tasks only, never stored nor logged. A failed host does not stop the others. Answers 202 with operation_id. Permission hosts:manage. Errors: 422 validation_error (invalid name or missing fingerprint), 404 cluster_not_found. Audited as host.ssh_bootstrap.

Route: /api/v1/clusters/{cluster_id}/hosts/ssh-bootstrap (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noHosts, SSH account, private key and host key fingerprints.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Install agents over SSH".

Raises: the typed errors of the transport (Errors).

Class HubApi​

Navin Trusted Hub. Client of the Navin Trusted Hub: the Manager fetches (online) or imports (offline) the signed distribution document of the customer, verifies it, keeps its targets (approved packages and images with their digests) and feeds the mirror with the approved images. Operations of this group of the Navin Manager API.

ManagerResource

HubApi.getStatus​

getStatus(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the Hub status. Returns configured, the public settings (the token is never returned), the state of the last accepted document and a packages_summary. Permission system:read.

Route: /api/v1/hub (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the Hub status".

Raises: the typed errors of the transport (Errors).

HubApi.importOffline​

importOffline(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Import a distribution document offline. Verifies and stores a signed document brought on removable media (air-gapped site). Needs the customer and the pinned keys in the settings. Returns metadata_version, targets, images_loaded and changes. Permission settings:manage; 422 hub_document_invalid when a check fails. Audited as hub.import.

Route: /api/v1/hub/import (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe signed distribution document, as JSON.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Import a distribution document offline".

Raises: the typed errors of the transport (Errors).

HubApi.listPackages​

listPackages(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the approved packages. Targets of the accepted document (project, name, version, image, revocation), each with whether it is the latest approved version and whether it is installed on a cluster. Returns items. Permission system:read.

Route: /api/v1/hub/packages (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the approved packages".

Raises: the typed errors of the transport (Errors).

HubApi.putSettings​

putSettings(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Save the Hub settings. Saves the connection to the Hub and returns the status. The token is sealed; leave it null to keep the stored one. Permission settings:manage; 422 hub_document_invalid when trusted_keys_pem holds no Ed25519 public key. Audited as hub.settings (key identifiers only).

Route: /api/v1/hub/settings (PUT).

NameTypeDefaultRequiredDescription
bodyunknown{}noHub address, customer, keys and token.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Save the Hub settings".

Raises: the typed errors of the transport (Errors).

HubApi.sync​

sync(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Sync with the Hub. Downloads the document of the customer from the Hub, verifies and stores it. Needs the URL, the customer and the pinned keys in the settings. Returns metadata_version, targets, images_loaded and changes. Permission settings:manage. Audited as hub.sync.

Route: /api/v1/hub/sync (POST).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Sync with the Hub".

Raises: the typed errors of the transport (Errors).

Class KubernetesApi​

Kubernetes clusters. A cluster of the Manager can be a Kubernetes cluster instead of a set of hosts. The Manager talks to it through its API server only (never over SSH) with a sealed kubeconfig, and runs catalog services there as ManagedComponent resources of the group platform.navin.ai: it writes the desired state (server side apply, field manager navin-manager), the Navin Platform Operator applies the charts, and every answer about a component is read from the status of its resource. The Navin Cluster Agent, deployed in the cluster, receives signed commands and reports back. Operations of this group of the Navin Manager API.

ManagerResource

KubernetesApi.agentManifests​

agentManifests(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the manifests of the cluster agent. ServiceAccount, RBAC and Deployment of the cluster agent for the managed namespace, as objects (manifests) and as YAML (yaml) ready for kubectl apply. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent/manifests (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the manifests of the cluster agent".

Raises: the typed errors of the transport (Errors).

KubernetesApi.componentAction​

componentAction(clusterId: string, name: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run an action on a Kubernetes component. Changes the desired state: start, stop, restart or rolling_restart (a restart timestamp), scale (fixed replicas or autoscaling, never below the disruption budget) or maintenance (enabled). Answers 202 with component and requested. Permission services:operate. Errors: 409 k8s_maintenance, 409 k8s_component_stopped, 409 k8s_replicas_below_pdb. Audited as k8s.component.<action>.

Route: /api/v1/clusters/{cluster_id}/kubernetes/components/{name}/actions (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
namestringyesName of the component.
bodyunknown{}noAction and its arguments.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run an action on a Kubernetes component".

Raises: the typed errors of the transport (Errors).

KubernetesApi.configureComponent​

configureComponent(clusterId: string, name: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Configure a Kubernetes component. Changes the version, source, values, secret references or disruption budget of the component (server side apply). Values that look like secrets are refused: use secret_refs. Permission configs:edit. Errors: 422 k8s_values_secret, 409 k8s_maintenance, 404 k8s_component_not_found. Audited as k8s.component.configure (field names only).

Route: /api/v1/clusters/{cluster_id}/kubernetes/components/{name} (PATCH).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
namestringyesName of the component.
bodyunknown{}noFields of the component to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Configure a Kubernetes component".

Raises: the typed errors of the transport (Errors).

KubernetesApi.getAgent​

getAgent(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the cluster agent. State of the identity of the Navin Cluster Agent and its last report. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the cluster agent".

Raises: the typed errors of the transport (Errors).

KubernetesApi.getComponent​

getComponent(clusterId: string, name: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a Kubernetes component. Reads the resource and returns its observed state. Permission cluster:read; 404 k8s_component_not_found (the record is dropped when the resource is gone).

Route: /api/v1/clusters/{cluster_id}/kubernetes/components/{name} (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
namestringyesName of the component.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a Kubernetes component".

Raises: the typed errors of the transport (Errors).

KubernetesApi.getTarget​

getTarget(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a Kubernetes target. Returns the API server, the namespace, the server version, the discovered mode, distribution and number of nodes, the discovery time, the last error and the kubeconfig as {"secret": true, "set": true}. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a Kubernetes target".

Raises: the typed errors of the transport (Errors).

KubernetesApi.importRbac​

importRbac(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the RBAC of the import identity. Least privilege RBAC of the identity the Manager uses for the cluster, as objects and YAML, with the resulting user name: read what the discovery needs, write only platform.navin.ai resources in the managed namespace; no Secret, RBAC object, workload, exec nor impersonation. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/import-rbac (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the RBAC of the import identity".

Raises: the typed errors of the transport (Errors).

KubernetesApi.installComponent​

installComponent(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Install a catalog service on Kubernetes. Creates the ManagedComponent resource of a catalog service (chart from a path or an OCI reference pinned by digest) and returns its state (201). Values that look like secrets are refused. Permission services:install. Errors: 409 k8s_component_exists, 422 k8s_values_secret, 409 k8s_replicas_below_pdb. Audited as k8s.component.install.

Route: /api/v1/clusters/{cluster_id}/kubernetes/components (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noService, source, values, replicas and policies of the component.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Install a catalog service on Kubernetes".

Raises: the typed errors of the transport (Errors).

KubernetesApi.issue​

issue(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Issue the cluster agent identity. Issues the client certificate and the configuration of the Navin Cluster Agent: certificate_pem, private_key_pem (returned once, never stored), ca_pem, manager_public_key_pem, config, fingerprint and not_after (201). Permission cluster:manage; 422 k8s_agent_gateway_url_invalid. Audited as k8s.agent.issue.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noGateway URL, tenant and offline delay of the agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Issue the cluster agent identity".

Raises: the typed errors of the transport (Errors).

KubernetesApi.lastDiscovery​

lastDiscovery(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the last discovery of a Kubernetes cluster. Returns the inventory of the last discovery. Permission cluster:read; 404 k8s_not_discovered.

Route: /api/v1/clusters/{cluster_id}/kubernetes/discovery (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the last discovery of a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

KubernetesApi.listCommands​

listCommands(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the cluster agent commands. The last 200 commands queued for the cluster agent, each with its receipts. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent/commands (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the cluster agent commands".

Raises: the typed errors of the transport (Errors).

KubernetesApi.listComponents​

listComponents(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the Kubernetes components. Live list: every ManagedComponent of the namespace with its status, which is also written into the model of the Manager. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/kubernetes/components (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the Kubernetes components".

Raises: the typed errors of the transport (Errors).

KubernetesApi.patchTarget​

patchTarget(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update a Kubernetes target. Changes the API server, the kubeconfig (send the read back object to keep it) or the namespace (refused while components remain); the kubeconfig guard runs again. Permission cluster:manage. Errors: 422 validation_error, 409 k8s_components_remain. Audited as k8s.cluster.update.

Route: /api/v1/clusters/{cluster_id}/kubernetes (PATCH).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noFields of the target to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update a Kubernetes target".

Raises: the typed errors of the transport (Errors).

KubernetesApi.queueCommand​

queueCommand(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Queue a signed command for the cluster agent. Records the authorization decision, then queues a signed command (managedcomponent.apply, managedcomponent.delete or inventory.report) the agent picks up. Answers 202 with the command. Permission services:operate. Audited as k8s.agent.policy.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent/commands (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noOperation, parameters, idempotency key and validity.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Queue a signed command for the cluster agent".

Raises: the typed errors of the transport (Errors).

KubernetesApi.register​

register(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Register a Kubernetes cluster. Checks the kubeconfig against the API server given, calls /version, seals the kubeconfig and turns the cluster into a Kubernetes cluster. The cluster must have no host. Returns the target (201). Permission cluster:manage. Errors: 409 k8s_already_registered, 409 k8s_cluster_has_hosts, kubeconfig guard and API errors. Audited as k8s.cluster.register.

Route: /api/v1/clusters/{cluster_id}/kubernetes (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noAPI server, kubeconfig and namespace.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Register a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

KubernetesApi.removeComponent​

removeComponent(clusterId: string, name: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Remove a Kubernetes component. Deletes the ManagedComponent resource; the operator uninstalls the chart. Answers 202 with {"name", "state": "removed"} once the resource is gone, else the component still being deleted. Permission services:install. Errors: 404 k8s_component_not_found, 409 k8s_maintenance. Audited as k8s.component.remove.

Route: /api/v1/clusters/{cluster_id}/kubernetes/components/{name} (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
namestringyesName of the component (the ManagedComponent resource).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Remove a Kubernetes component".

Raises: the typed errors of the transport (Errors).

KubernetesApi.revoke​

revoke(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Revoke the cluster agent identity. Revokes the identity of the Navin Cluster Agent. Answers 204. Permission cluster:manage; 404 k8s_agent_not_registered. Audited as k8s.agent.revoke.

Route: /api/v1/clusters/{cluster_id}/kubernetes/agent (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Revoke the cluster agent identity".

Raises: the typed errors of the transport (Errors).

KubernetesApi.runDiscovery​

runDiscovery(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Discover a Kubernetes cluster. Reads, with read only calls, the version, the distribution (bring your own or managed), the nodes with their capacity and GPUs, the storage and ingress classes, CoreDNS and the platform add-ons (cert-manager, Cilium, Kyverno, Argo CD, KEDA...). Stores and returns the inventory. Permission hosts:manage. Audited as k8s.discovery.

Route: /api/v1/clusters/{cluster_id}/kubernetes/discovery (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Discover a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

KubernetesApi.unregister​

unregister(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Unregister a Kubernetes cluster. Forgets the API server and the kubeconfig; the cluster becomes a host cluster again. Refused while components remain (409 k8s_components_remain). Answers 204. Permission cluster:manage. Audited as k8s.cluster.unregister.

Route: /api/v1/clusters/{cluster_id}/kubernetes (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Unregister a Kubernetes cluster".

Raises: the typed errors of the transport (Errors).

Class LifecycleApi​

Lifecycle. The lifecycle of a cluster and of its services after the install: installation profile and approvals, preflight, liveness, readiness and smoke checks, upgrades with rollback and restore, coordinated backups and restores, drift detection, sanitized support bundles, signed acceptance reports and the uniform component sheet. Operations of this group of the Navin Manager API.

ManagerResource

LifecycleApi.acceptanceKey​

acceptanceKey(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the public key that signs the acceptance reports. Returns algorithm (Ed25519), key_id and public_key_pem, to verify a report offline. Any signed in user.

Route: /api/v1/acceptance/public-key (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the public key that signs the acceptance reports".

Raises: the typed errors of the transport (Errors).

LifecycleApi.clusterProfile​

clusterProfile(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Evaluate the profile of a cluster. Every rule of the cluster profile (or of profile, to compare before choosing one) evaluated against the real state, each with status (pass or fail), label and reason; the status is blocked when one rule fails. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/profile (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Evaluate the profile of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.componentSheet​

componentSheet(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the component sheet of a service. Every tab of the uniform component sheet from the observed state: overview, instances, config, dependencies, logs, metrics, security (TLS, endpoints, secrets set or not, ports, certificates, run users, profile), operations, upgrade, backups, audit and support. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/sheet (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the component sheet of a service".

Raises: the typed errors of the transport (Errors).

LifecycleApi.createBackup​

createBackup(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Take a coordinated backup. Starts one operation that backs up the services given (every backupable service by default) in dependency order, sharing one set_id; the set succeeds only when every member succeeded. Returns operation_id, set_id and backup_ids. Permission services:operate. Audited as backup.create.

Route: /api/v1/clusters/{cluster_id}/backups (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noServices to back up.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Take a coordinated backup".

Raises: the typed errors of the transport (Errors).

LifecycleApi.createBundle​

createBundle(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Build a support bundle. Starts an operation that collects log tails, the profile, the hosts, the service versions and states, the rendered configuration, the open alerts, the drift findings and the operation history into a tar.gz archive in which every secret and personal datum is masked. Returns operation_id and bundle_id. Permission cluster:manage. Audited as support.bundle.

Route: /api/v1/clusters/{cluster_id}/support-bundles (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Build a support bundle".

Raises: the typed errors of the transport (Errors).

LifecycleApi.createReport​

createReport(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run an acceptance. Starts the acceptance.run operation: cluster preflight, liveness of every running instance, readiness and smoke test of every managed service (each stage tolerates its failures so that every check runs), then the signed report. Returns operation_id and report_id. Permission services:install. Audited as acceptance.run.

Route: /api/v1/clusters/{cluster_id}/acceptance-reports (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run an acceptance".

Raises: the typed errors of the transport (Errors).

LifecycleApi.decideApproval​

decideApproval(clusterId: string, approvalId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Approve or reject an approval request. Decides a pending request; the requester cannot decide its own. Returns the approval. Permission cluster:manage. Errors: 404 approval_invalid, 409 approval_not_pending, 403 approval_self. Audited as approval.approve or approval.reject.

Route: /api/v1/clusters/{cluster_id}/approvals/{approval_id}/decision (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
approvalIdstringyesIdentifier of the approval request.
bodyunknown{}noThe decision.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Approve or reject an approval request".

Raises: the typed errors of the transport (Errors).

LifecycleApi.downloadBundle​

downloadBundle(clusterId: string, bundleId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Download a support bundle. Returns the navin-support-<time>.tar.gz archive of a succeeded bundle. Permission cluster:manage; 404 bundle_not_found. Audited as support.bundle_download.

Route: /api/v1/clusters/{cluster_id}/support-bundles/{bundle_id}/download (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bundleIdstringyesIdentifier of the support bundle.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Download a support bundle".

Raises: the typed errors of the transport (Errors).

LifecycleApi.driftReconcile​

driftReconcile(clusterId: string, findingId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Reconcile a drift finding. Rewrites the files and units of the drifted instance from the Manager configuration (and restarts it when asked). Returns operation_id. Permission configs:edit. Errors: 404 drift_not_found, 409 drift_not_reconcilable (a file that belongs to no service). Audited as drift.reconcile.

Route: /api/v1/clusters/{cluster_id}/drift/{finding_id}/reconcile (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
findingIdstringyesIdentifier of the drift finding.
bodyunknown{}noRestart option and optional approval.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Reconcile a drift finding".

Raises: the typed errors of the transport (Errors).

LifecycleApi.driftReport​

driftReport(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the drift report of a cluster. Findings of the last scans: managed files and units changed, removed or replaced outside the Manager, with host, service, component and path. Open findings raise the config_drift alert. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/drift (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the drift report of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.driftScan​

driftScan(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Scan the cluster for drift. Starts an operation with one digest task per host over the files and units the Manager wrote; differences open findings. Returns operation_id. Permission services:operate. Audited as drift.scan.

Route: /api/v1/clusters/{cluster_id}/drift/scan (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noHosts to scan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Scan the cluster for drift".

Raises: the typed errors of the transport (Errors).

LifecycleApi.getReport​

getReport(clusterId: string, reportId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a signed acceptance report. Returns the signed document: one item per check with PASS, FAIL or BLOCKED and its evidence, the verdict (FAIL when one item failed, BLOCKED when none failed and one is blocked, else PASS) and the signature. Permission cluster:read; 404 acceptance_not_found until the run succeeded.

Route: /api/v1/clusters/{cluster_id}/acceptance-reports/{report_id} (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
reportIdstringyesIdentifier of the acceptance report.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a signed acceptance report".

Raises: the typed errors of the transport (Errors).

LifecycleApi.listApprovals​

listApprovals(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the approvals of a cluster. The last 200 approvals, newest first: action, service, reason, status (pending, approved, rejected, expired or used), requester, decider, the operation that used it and the times. Approvals past their expiry are marked expired first. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/approvals (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the approvals of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.listBackups​

listBackups(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the service backups of a cluster. Returns backupable (the installed services whose catalog declares a backup) and the last 300 backups with their service, host, set, status, files and digests. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/backups (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the service backups of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.listBundles​

listBundles(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the support bundles of a cluster. The last 50 bundles with their status, size, SHA-256, contents, redactions and operation. Permission cluster:manage.

Route: /api/v1/clusters/{cluster_id}/support-bundles (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the support bundles of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.listProfiles​

listProfiles(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the installation profiles. Every profile with its label and description in both languages, its rules, whether it requires approvals and the severity of the network rules. Any signed in user.

Route: /api/v1/profiles (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the installation profiles".

Raises: the typed errors of the transport (Errors).

LifecycleApi.listReports​

listReports(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the acceptance reports of a cluster. The last 100 acceptance runs of the cluster, newest first, with their status, verdict and operation. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/acceptance-reports (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the acceptance reports of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.listUpgrades​

listUpgrades(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the upgrades of a cluster. The last 200 upgrades of every service with their versions, status, backup and operations. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/upgrades (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the upgrades of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.reportHtml​

reportHtml(clusterId: string, reportId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get an acceptance report as HTML. Renders the report as a self contained HTML page in the language asked, for printing or archiving. Permission cluster:read; 404 acceptance_not_found.

Route: /api/v1/clusters/{cluster_id}/acceptance-reports/{report_id}/html (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
reportIdstringyesIdentifier of the acceptance report.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get an acceptance report as HTML".

Raises: the typed errors of the transport (Errors).

LifecycleApi.requestApproval​

requestApproval(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Request an approval. Records a pending request for a disruptive action on a service; another user decides it. Returns the approval (201). Permission services:operate. Audited as approval.request.

Route: /api/v1/clusters/{cluster_id}/approvals (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noAction, service and reason.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Request an approval".

Raises: the typed errors of the transport (Errors).

LifecycleApi.restoreBackup​

restoreBackup(clusterId: string, backupId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Restore a service backup. Starts the restore operation: stop the instances, check the digests, run the restore steps, start the instances, run the health checks, the verify steps, the service check and the smoke test. Returns operation_id. Permission services:install; an approval under banking-secure. Audited as backup.restore.

Route: /api/v1/clusters/{cluster_id}/backups/{backup_id}/restore (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
backupIdstringyesIdentifier of the service backup.
bodyunknown{}noOptional approval.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Restore a service backup".

Raises: the typed errors of the transport (Errors).

LifecycleApi.restoreUpgrade​

restoreUpgrade(clusterId: string, upgradeId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Restore the backup taken before an upgrade. Starts the operation that brings back the previous release and its data from the backup taken before the upgrade, when a rollback is not possible. Returns operation_id. Permission services:install; 404 upgrade_not_found; an approval under banking-secure. Audited as service.restore.

Route: /api/v1/clusters/{cluster_id}/upgrades/{upgrade_id}/restore (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
upgradeIdstringyesIdentifier of the upgrade.
bodyunknown{}noOptional approval.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Restore the backup taken before an upgrade".

Raises: the typed errors of the transport (Errors).

LifecycleApi.rollback​

rollback(clusterId: string, upgradeId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Roll an upgrade back. Starts the operation that replays the sealed tasks of the previous release and restores the previous configuration version. Refused when the descriptor declares it impossible or an irreversible migration ran (use the restore instead). Returns operation_id. Permission services:install; 404 upgrade_not_found. Audited as service.rollback.

Route: /api/v1/clusters/{cluster_id}/upgrades/{upgrade_id}/rollback (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
upgradeIdstringyesIdentifier of the upgrade.
bodyunknown{}noOptional approval.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Roll an upgrade back".

Raises: the typed errors of the transport (Errors).

LifecycleApi.runPreflight​

runPreflight(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run the installation preflight of a cluster. Every check that must pass before a service is installed or upgraded, with its severity, evidence and a blocking verdict: host facts, DNS, catalog preflight entries, firewall, capacity, versions, TLS and profile rules. A check in fail blocks. Nothing is changed. Permission services:install.

Route: /api/v1/clusters/{cluster_id}/preflight (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noServices and hosts to check.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run the installation preflight of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.serviceChecks​

serviceChecks(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the checks of a service. Liveness of every instance (health checks of the agent), readiness (service check) and functional smoke test, each with its status, results, error and time. Only a passed smoke test proves that the service works. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/checks (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the checks of a service".

Raises: the typed errors of the transport (Errors).

LifecycleApi.setProfile​

setProfile(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Change the profile of a cluster. Sets the installation profile and returns its evaluation. Permission cluster:manage. Audited as cluster.profile with the previous and the new profile.

Route: /api/v1/clusters/{cluster_id}/profile (PUT).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noThe new profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Change the profile of a cluster".

Raises: the typed errors of the transport (Errors).

LifecycleApi.startUpgrade​

startUpgrade(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Upgrade a service. Upgrades the service to the catalog release in one operation:

Route: /api/v1/clusters/{cluster_id}/services/{service}/upgrade (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noCanary host and optional approval.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Upgrade a service".

Raises: the typed errors of the transport (Errors).

LifecycleApi.upgradeInfo​

upgradeInfo(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Check whether a service can be upgraded. Returns from (installed release), to (catalog release), allowed with the problems, stateful, backup_before, the migrations, whether a rollback is possible, the upgrade matrix and the history of the last 50 upgrades. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/upgrade (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Check whether a service can be upgraded".

Raises: the typed errors of the transport (Errors).

LifecycleApi.verifyReport​

verifyReport(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Verify the signature of an acceptance report. Checks the Ed25519 signature of a report document against the key of this Manager and returns valid, trusted, key_id and the reason of a refusal. Any signed in user.

Route: /api/v1/acceptance/verify (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe signed report document.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Verify the signature of an acceptance report".

Raises: the typed errors of the transport (Errors).

Class McpApi​

MCP servers. The MCP (Model Context Protocol) servers of a tenant project: created from a preset of the Navin library or typed by an administrator, tested, and optionally hosted on the mcp-host service of a cluster. Operations of this group of the Navin Manager API.

ManagerResource

McpApi.createServer​

createServer(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create an MCP server. Creates a server from a preset (its required fields are mandatory) or a custom one, and returns it (201). A preset whose URL is not internal needs url set to the internal address of its server. Permission mcp:manage. Errors: 422 mcp_fields_missing, 422 mcp_fields_unknown, 422 mcp_target_required, 422 mcp_online_forbidden, 404 mcp_preset_not_found, 409 mcp_server_name_taken. Audited as mcp.create.

Route: /api/v1/mcp/servers (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noTenant, project and definition of the server.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.deleteServer​

deleteServer(serverId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete an MCP server. Deletes the server; a hosted server is withdrawn from its hosting first. Answers 204. Permission mcp:manage; 404 mcp_server_not_found. Audited as mcp.delete.

Route: /api/v1/mcp/servers/{server_id} (DELETE).

NameTypeDefaultRequiredDescription
serverIdstringyesIdentifier of the MCP server.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.getServer​

getServer(serverId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get an MCP server. Returns the server with its transport, URL or command, allowed tools, configured and secret field names, last test and hosting (state, cluster, URL; never the token). Permission mcp:read; 404 mcp_server_not_found.

Route: /api/v1/mcp/servers/{server_id} (GET).

NameTypeDefaultRequiredDescription
serverIdstringyesIdentifier of the MCP server.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.hostServer​

hostServer(serverId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Host a stdio MCP server on a cluster. Hosts a stdio server on the mcp-host service of a cluster: a new bearer token (sealed; the runtime only receives its SHA-256), status deploying, then the mcp.hosting.apply operation that writes servers.json on every instance; the status becomes hosted or failed. Answers 202 with the server and operation_id. Permission mcp:manage. Errors: 422 mcp_hosting_stdio_only, 409 mcp_hosting_disabled, 409 mcp_host_not_installed. Audited as mcp.host.

Route: /api/v1/mcp/servers/{server_id}/hosting (POST).

NameTypeDefaultRequiredDescription
serverIdstringyesIdentifier of the MCP server.
bodyunknown{}noCluster and limits of the hosting.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Host a stdio MCP server on a cluster".

Raises: the typed errors of the transport (Errors).

McpApi.hostedServers​

hostedServers(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the hosted MCP servers with their tokens. Hosted servers of a tenant (one project or all) with url, bearer token, allowed_tools, status and hosted_at, for the Navin Enterprise platform. Permission mcp:publish (admin role only). Audited as mcp.hosted_list (identifiers only, never a token).

Route: /api/v1/mcp/hosted (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the hosted MCP servers with their tokens".

Raises: the typed errors of the transport (Errors).

McpApi.hostingInfrastructure​

hostingInfrastructure(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the MCP hosting infrastructure. Per cluster: whether mcp-host is installed, its instances (FQDN, base URL, state) and the number of servers each one hosts. A server is placed on one instance by a hash of its identifier. Permission mcp:read.

Route: /api/v1/mcp/hosting (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the MCP hosting infrastructure".

Raises: the typed errors of the transport (Errors).

McpApi.listPresets​

listPresets(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the MCP presets. Presets of the Navin library (name, category, transport, hosting, fields to fill), sorted by category and name. Permission mcp:read; 503 mcp_presets_unavailable.

Route: /api/v1/mcp/presets (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the MCP presets".

Raises: the typed errors of the transport (Errors).

McpApi.listServers​

listServers(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the MCP servers of a project. Servers of one project of one tenant (both required), without any secret value. Permission mcp:read.

Route: /api/v1/mcp/servers (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the MCP servers of a project".

Raises: the typed errors of the transport (Errors).

McpApi.renewToken​

renewToken(serverId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Renew the token of a hosted MCP server. Issues a new bearer token and applies it; the previous token stops working once applied. Answers 202. Permission mcp:manage. Errors: 409 mcp_not_hosted, 409 mcp_hosting_disabled. Audited as mcp.hosting_token.

Route: /api/v1/mcp/servers/{server_id}/hosting/token (POST).

NameTypeDefaultRequiredDescription
serverIdstringyesIdentifier of the MCP server.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Renew the token of a hosted MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.testServer​

testServer(serverId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Test an MCP server. Speaks MCP to the server (initialize, notifications/initialized, tools/list) over streamable HTTP, SSE, or stdin and stdout of the command when it is on the PATH (no shell, with a timeout); a hosted server is tested at its hosted URL with its token. Returns and keeps in last_test the result {ok, tools, server_info, error, tested_at}; an error never repeats a secret value. Permission mcp:manage; 422 mcp_online_forbidden. Audited as mcp.test.

Route: /api/v1/mcp/servers/{server_id}/test (POST).

NameTypeDefaultRequiredDescription
serverIdstringyesIdentifier of the MCP server.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Test an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.unhostServer​

unhostServer(serverId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Stop hosting an MCP server. Takes the server out of its hosting: status removing, then the mcp.hosting.apply operation without it (none at the end). Answers 202 with the server and operation_id. Permission mcp:manage; 409 mcp_not_hosted. Audited as mcp.unhost.

Route: /api/v1/mcp/servers/{server_id}/hosting (DELETE).

NameTypeDefaultRequiredDescription
serverIdstringyesIdentifier of the MCP server.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Stop hosting an MCP server".

Raises: the typed errors of the transport (Errors).

McpApi.updateServer​

updateServer(serverId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update an MCP server. Changes the fields given and returns the server. values is merged with the stored ones; url, command, args, headers and env apply to custom servers only (422 mcp_custom_only). Disabling a hosted server withdraws it from its hosting. Permission mcp:manage. Errors: 422 mcp_fields_unknown, 422 mcp_online_forbidden. Audited as mcp.update.

Route: /api/v1/mcp/servers/{server_id} (PATCH).

NameTypeDefaultRequiredDescription
serverIdstringyesIdentifier of the MCP server.
bodyunknown{}noFields of the server to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update an MCP server".

Raises: the typed errors of the transport (Errors).

Class McpRuntimeApi​

MCP runtime. The MCP runtime of a Kubernetes cluster: the ToolHive Kubernetes Operator, installed from pinned charts, and the ephemeral MCP server instances the lifecycle controller of the Control Plane creates in it. Operations of this group of the Navin Manager API.

ManagerResource

McpRuntimeApi.destroyInstance​

destroyInstance(clusterId: string, namespace: string, name: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete a managed MCP instance. Deletes one managed MCPServer (uid precondition); the Control Plane controller then revokes its credentials and closes it. Returns namespace, name, instance_id and state (deleting). Permission services:operate. Errors: 404 mcp_runtime_instance_not_found, 502 mcp_runtime_forbidden (the identity of the Manager lacks the right). Audited as mcp_runtime.instance.destroy.

Route: /api/v1/clusters/{cluster_id}/mcp-runtime/instances/{namespace}/{name} (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
namespacestringyesProject namespace of the instance, mcp-<12 hex>.
namestringyesName of the MCPServer object.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete a managed MCP instance".

Raises: the typed errors of the transport (Errors).

McpRuntimeApi.installToolhive​

installToolhive(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Install the ToolHive operator. Writes the two ManagedComponent resources of ToolHive (CRDs, then operator) in toolhive-system, pinned by digest. Returns namespace, version and the components written (201). Permission services:install; 409 mcp_runtime_installed. Audited as mcp_runtime.install.

Route: /api/v1/clusters/{cluster_id}/mcp-runtime/install (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Install the ToolHive operator".

Raises: the typed errors of the transport (Errors).

McpRuntimeApi.restartInstance​

restartInstance(clusterId: string, namespace: string, name: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Restart a managed MCP instance. Restarts one managed MCPServer without changing its spec: a merge patch of the annotation mcpserver.toolhive.stacklok.dev/restarted-at to a new RFC 3339 time (rolling restart by the operator), with the uid as precondition. Returns namespace, name, instance_id, state (restarting) and restarted_at. Permission services:operate; 404 mcp_runtime_instance_not_found. Audited as mcp_runtime.instance.restart.

Route: /api/v1/clusters/{cluster_id}/mcp-runtime/instances/{namespace}/{name}/restart (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
namespacestringyesProject namespace of the instance, mcp-<12 hex>.
namestringyesName of the MCPServer object.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Restart a managed MCP instance".

Raises: the typed errors of the transport (Errors).

McpRuntimeApi.runtimeState​

runtimeState(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the MCP runtime state. Returns the operator state (with crd_installed), the ToolHive components, the preset, the managed instances items (filtered by tenant and project), the ignored objects, the aggregates by tenant and project (always over every managed instance) and observed_at. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/mcp-runtime (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the MCP runtime state".

Raises: the typed errors of the transport (Errors).

Class MeApi​

My profile. The profile of the signed in user and its personal API tokens. Operations of this group of the Navin Manager API.

ManagerResource

MeApi.listTokens​

listTokens(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List my API tokens. Lists every token of the caller, newest first, revoked ones included: id, name, prefix, permissions (null: every permission of the user), expires_at, last_used_at, revoked_at, created_at. The secret is never returned.

Route: /api/v1/me/tokens (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List my API tokens".

Raises: the typed errors of the transport (Errors).

MeApi.me​

me(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Read my profile. Returns the account of the caller: identifier, username, display name, email, source (local, ldap, oidc), role bindings, MFA state, language, lock and last sign in.

Route: /api/v1/me (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Read my profile".

Raises: the typed errors of the transport (Errors).

MeApi.revokeToken​

revokeToken(tokenId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Revoke one of my API tokens. Revokes the token at once (revoking it again is harmless). Browser session only. Answers 204; 404 token_not_found when the token is not one of yours. Audited as token.revoke.

Route: /api/v1/me/tokens/{token_id} (DELETE).

NameTypeDefaultRequiredDescription
tokenIdstringyesIdentifier of the API token, from GET /me/tokens.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Revoke one of my API tokens".

Raises: the typed errors of the transport (Errors).

Class MetaApi​

Version. Public metadata of the Manager. No authentication is needed. Operations of this group of the Navin Manager API.

ManagerResource

MetaApi.version​

version(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the version of the Manager. Returns name (navin-manager), version, environment and the stack of the catalog (name, version, number of services). Public.

Route: /api/v1/version (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the version of the Manager".

Raises: the typed errors of the transport (Errors).

Class MirrorApi​

Local mirror. The local mirror holds the packages, container images and Python wheels the agents install from, so that a site without Internet access (or under the banking-secure and air-gapped profiles) never downloads from outside. It is filled from an offline bundle described by a manifest. Operations of this group of the Navin Manager API.

ManagerResource

MirrorApi.reload​

reload(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Reload the mirror manifest. Reads the manifest of the mirror again and replaces the recorded artifacts with its content; every file must exist. Returns what was loaded. Permission settings:manage. Errors: 409 mirror_manifest_missing, 422 mirror_manifest_invalid. Audited as mirror.reload (outcome failure with the error code when the manifest is refused).

Route: /api/v1/mirror/reload (POST).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Reload the mirror manifest".

Raises: the typed errors of the transport (Errors).

MirrorApi.status​

status(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the mirror status. Returns the mirror url and registry, manifest_loaded, loaded_at, the number of artifacts, images and python packages loaded, and missing, what the catalog needs that the mirror lacks. Permission system:read.

Route: /api/v1/mirror (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the mirror status".

Raises: the typed errors of the transport (Errors).

Class NavinSmApi​

Navin SM. Navin SM is the Navin desktop and CLI build an organization gives to its staff, with a file that points Navin at the organization's own LiteLLM proxy and models (Azure, Bedrock, vLLM... behind LiteLLM), optionally exclusive (no other provider allowed). A profile is that file: the organization, the gateway (base URL, authentication, headers, CA bundle, models, default model, routes, exclusive flag) and the managed policy Navin enforces (permissions, MCP allowlist, plugins, hooks, bypass, pinned environment). Operations of this group of the Navin Manager API.

ManagerResource

assignableUsers(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the users a key can be assigned to. Enabled users of the Manager (50 at most, sorted by name) whose user name, display name or email contains q, with id, username, display_name, email and source. Permission navin_sm:keys.

Route: /api/v1/navin-sm/users (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the users a key can be assigned to".

Raises: the typed errors of the transport (Errors).

blockKey(profileId: string, keyId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Block a key. Blocks the key at the proxy (POST /key/block): it is refused at once and can be unblocked. Returns the key with status blocked. Permission navin_sm:keys. Errors: 404 navin_sm_key_not_found, 409 navin_sm_key_revoked, 409 navin_sm_key_gone, 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.block.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/{key_id}/block (POST).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
keyIdstringyesIdentifier of the key in the Manager.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Block a key".

Raises: the typed errors of the transport (Errors).

createKey(profileId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Issue a virtual key. Issues a key at the LiteLLM service the profile is linked to (POST /key/generate with the master key kept in the server) for a user of the Manager or a group of the identity provider, and answers 201 {key, item}: key is returned here and never again, the Manager keeps only the alias and the sha256 LiteLLM uses as identifier. The LiteLLM user is navin-sm:<org_id>:<kind>:<assignee>, the alias navin-sm.<org_id>.<assignee>.<random>. Permission navin_sm:keys. Errors: 404 navin_sm_profile_not_found, 404 navin_sm_user_not_found, 422 navin_sm_assignee_required, 422 navin_sm_key_models_unknown (a model outside the profile), 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 409 navin_sm_key_alias_taken, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.create (id and alias, never the key).

Route: /api/v1/navin-sm/profiles/{profile_id}/keys (POST).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
bodyunknown{}noAssignee, models and limits of the new key.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Issue a virtual key".

Raises: the typed errors of the transport (Errors).

createProfile(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a Navin SM profile. Creates the profile and returns it (201). Permission settings:manage, plus vault:manage with a shared_key_ref. Errors (422 unless noted): navin_sm_org_id_invalid, navin_sm_value_empty, navin_sm_value_duplicate, navin_sm_base_url_invalid, navin_sm_base_url_chat, navin_sm_shared_key_ref_required, navin_sm_shared_key_ref_forbidden, navin_sm_vault_entry_not_found, navin_sm_header_invalid, navin_sm_header_secret, navin_sm_models_count, navin_sm_model_duplicate, navin_sm_default_model_unknown, navin_sm_route_invalid, navin_sm_route_unknown, navin_sm_env_invalid, navin_sm_env_secret, 409 navin_sm_org_taken. Audited as navin_sm.create.

Route: /api/v1/navin-sm/profiles (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a Navin SM profile".

Raises: the typed errors of the transport (Errors).

deletePackage(filename: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Remove a stored package. Removes the stored file; its published SHA256 stays recorded. Answers 204. Permission settings:manage. Errors: 404 navin_sm_package_unknown, 404 navin_sm_package_missing. Audited as navin_sm.package.delete.

Route: /api/v1/navin-sm/distribution/packages/{filename} (DELETE).

NameTypeDefaultRequiredDescription
filenamestringyesFile name of the package.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Remove a stored package".

Raises: the typed errors of the transport (Errors).

deleteProfile(profileId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete a Navin SM profile. Deletes the profile (the vault entry of its key is kept). Answers 204. Permission settings:manage; 404 navin_sm_profile_not_found. Audited as navin_sm.delete.

Route: /api/v1/navin-sm/profiles/{profile_id} (DELETE).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete a Navin SM profile".

Raises: the typed errors of the transport (Errors).

discoverModels(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Discover the models of a LiteLLM proxy. Calls GET <base>/v1/models then GET <base>/model/info of the proxy (5 second timeout, TLS 1.2 or later, public roots plus the ca_pem given, no redirect) and returns {models: [{id, context_window?, max_output_tokens?, vision?, reasoning?}], info_available, info_error}. With litellm_cluster_id and litellm_service, the LiteLLM service installed by the Manager is read with its master key and the CA of the Manager, both kept in the server (an empty base_url then means its address); otherwise the key of the vault entry or the key typed for this call only. /model/info is optional (an admin route a virtual key may not reach). Permission settings:manage, plus vault:manage with a shared_key_ref. Errors: 422 navin_sm_base_url_invalid, 422 navin_sm_header_invalid, 422 navin_sm_litellm_link_incomplete (one of the two link fields only), 422 navin_sm_litellm_source_not_found, 409 navin_sm_master_key_missing, 409 navin_sm_shared_key_missing, 502 navin_sm_discover_failed (details reason: timeout, tls_failed, refused, unreachable, auth_failed, not_found, http_status, protocol_error). Audited as navin_sm.discover.

Route: /api/v1/navin-sm/discover (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe proxy to read.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Discover the models of a LiteLLM proxy".

Raises: the typed errors of the transport (Errors).

distribution(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

State of the Navin SM distribution. The release of Navin SM the catalog names (service: name, version, GitHub repository and tag, settings and CA paths per system), its packages with their published SHA256, stored state, size and download link, the number stored, the last ten fetches and whether one is running. Permission settings:manage; 409 navin_sm_service_missing without the navin-sm service in the catalog.

Route: /api/v1/navin-sm/distribution (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "State of the Navin SM distribution".

Raises: the typed errors of the transport (Errors).

downloadPackage(filename: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Download a stored package. The package as stored (application/octet-stream, Cache-Control: no-store), its SHA256 in the X-Checksum-Sha256 header. Permission settings:manage. Errors: 404 navin_sm_package_unknown, 404 navin_sm_package_missing (not stored).

Route: /api/v1/navin-sm/distribution/packages/{filename}/download (GET).

NameTypeDefaultRequiredDescription
filenamestringyesFile name of the package.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Download a stored package".

Raises: the typed errors of the transport (Errors).

exportProfile(profileId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Export the managed-settings.json of a profile. Returns the file as an attachment (managed-settings.json, Cache-Control: no-store), valid against the contract. gateway.apiKey is present only for shared_key, unsealed from the vault for this answer. Permission settings:manage, plus vault:manage for shared_key. Errors: 404 navin_sm_profile_not_found, 409 navin_sm_shared_key_missing (vault entry gone or without key), 422 navin_sm_os_required (profile with use_manager_ca exported without os), 500 navin_sm_export_invalid. Audited as navin_sm.export (never the key).

Route: /api/v1/navin-sm/profiles/{profile_id}/export (GET).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Export the managed-settings.json of a profile".

Raises: the typed errors of the transport (Errors).

fetchRelease(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Fetch the release from GitHub. Starts a background fetch of the release (202, the import): the checksum files first, then every package not stored yet, each verified against its published SHA256. The GitHub token is the API key of the vault entry, read in the server and never returned, logged or audited. Permissions settings:manage and vault:manage. Errors: 409 navin_sm_service_missing, 422 navin_sm_vault_entry_not_found, 422 navin_sm_github_token_missing, 409 navin_sm_import_running. Audited as navin_sm.package.fetch (name of the vault entry only). Follow it with GET /navin-sm/distribution/imports/{import_id}.

Route: /api/v1/navin-sm/distribution/fetch (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe vault entry holding the GitHub token.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Fetch the release from GitHub".

Raises: the typed errors of the transport (Errors).

getImport(importId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

State of a fetch. {id, version, state, files, error, created_at, finished_at}: state is running, done or failed; each file is pending, downloading, stored, skipped (already stored) or failed with its error (never the token). Permission settings:manage; 404 navin_sm_import_not_found.

Route: /api/v1/navin-sm/distribution/imports/{import_id} (GET).

NameTypeDefaultRequiredDescription
importIdstringyesIdentifier of the fetch, returned by POST /navin-sm/distribution/fetch.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "State of a fetch".

Raises: the typed errors of the transport (Errors).

getProfile(profileId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a Navin SM profile. Returns one profile without any key. Permission settings:manage; 404 navin_sm_profile_not_found.

Route: /api/v1/navin-sm/profiles/{profile_id} (GET).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a Navin SM profile".

Raises: the typed errors of the transport (Errors).

listKeys(profileId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the virtual keys of a profile. LiteLLM virtual keys issued for the profile, active and blocked first, then revoked: assignee, alias, status, models and limits, never a key value nor its hash. Permission navin_sm:keys; 404 navin_sm_profile_not_found.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys (GET).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the virtual keys of a profile".

Raises: the typed errors of the transport (Errors).

listProfiles(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the Navin SM profiles. Profiles sorted by organization name, with the name of the vault entry of their shared key but never the key (shared_key_set). Permission settings:manage.

Route: /api/v1/navin-sm/profiles (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the Navin SM profiles".

Raises: the typed errors of the transport (Errors).

litellmSources(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the installed LiteLLM gateways. LiteLLM services installed by the Manager with their address and the vault entry of their key, to prefill the gateway of a profile or link it (litellm_cluster_id, litellm_service). The vault entry is listed only to a holder of vault:manage; an installed service without an entry yet has vault_entry_id null (POST /vault/import creates it). Permission settings:manage.

Route: /api/v1/navin-sm/litellm-sources (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the installed LiteLLM gateways".

Raises: the typed errors of the transport (Errors).

loadChecksums(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Load the published checksums of the release. Records the published SHA256 of the packages from the lines <sha256> <filename> of the SHA256SUMS and .sha256 files of the release, pasted together (offline sites). Returns {updated, unchanged, conflicts, ignored}: the files recorded or already identical, the stored packages whose SHA256 would change (reported and left as they are) and the names outside the release. Permission settings:manage. Errors: 409 navin_sm_service_missing, 422 navin_sm_checksums_invalid (no usable line). Audited as navin_sm.package.checksums.

Route: /api/v1/navin-sm/distribution/checksums (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe checksum lines.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Load the published checksums of the release".

Raises: the typed errors of the transport (Errors).

previewProfile(profileId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Preview the managed-settings.json of a profile. The file the export would produce, checked against the contract, without its key: a shared_key is replaced by <vault: entry name>. Returns {os, settings_path, ca_path, document, problems, valid}; problems lists the rules the document breaks (a vault entry without key, a profile with use_manager_ca previewed without os). Permission settings:manage; 404 navin_sm_profile_not_found. Not audited (nothing leaves the server).

Route: /api/v1/navin-sm/profiles/{profile_id}/preview (GET).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Preview the managed-settings.json of a profile".

Raises: the typed errors of the transport (Errors).

profileBundle(profileId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Download the deployment bundle of a profile. Zip for one system (navin-sm-<org_id>-<os>.zip, Cache-Control: no-store): managed-settings.json (the shared key included, audited as navin_sm.export with purpose bundle), the CA of the Manager when the profile ships it (use_manager_ca), and the deployment files of the system: shell script and Ansible playbook on Linux, shell script and MDM notes on macOS, PowerShell script with GPO and Intune notes on Windows. The packages are downloaded apart (GET /navin-sm/distribution/packages/{filename}/download). Permission settings:manage, plus vault:manage for shared_key. Errors: 404 navin_sm_profile_not_found, 409 navin_sm_service_missing (no navin-sm service in the catalog), 409 navin_sm_shared_key_missing.

Route: /api/v1/navin-sm/profiles/{profile_id}/bundle (GET).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Download the deployment bundle of a profile".

Raises: the typed errors of the transport (Errors).

revokeAllKeys(profileId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Revoke every key of a profile. Deletes every active or blocked key of the profile at the proxy in one call (POST /key/delete) and records them as revoked. Returns {revoked, items}. Permission navin_sm:keys. Errors: 404 navin_sm_profile_not_found, 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.revoke_all (count and ids of the keys).

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/revoke-all (POST).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Revoke every key of a profile".

Raises: the typed errors of the transport (Errors).

revokeKey(profileId: string, keyId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Revoke a key. Deletes the key at the proxy (POST /key/delete, immediate) and keeps it in the Manager with status revoked and revoked_at; a key the proxy no longer knows is revoked all the same. Returns the key. Permission navin_sm:keys. Errors: 404 navin_sm_key_not_found, 409 navin_sm_key_revoked, 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.revoke.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/{key_id} (DELETE).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
keyIdstringyesIdentifier of the key in the Manager.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Revoke a key".

Raises: the typed errors of the transport (Errors).

unblockKey(profileId: string, keyId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Unblock a key. Unblocks a blocked key at the proxy (POST /key/unblock) and returns it with status active. Permission navin_sm:keys. Same errors as the block. Audited as navin_sm.key.unblock.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/{key_id}/unblock (POST).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
keyIdstringyesIdentifier of the key in the Manager.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Unblock a key".

Raises: the typed errors of the transport (Errors).

updateKey(profileId: string, keyId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Change the models and limits of a key. Applies the models and limits at the proxy (POST /key/update), then in the Manager, and returns the key. Permission navin_sm:keys. Errors: 404 navin_sm_profile_not_found, 404 navin_sm_key_not_found, 409 navin_sm_key_revoked, 409 navin_sm_key_gone (the proxy no longer knows the key, which is then recorded as revoked), 422 navin_sm_key_models_unknown, 409 navin_sm_profile_not_linked, 409 navin_sm_master_key_missing, 502 navin_sm_proxy_refused or navin_sm_proxy_failed. Audited as navin_sm.key.update.

Route: /api/v1/navin-sm/profiles/{profile_id}/keys/{key_id} (PUT).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
keyIdstringyesIdentifier of the key in the Manager (never its value).
bodyunknown{}noNew models and limits.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Change the models and limits of a key".

Raises: the typed errors of the transport (Errors).

updateProfile(profileId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Replace a Navin SM profile. Replaces the whole profile and returns it. Same rules and errors as the creation, plus 404 navin_sm_profile_not_found. Audited as navin_sm.update (names of the fields changed).

Route: /api/v1/navin-sm/profiles/{profile_id} (PUT).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
bodyunknown{}noThe whole profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Replace a Navin SM profile".

Raises: the typed errors of the transport (Errors).

uploadPackage(filename: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Upload a package of the release. Raw body of one package of the release, streamed to <mirror_dir>/navin-sm/<version>/ and hashed while it is written; kept (201, the package as the distribution lists it) only when its SHA256 is the one published (loaded beforehand) or the one of the X-Checksum-Sha256 header. Permission settings:manage. Errors: 404 navin_sm_package_unknown (not a package of the release), 422 navin_sm_package_checksum_unknown (no published SHA256 and no header), 422 navin_sm_package_checksum_mismatch (the file is removed), 422 navin_sm_package_too_large (2 GiB), 409 navin_sm_disk_full. Audited as navin_sm.package.store, refusals included.

Route: /api/v1/navin-sm/distribution/packages/{filename} (PUT).

NameTypeDefaultRequiredDescription
filenamestringyesFile name of the package, as the catalog lists it for this version.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Upload a package of the release".

Raises: the typed errors of the transport (Errors).

usage(profileId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Tracking of the keys of a profile. Reads the proxy through the server (GET /key/info per live key, GET /spend/logs over the period) and returns {available, reason, period, keys, models, totals, truncated, last_use}: for each key its live state, spend, budget and reset date, and over the period its calls, tokens, errors, models and last use; the same figures per model and in total. truncated is true when the proxy capped the logs at 10000 rows (the figures of the period are then partial). When the profile is not linked, the master key is missing or the proxy is out of reach, available is false with reason and no figure: zeros are never invented. Permission navin_sm:keys; 404 navin_sm_profile_not_found.

Route: /api/v1/navin-sm/profiles/{profile_id}/usage (GET).

NameTypeDefaultRequiredDescription
profileIdstringyesIdentifier of the profile.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Tracking of the keys of a profile".

Raises: the typed errors of the transport (Errors).

Class NetworkApi​

Network flows. The network flows of a cluster, computed from what the Manager knows, for the network team that opens them in its security groups or host firewalls. Each flow belongs to a scope: Operations of this group of the Navin Manager API.

ManagerResource

NetworkApi.networkFlows​

networkFlows(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the network flow matrix of a cluster. Flows to open between the hosts, the Manager, the clients and the external endpoints of the cluster. JSON: cluster_id, items, summary and generated_at; with format=csv, a network-flows-<cluster>.csv attachment. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/network/flows (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the network flow matrix of a cluster".

Raises: the typed errors of the transport (Errors).

NetworkApi.networkRules​

networkRules(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the firewall rules that open the flows. Commands opening the flows in the security groups of a cloud provider or in a host firewall. With auto, the provider of each host is used (the environment chosen for the host, else the detected platform). Nothing is applied. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/network/rules (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the firewall rules that open the flows".

Raises: the typed errors of the transport (Errors).

Class NodeSecurityApi​

Node security. The security of the managed hosts and of their node agents: inventory, SSH policy, preflight and SSH bootstrap of the agent, enrollment tokens bound to the agent key, trust state (quarantine, revocation, recovery), management mode, signed agent commands and their receipts, agent update and SSH break glass. Operations of this group of the Navin Manager API.

ManagerResource

NodeSecurityApi.agentUpdate​

agentUpdate(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update the agent of a host. Verifies the signed agent binary of the mirror, then issues a signed agent.update command with its digest and signature (idempotency key derived from the digest). Returns the command envelope (201). Permission hosts:manage. Errors: 422 agent_package_untrusted, 409 host_not_trusted, 409 host_client_managed.

Route: /api/v1/hosts/{host_id}/agent-update (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noValidity of the command and health timeout of the new agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update the agent of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.bootstrapPlan​

bootstrapPlan(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Preview the bootstrap of a node agent. Checks the credential against the SSH policy and returns the plan without connecting: SSH user, target, jumps, credential verdict, the sudoers file and its validation, the allowlist, the systemd unit and the staging directory. Permission hosts:manage; 422 ssh_policy_refused.

Route: /api/v1/hosts/bootstrap/plan (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noSame body as a bootstrap.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Preview the bootstrap of a node agent".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglassApprove​

breakglassApprove(requestId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Approve a break glass request. Adds an approval. Two distinct approvers, both different from the requester, are needed; the second approval signs an OpenSSH user certificate valid for the TTL. Permission hosts:manage. Errors: 403 breakglass_self_approval, 409 breakglass_not_pending, 409 breakglass_already_approved, 404 breakglass_not_found. Audited as host.breakglass.approve.

Route: /api/v1/breakglass/{request_id}/approve (POST).

NameTypeDefaultRequiredDescription
requestIdstringyesIdentifier of the break glass request.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Approve a break glass request".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglassEvidence​

breakglassEvidence(requestId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Add evidence to a break glass session. Appends a redacted evidence record (session start, command digest, session end or recording) to the request. Permission hosts:manage; 404 breakglass_not_found.

Route: /api/v1/breakglass/{request_id}/evidence (POST).

NameTypeDefaultRequiredDescription
requestIdstringyesIdentifier of the break glass request.
bodyunknown{}noKind, digest and summary of the evidence.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Add evidence to a break glass session".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglassList​

breakglassList(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the break glass requests of a host. The last 50 break glass requests of the host with their status, approvers, validity and evidence. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/breakglass (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the break glass requests of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglassRequest​

breakglassRequest(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Request an emergency SSH access. Records a break glass request for the host with the reason, the public key of the requester and the TTL; two other users must approve it. Returns the request (201). Permission hosts:manage. Errors: 422 breakglass_key_refused, 409 host_not_trusted, 409 host_client_managed. Audited as host.breakglass.request.

Route: /api/v1/hosts/{host_id}/breakglass (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noReason, public key, account and validity.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Request an emergency SSH access".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.breakglassRevoke​

breakglassRevoke(requestId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Revoke a break glass access early. Ends the access before its TTL: the certificate is added to the key revocation list the hosts load. Permission hosts:manage. Errors: 404 breakglass_not_found, 409 breakglass_not_active.

Route: /api/v1/breakglass/{request_id}/revoke (POST).

NameTypeDefaultRequiredDescription
requestIdstringyesIdentifier of the break glass request.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Revoke a break glass access early".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.getSshPolicy​

getSshPolicy(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the SSH policy of a cluster. Returns allow_rsa, rsa_min_bits, approved_user_cas, bootstrap_user, spiffe_trust_domain and rotate_before_days. Permission cluster:read; 404 cluster_not_found.

Route: /api/v1/clusters/{cluster_id}/ssh-policy (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the SSH policy of a cluster".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.hostBootstrap​

hostBootstrap(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Bootstrap a node agent over SSH. Starts an operation that installs and registers the agent on one host:

Route: /api/v1/hosts/bootstrap (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noTarget host, jump hosts, SSH account, private key or certificate.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Bootstrap a node agent over SSH".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.hostEnroll​

hostEnroll(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Issue an enrollment token for one agent key. Issues a single use token for one host and one key: host_fingerprint is the SHA-256 (hex) of the public key of the agent (nm-agent prints it before enrolling). The token expires after at most 15 minutes and is consumed by the first enrollment that presents a CSR of that exact key. Returns id, token, expires_at, ttl_s, host_fingerprint and agent_url (201). Permission hosts:manage. Audited as host.enroll_token.

Route: /api/v1/hosts/enroll (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noCluster, FQDN and key fingerprint of the host.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Issue an enrollment token for one agent key".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.hostInventory​

hostInventory(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the inventory of a host. Returns host_id, the inventory reconciled from the agent facts (hardware, GPUs, platform) and updated_at. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/inventory (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the inventory of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.hostPreflight​

hostPreflight(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run the preflight of a host before its bootstrap. Reads the host over SSH and from the Manager (DNS forward and reverse, TCP reachability, required ports free, disks, operating system) and returns the checks graded pass, warning or blocking, the blocking and warnings counts, a reproducible digest and the credential verdict. Nothing is installed. Permission hosts:manage. Errors: 422 ssh_policy_refused. Audited as host.preflight.

Route: /api/v1/hosts/preflight (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noSSH access, expected identity, ports and disks to check.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run the preflight of a host before its bootstrap".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.hostReceipts​

hostReceipts(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the command receipts of a host. Receipts of the signed commands run by the agent, last completed first: operation, start and end, exit code, observed state, error code and evidence, redacted. Permission cluster:read.

Route: /api/v1/hosts/{host_id}/receipts (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the command receipts of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.issueCommand​

issueCommand(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Send a signed command to an agent. Issues a command envelope signed with the Ed25519 key of the Manager for the agent of the host (the same idempotency key returns the stored envelope). Allowed operations: facts.collect, health.check, logs.tail, files.digest, service.control, command.run, agent.update; the last three are refused on client managed hosts. Returns the envelope (201). Permission hosts:manage. Errors: 422 command_operation_unknown, 409 host_not_trusted, 409 host_client_managed. Audited as host.command.issue.

Route: /api/v1/hosts/{host_id}/commands (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noOperation, parameters, validity and idempotency key.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Send a signed command to an agent".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.listAllHosts​

listAllHosts(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the hosts of every cluster. Hosts of every cluster the caller may read (or of one cluster), sorted by FQDN, with their trust state, management mode, identity, metrics, inventory and platform.

Route: /api/v1/hosts (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the hosts of every cluster".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.listNodes​

listNodes(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the node agents. Hosts not decommissioned of every cluster the caller may read, with their trust state, management mode, agent version, last heartbeat, identity (certificate serial and expiry, SPIFFE ID, rotation_due), metrics and platform.

Route: /api/v1/agents/nodes (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the node agents".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.nodeDetail​

nodeDetail(hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a node agent. The node view plus its last 10 certificates and diagnostics (facts, last metrics, last 20 receipts). Permission cluster:read; 404 host_not_found.

Route: /api/v1/agents/nodes/{host_id} (GET).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a node agent".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.putSshPolicy​

putSshPolicy(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Set the SSH policy of a cluster. Replaces the SSH policy and returns it. The bootstrap user and every approved CA key are checked first. Permission hosts:manage. Errors: 422 ssh_policy_refused (weak or invalid key, refused user), 404 cluster_not_found. Audited as cluster.ssh_policy.

Route: /api/v1/clusters/{cluster_id}/ssh-policy (PUT).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noThe SSH policy.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Set the SSH policy of a cluster".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.quarantineHost​

quarantineHost(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Quarantine a host. Sets the trust state to quarantined: the Manager stops trusting the agent for new commands until it is recovered. Returns the node. Permission hosts:manage. Audited as host.quarantine.

Route: /api/v1/hosts/{host_id}/quarantine (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noReason of the change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Quarantine a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.recoverHost​

recoverHost(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Trust a quarantined host again. Sets the trust state back to trusted. A revoked host cannot be recovered: it must enroll again (409 agent_revoked). Returns the node. Permission hosts:manage. Audited as host.recover.

Route: /api/v1/hosts/{host_id}/recover (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noReason of the change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Trust a quarantined host again".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.revokeHost​

revokeHost(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Revoke the agent of a host. Sets the trust state to revoked, revokes the certificates of the agent and expires its pending commands. Only a new enrollment brings it back. Returns the node. Permission hosts:manage. Audited as host.revoke with the number of certificates revoked.

Route: /api/v1/hosts/{host_id}/revoke (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noReason of the change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Revoke the agent of a host".

Raises: the typed errors of the transport (Errors).

NodeSecurityApi.setManagement​

setManagement(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Set who manages a host. Sets the management mode: platform (the Manager acts on the host) or client (the dangerous commands and break glass are refused). Returns the node. Permission hosts:manage. Audited as host.management.

Route: /api/v1/hosts/{host_id}/management (PUT).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noThe management mode.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Set who manages a host".

Raises: the typed errors of the transport (Errors).

Class OperationsApi​

Operations. An operation is the unit of every change the Manager makes: an install, a restart, an upgrade, a backup, a host bootstrap... It is made of ordered stages; each stage holds tasks, usually one per host, run by the Navin agents. Status of an operation: pending, running, succeeded, failed or aborted; progress goes from 0 to 100. Operations of this group of the Navin Manager API.

ManagerResource

OperationsApi.abort​

abort(operationId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Abort an operation. Asks a pending or running operation to stop: tasks not started are cancelled, the running ones are stopped by their agents. Returns id, status and abort_requested. Permission operations:abort; 409 operation_not_running when it is already finished. Audited as operation.abort.

Route: /api/v1/operations/{operation_id}/abort (POST).

NameTypeDefaultRequiredDescription
operationIdstringyesIdentifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Abort an operation".

Raises: the typed errors of the transport (Errors).

OperationsApi.getOperation​

getOperation(operationId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get an operation with its stages and tasks. Returns the operation and its stages in order; each stage gives seq, name_i18n, status, tolerate_failures and its tasks (host, type, service, component, status, attempts, exit code, summary, error, times). Permission operations:read on its cluster; 404 operation_not_found.

Route: /api/v1/operations/{operation_id} (GET).

NameTypeDefaultRequiredDescription
operationIdstringyesIdentifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get an operation with its stages and tasks".

Raises: the typed errors of the transport (Errors).

OperationsApi.getTask​

getTask(operationId: string, taskId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a task of an operation. Returns one task with its full output, attempts and max_attempts, timeout_s, exit_code, duration_ms and times. Permission operations:read; 404 operation_not_found or 404 task_not_found.

Route: /api/v1/operations/{operation_id}/tasks/{task_id} (GET).

NameTypeDefaultRequiredDescription
operationIdstringyesIdentifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.
taskIdstringyesIdentifier of the task, from the stages of the operation.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a task of an operation".

Raises: the typed errors of the transport (Errors).

OperationsApi.listOperations​

listOperations(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Page<Doc>>

List the operations of a cluster. Operations of the cluster, newest first, without their stages: id, type, title_i18n, target, status, progress, error, created_by, created_at, started_at, finished_at, abort_requested. Paginated with limit and cursor. Permission operations:read.

Route: /api/v1/clusters/{cluster_id}/operations (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Page<Doc>>. Decoded JSON answer of the operation "List the operations of a cluster".

Raises: the typed errors of the transport (Errors).

OperationsApi.retry​

retry(operationId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Retry a failed operation. Creates a new operation from a failed or aborted one and returns its operation_id. The retry goes through the checks of a new operation: one change at a time per service, administrative state of the service, profile of the cluster and, under banking-secure, a new approval for a disruptive operation. Permission operations:abort; 409 operation_not_retryable in any other status. Audited as operation.retry.

Route: /api/v1/operations/{operation_id}/retry (POST).

NameTypeDefaultRequiredDescription
operationIdstringyesIdentifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Retry a failed operation".

Raises: the typed errors of the transport (Errors).

OperationsApi.running​

running(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the running operations. Pending and running operations of every cluster where the caller holds operations:read (at most 200, newest first), with their count. Used by the activity indicator of the console.

Route: /api/v1/operations/running (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the running operations".

Raises: the typed errors of the transport (Errors).

OperationsApi.taskLogs​

taskLogs(operationId: string, taskId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Read the log lines of a task. Returns the lines written after after_seq (each with seq, ts, stream and data), next_seq to pass as after_seq on the next call, and done: true once the task is finished and every line was read. To follow a task, call it again with after_seq=next_seq until done. Permission operations:read.

Route: /api/v1/operations/{operation_id}/tasks/{task_id}/logs (GET).

NameTypeDefaultRequiredDescription
operationIdstringyesIdentifier of the operation (an install, a restart, a backup...) whose tasks run on the hosts.
taskIdstringyesIdentifier of the task.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Read the log lines of a task".

Raises: the typed errors of the transport (Errors).

Class PKIApi​

PKI and certificates. The certificate authority of the Manager and the certificates it issues: client certificates of the agents and TLS certificates of the service components. Operations of this group of the Navin Manager API.

ManagerResource

PKIApi.getCa​

getCa(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the certificate authority. Returns the CA certificate of the Manager (ca_pem), its expiry not_after and its sha256 fingerprint. Any signed in user.

Route: /api/v1/pki/ca (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the certificate authority".

Raises: the typed errors of the transport (Errors).

PKIApi.listCertificates​

listCertificates(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the certificates of a cluster. Certificates issued for the cluster, the first to expire first: kind (agent or service), host, service, component, serial, subject, sans, not_before, not_after, revoked_at. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/certificates (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the certificates of a cluster".

Raises: the typed errors of the transport (Errors).

PKIApi.rotate​

rotate(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Rotate the service certificates of a cluster. Issues a new certificate for every component instance (of one service, or of all), then starts an operation that installs them on the hosts and restarts the components. Answers 202 with operation_id. Permission pki:manage. Errors: 404 cluster_not_found, 409 no_certificates_to_rotate. Audited as pki.rotate.

Route: /api/v1/clusters/{cluster_id}/certificates/rotate (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noOptional service to limit the rotation to.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Rotate the service certificates of a cluster".

Raises: the typed errors of the transport (Errors).

Class RestoresApi​

Backup, restore and disaster recovery. The Backup & Recovery Manager: backup targets and plans, backup artefacts with their verifications, retention, restore tests, restores and disaster recovery (sites, plans, exercises, failovers, DNS and load balancer switches). Operations of this group of the Navin Manager API.

ManagerResource

RestoresApi.approve​

approve(planId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Approve a restore plan. Adds the approval of the caller; two approvals by people other than the requester are needed. Permission restore:execute. Errors: 403 restore_self_approval, 409 restore_not_approvable. Audited as restore.approve.

Route: /api/v1/restores/{plan_id}/approve (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the restore plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Approve a restore plan".

Raises: the typed errors of the transport (Errors).

RestoresApi.dryRun​

dryRun(planId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Dry run a restore plan. Checks the digest, decryption and compatibility without writing to the destination, and returns the recorded approvers. For a named destination it also checks its identity, emptiness and restricted role (checks.destination, checks.executor). A successful dry run does not authorize execution: two approvals are still required. Permission restore:execute. Audited as restore.dry_run.

Route: /api/v1/restores/{plan_id}/dry-run (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the restore plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Dry run a restore plan".

Raises: the typed errors of the transport (Errors).

RestoresApi.execute​

execute(planId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Execute an approved restore. Runs an approved plan with a destination: status executing and a durable execution_token are committed before any write. The artefact is checked again (size, digest, decryption), restored with pg_restore --single-transaction by the restricted role, then its rows are read back and compared with the backup inventory (result.inventory, rows, tables). Success: executed. Recorded failure: failed, rollback_performed: false, HTTP 502 restore_execution_failed; its nested result.error identifies the cause, including backup_corrupted, restore_target_busy or restore_execution_timeout. A process interruption can leave executing for manual inspection. Nothing is automatically rolled back or replayed. Pre-execution refusals include 409 restore_not_approved, 501 restore_executor_unavailable and 409 restore_target_changed. Permission restore:execute. Audited as restore.execute.started and restore.execute.

Route: /api/v1/restores/{plan_id}/execute (POST).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the restore plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Execute an approved restore".

Raises: the typed errors of the transport (Errors).

RestoresApi.list​

list(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the restore plans. The last 200 restore plans with their status and number of approvals. Permission backup:read.

Route: /api/v1/restores (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the restore plans".

Raises: the typed errors of the transport (Errors).

RestoresApi.plan​

plan(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Plan a restore. Creates a restore plan for a backup artefact: checks the compatibility of the backed up versions with the target versions (same major version) and lists the steps (verify artefact, verify destination, restore, verify restored). With target_name, the artefact must be an available pg_dump with a verification_inventory and the destination an empty PostgreSQL database owned by a restricted role; its identity is frozen in target_snapshot. Returns the plan (201). Permission restore:execute. Errors: 404 backup_artifact_not_found, 501 restore_executor_unavailable (unknown destination), 409 restore_target_invalid, 409 restore_target_not_empty, 422 restore_inventory_required. Audited as restore.plan.

Route: /api/v1/restores/plan (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noArtefact, environment, destination and target versions.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Plan a restore".

Raises: the typed errors of the transport (Errors).

RestoresApi.verify​

verify(planId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a restore plan. Returns the plan with its compatibility, steps, approvers and required_approvals (2). Permission backup:read; 404 restore_plan_not_found.

Route: /api/v1/restores/{plan_id} (GET).

NameTypeDefaultRequiredDescription
planIdstringyesIdentifier of the restore plan.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a restore plan".

Raises: the typed errors of the transport (Errors).

Class ServicesApi​

Platform Manager services operations.

ManagerResource

ServicesApi.action​

action(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run an action on a service. Starts an operation that runs the action on the components and hosts chosen (all by default) and returns operation_id. A rolling restart handles batch_size hosts at a time. reinstall also needs services:install. Permission services:operate. Errors: 409 service_unmanaged, 409 service_check_missing, 409 smoke_test_missing, 404 host_component_not_found, 409 approval_required. Audited as service.<action>.

Route: /api/v1/clusters/{cluster_id}/services/{service}/actions (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noAction, scope and batching.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run an action on a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.addComponent​

addComponent(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Add component instances to hosts. Starts an operation that installs the component on the hosts given (started unless the service is stopped) and returns operation_id with the ha checks. Permission services:install. Errors: 409 service_unmanaged, 404 component_unknown, 422 topology_invalid, 409 ha_requirements_not_met or ha_acknowledgement_required. Audited as service.component_add.

Route: /api/v1/clusters/{cluster_id}/services/{service}/components (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noComponent and target hosts.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Add component instances to hosts".

Raises: the typed errors of the transport (Errors).

ServicesApi.checkConnection​

checkConnection(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Check a connected service now. Runs the health check and the authenticated check of a connected service and records the result in its monitoring history. Returns service, health and health_details. Permission services:operate; 409 service_not_connected.

Route: /api/v1/clusters/{cluster_id}/services/{service}/connection/check (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Check a connected service now".

Raises: the typed errors of the transport (Errors).

ServicesApi.clientConfig​

clientConfig(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the client configuration of a service. Files a client needs to reach the service (path, content, mode), rendered from the catalog with the secrets redacted. Empty files when the service has none. Permission configs:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/client-config (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the client configuration of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.clusterAction​

clusterAction(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run an action on every service of a cluster. Starts one operation that runs the action on every managed service in scope (every service by default, or those of services, on every host or on hosts), in dependency order: a provider starts before its consumers and stops after them. restart stops every service in reverse order, then starts every service in order with the health checks; rolling_restart restarts each service by batches of batch_size hosts; restart_stale writes again the files and units of the instances whose configuration changed, then restarts them by batches; service_check runs the check of every service. Connected services, services being installed or uninstalled, an administrative state that forbids the action and instances in maintenance, being removed or on a decommissioned host are left out and listed in skipped with the reason. Returns services in dependency order, skipped, steps and operation_id; with dry_run nothing is created and operation_id is null. Permission services:operate. Errors: 409 bulk_nothing_to_do, 404 cluster_service_not_found, 409 profile_blocked, 409 approval_required (under banking-secure, stop and restarts need an approval for the service *). Audited as cluster.<action>.

Route: /api/v1/clusters/{cluster_id}/actions (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noAction, scope, batching and dry run.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run an action on every service of a cluster".

Raises: the typed errors of the transport (Errors).

ServicesApi.configure​

configure(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Save a new configuration version. Merges the properties sent over the current values, validates them against the parameter definitions and saves a new version. Returns version and stale_hosts. Permission configs:edit. Errors: 422 config_invalid (with the fields), 409 service_unmanaged. Audited as config.update (parameter names only).

Route: /api/v1/clusters/{cluster_id}/services/{service}/config (PUT).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noChanged properties and a note.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Save a new configuration version".

Raises: the typed errors of the transport (Errors).

ServicesApi.connectService​

connectService(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Connect an existing service. Registers an existing service of yours against the connect section of its catalog descriptor: no host, never installed, started or stopped by the Manager. The health check and the authenticated check of the method run first; refused credentials give 422 connect_invalid. In a production or pre-production cluster HTTPS, a verified certificate and an allowed method are required. Secret fields are sealed. Returns the service summary (201). Permission services:install. Audited as service.connect.

Route: /api/v1/clusters/{cluster_id}/services/connect (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noAddress, authentication and TLS settings of the existing service.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Connect an existing service".

Raises: the typed errors of the transport (Errors).

ServicesApi.disconnectService​

disconnectService(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Disconnect a connected service. Forgets a connected service and its sealed credentials; the service itself is left untouched. Permission services:install. Errors: 409 service_not_connected, 409 service_in_use while a consumer is bound to it. Audited as service.disconnect.

Route: /api/v1/clusters/{cluster_id}/services/{service}/connection (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Disconnect a connected service".

Raises: the typed errors of the transport (Errors).

ServicesApi.getMode​

getMode(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the administrative state of a service. Returns the administrative state (enabled, disabled, maintenance, quarantined, suspended), its reason, whether the service may run (run_authorized) the security lock of the cluster and modes, the documented effect of every mode. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/mode (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the administrative state of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.getService​

getService(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a service. The summary of the service plus its host_components (every instance with its state, health and version), its bindings to other services and its quick_links (web consoles rendered from the catalog). Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service} (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.health​

health(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the checks of a service. Liveness of every instance (health checks of the agent), readiness (service check) and functional smoke test, each with its status, results, error and time. Only a passed smoke test proves that the service works. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/checks (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the checks of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.hostAction​

hostAction(hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run an action on every component of a host. Starts one operation that starts, stops or restarts every component placed on the host, or only the components whose configuration changed (restart_stale), service after service in dependency order. Instances in maintenance and services whose administrative state forbids the action are left out and listed in skipped; with dry_run nothing is created and operation_id is null. Permission services:operate on the cluster of the host. Errors: 404 host_not_found, 409 bulk_nothing_to_do, 409 approval_required (under banking-secure, stop and restarts need an approval for the service host:<host id>). Audited as host.<action>.

Route: /api/v1/hosts/{host_id}/actions (POST).

NameTypeDefaultRequiredDescription
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noAction and dry run.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run an action on every component of a host".

Raises: the typed errors of the transport (Errors).

ServicesApi.hostComponentAction​

hostComponentAction(clusterId: string, service: string, component: string, hostId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run an action on one component instance. Like the service actions, limited to the component on one host. Returns operation_id. Permission services:operate (services:install for reinstall). Audited as service.<action>.

Route: /api/v1/clusters/{cluster_id}/services/{service}/components/{component}/hosts/{host_id}/actions (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
componentstringyesName of the component.
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
bodyunknown{}noAction to run.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run an action on one component instance".

Raises: the typed errors of the transport (Errors).

ServicesApi.install​

install(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Install services. Validates, gates and plans the install of one or more services, then creates the operation. Returns operation_id and the ha checks.

Route: /api/v1/clusters/{cluster_id}/services (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noServices to install with their placements and configuration.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Install services".

Raises: the typed errors of the transport (Errors).

ServicesApi.installServices​

installServices(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Install services. Validates, gates and plans the install of one or more services, then creates the operation. Returns operation_id and the ha checks.

Route: /api/v1/clusters/{cluster_id}/services (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noServices to install with their placements and configuration.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Install services".

Raises: the typed errors of the transport (Errors).

ServicesApi.listServices​

listServices(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the services of a cluster. Every service of the cluster with its display_name, mode, method, managed, state, health, version, components and their hosts, hosts with a stale configuration, config_version, open alerts, administrative state, delivery (install or connect) and connection. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the services of a cluster".

Raises: the typed errors of the transport (Errors).

ServicesApi.lockCluster​

lockCluster(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Set the security lock of a cluster. Locks the cluster after a security incident: every new operation is refused with 423 cluster_security_locked, except a security suspension or an emergency stop, until a security administrator lifts it. Returns cluster_id and security_lock. Permission pki:manage. Audited as cluster.security_lock.

Route: /api/v1/clusters/{cluster_id}/security-lock (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noReason of the lock.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Set the security lock of a cluster".

Raises: the typed errors of the transport (Errors).

ServicesApi.removeComponent​

removeComponent(clusterId: string, service: string, component: string, hostId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Remove a component instance from a host. Starts an operation that stops and removes the component on that host and returns operation_id with the ha checks. Permission services:install. Errors: 404 host_component_not_found, 422 topology_invalid (the topology would break the rules of the service), 409 ha_requirements_not_met or ha_acknowledgement_required. Audited as service.component_remove.

Route: /api/v1/clusters/{cluster_id}/services/{service}/components/{component}/hosts/{host_id} (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
componentstringyesName of the component, as declared by the catalog service, for example server.
hostIdstringyesIdentifier of the host, a machine registered by its Navin agent.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Remove a component instance from a host".

Raises: the typed errors of the transport (Errors).

ServicesApi.rollback​

rollback(clusterId: string, upgradeId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Roll an upgrade back. Starts the operation that replays the sealed tasks of the previous release and restores the previous configuration version. Refused when the descriptor declares it impossible or an irreversible migration ran (use the restore instead). Returns operation_id. Permission services:install; 404 upgrade_not_found. Audited as service.rollback.

Route: /api/v1/clusters/{cluster_id}/upgrades/{upgrade_id}/rollback (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
upgradeIdstringyesIdentifier of the upgrade.
bodyunknown{}noOptional approval.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Roll an upgrade back".

Raises: the typed errors of the transport (Errors).

ServicesApi.serviceAction​

serviceAction(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run an action on a service. Starts an operation that runs the action on the components and hosts chosen (all by default) and returns operation_id. A rolling restart handles batch_size hosts at a time. reinstall also needs services:install. Permission services:operate. Errors: 409 service_unmanaged, 409 service_check_missing, 409 smoke_test_missing, 404 host_component_not_found, 409 approval_required. Audited as service.<action>.

Route: /api/v1/clusters/{cluster_id}/services/{service}/actions (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noAction, scope and batching.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run an action on a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.serviceCommand​

serviceCommand(clusterId: string, service: string, command: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Run a custom command of a service. Starts an operation running a command declared by the catalog service (for example a vacuum or a rebalance) with its parameters and returns operation_id. Permission services:operate. Errors: 409 service_unmanaged, 404 command_unknown, 422 command_params_invalid, 404 host_component_not_found. Audited as service.command (parameter names only).

Route: /api/v1/clusters/{cluster_id}/services/{service}/commands/{command} (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
commandstringyesName of the command, as declared by the catalog service.
bodyunknown{}noParameters of the command and optional target host.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Run a custom command of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.serviceDashboardView​

serviceDashboardView(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the monitoring dashboard of a service. Monitoring dashboard of a service over [from, to] (default: the last hour): instances, health and latest checks, availability over the period, metrics of its hosts, alerts, operations, configuration and, for a connected service, its connection. Permission cluster:read.

Route: /api/v1/clusters/{cluster_id}/services/{service}/dashboard (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the monitoring dashboard of a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.serviceLogs​

serviceLogs(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Fetch the logs of a component instance. Starts an operation where the agent of the host reads the last lines of the component logs. Returns operation_id and task_id: read the lines with GET /operations/{operation_id}/tasks/{task_id}/logs. Permission services:operate. Audited as service.logs.

Route: /api/v1/clusters/{cluster_id}/services/{service}/logs (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noHost, component and number of lines.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Fetch the logs of a component instance".

Raises: the typed errors of the transport (Errors).

ServicesApi.setMode​

setMode(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Apply an operating mode to a service. Applies one mode and returns the administrative state left behind, its documented effect on new requests and transactions in flight, the operation_id when the mode stops processes, and the informative ha impact:

Route: /api/v1/clusters/{cluster_id}/services/{service}/mode (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noMode, reason and drain timeout.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Apply an operating mode to a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.uninstallService​

uninstallService(clusterId: string, service: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Uninstall a service. Starts the uninstall operation (stop, remove packages and, with purge_data, the data) and returns operation_id. Permission services:install. Errors: 409 service_in_use (consumers listed in details.consumers), 409 service_connected (use DELETE .../connection), 409 approval_required under banking-secure. Audited as service.uninstall.

Route: /api/v1/clusters/{cluster_id}/services/{service} (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Uninstall a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.unlockCluster​

unlockCluster(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Lift the security lock of a cluster. Lifts the lock: new operations are accepted again. Returns cluster_id and security_lock (null). Permission pki:manage (security role). Audited as cluster.security_unlock.

Route: /api/v1/clusters/{cluster_id}/security-lock (DELETE).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Lift the security lock of a cluster".

Raises: the typed errors of the transport (Errors).

ServicesApi.updateConnection​

updateConnection(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update a connected service. Changes the address, the credentials (rotation) or the TLS settings of a connected service; a value left out keeps the stored one. With dry_run the change is checked like a connect validation and not saved. Credentials the service refuses are never saved (422 connect_invalid). Permission services:install; 409 service_not_connected. Audited as service.connection.update (field names only, never values).

Route: /api/v1/clusters/{cluster_id}/services/{service}/connection (PATCH).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noFields of the connection to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update a connected service".

Raises: the typed errors of the transport (Errors).

ServicesApi.upgrade​

upgrade(clusterId: string, service: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Upgrade a service. Upgrades the service to the catalog release in one operation:

Route: /api/v1/clusters/{cluster_id}/services/{service}/upgrade (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
servicestringyesName of the catalog service, for example postgresql or keycloak.
bodyunknown{}noCanary host and optional approval.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Upgrade a service".

Raises: the typed errors of the transport (Errors).

ServicesApi.validateConnect​

validateConnect(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Check a connection before saving it. Dry run of a connect: checks the request against the descriptor, then runs the health check and the authenticated check of the method. Returns the verdict with the errors; nothing is saved. Permission services:install.

Route: /api/v1/clusters/{cluster_id}/services/connect/validate (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noSame body as a connect.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Check a connection before saving it".

Raises: the typed errors of the transport (Errors).

ServicesApi.validateServices​

validateServices(clusterId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Validate an install without running it. Checks an install request and previews it without changing anything. Returns ok, errors (each with service, field, code, message_i18n), plan (order, number of stages, steps), ha (high availability checks) and dependencies (items and added). Permission services:install.

Route: /api/v1/clusters/{cluster_id}/services/validate (POST).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
bodyunknown{}noSame body as an install.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Validate an install without running it".

Raises: the typed errors of the transport (Errors).

Class SettingsApi​

Settings. General settings of the Manager: site name, default language, install defaults (preferred method, registry, mirror), SMTP and remote syslog for the alert notifications (syslog also serves the remote audit rule of banking-secure), data retention and the corporate proxy of the managed hosts. Every signed in user reads the non secret values; settings:manage (global) writes them. The SMTP password is read back as {"secret": true, "set": true|false}. Changes are audited (settings.update). Operations of this group of the Navin Manager API.

ManagerResource

SettingsApi.getSettingsView​

getSettingsView(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the settings. Returns site_name, default_language, install, smtp, syslog, retention and proxy, secrets masked. Any signed in user.

Route: /api/v1/settings (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the settings".

Raises: the typed errors of the transport (Errors).

SettingsApi.putSettings​

putSettings(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update the settings. Changes the sections and fields given; a section or field left out is kept. Returns the settings. Permission settings:manage. Errors: 422 proxy_invalid (proxy URL with credentials or not http(s)), 422 validation_error. Audited as settings.update.

Route: /api/v1/settings (PUT).

NameTypeDefaultRequiredDescription
bodyunknown{}noSections of the settings to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update the settings".

Raises: the typed errors of the transport (Errors).

Class StackApi​

Stack catalog. The catalog of services the Manager can install (the stack): every service with its versions, components, install methods, parameters, dependencies and high availability rules. Any signed in user can read it; no permission is needed. Operations of this group of the Navin Manager API.

ManagerResource

StackApi.highAvailability​

highAvailability(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the high availability matrix of the catalog. High availability matrix of every catalog service, sorted by category then name: its modes (topologies) with the cardinality of each component, and its high availability block with the liveness and readiness checks. Returns items and count. Any signed in user.

Route: /api/v1/catalog/high-availability (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the high availability matrix of the catalog".

Raises: the typed errors of the transport (Errors).

StackApi.service​

service(name: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a catalog service. Public description of one catalog service: components, modes, methods, delivery, layer and high availability. Any signed in user; 404 for an unknown service.

Route: /api/v1/stack/services/{name} (GET).

NameTypeDefaultRequiredDescription
namestringyesName of the catalog service, for example postgresql.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a catalog service".

Raises: the typed errors of the transport (Errors).

StackApi.stack​

stack(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the catalog summary. Name, version and categories of the stack and a summary of every service it offers (components, modes, dependencies, licence). Any signed in user.

Route: /api/v1/stack (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the catalog summary".

Raises: the typed errors of the transport (Errors).

Class SystemApi​

System. Self monitoring of the Manager: health of the database, the engine, the agents and the scheduled jobs, the list of supported operating systems and the Prometheus service discovery of a cluster. Permissions: system:read for the health, cluster:read for the service discovery; the supported systems are open to every signed in user. Operations of this group of the Navin Manager API.

ManagerResource

SystemApi.health​

health(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the health of the Manager. Returns version, database (ok, latency_ms), engine (leader, last_tick_at, lag_s, queued_tasks), agents (online: heartbeat in the last 60 seconds, lost, total) and scheduler.jobs (last run and last error of each job). Permission system:read.

Route: /api/v1/system/health (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the health of the Manager".

Raises: the typed errors of the transport (Errors).

SystemApi.prometheusSd​

prometheusSd(clusterId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Prometheus service discovery of a cluster. Targets in the Prometheus HTTP service discovery format: one group per component instance exposing metrics, with targets (fqdn:port) and the labels __metrics_path__, __scheme__, nm_cluster, nm_service, nm_component, nm_host. Permission cluster:read; 404 cluster_not_found.

Route: /api/v1/clusters/{cluster_id}/sd/prometheus (GET).

NameTypeDefaultRequiredDescription
clusterIdstringyesIdentifier of the cluster (an environment of hosts or a Kubernetes cluster managed by the Navin Manager).
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Prometheus service discovery of a cluster".

Raises: the typed errors of the transport (Errors).

SystemApi.supportedOs​

supportedOs(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the supported operating systems. Published list of the operating systems and versions the agents and the services support. Any signed in user.

Route: /api/v1/system/supported-os (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the supported operating systems".

Raises: the typed errors of the transport (Errors).

Class TelemetryApi​

Telemetry. State of the real time export of the metrics and events of the Manager to ClickHouse. The platform ships no dashboard server (ADR-0169): machines and services are followed in the Manager itself and the exported tables are read with SQL. The export is off while no ClickHouse URL is configured. Any principal that reads at least one cluster (cluster:read, global or on a cluster). Operations of this group of the Navin Manager API.

ManagerResource

TelemetryApi.telemetry​

telemetry(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get the telemetry export state. Returns enabled, database, flush_seconds, retention_days, stats (buffered, written, dropped, failures, last_error) and the exported tables. Permission cluster:read on at least one cluster.

Route: /api/v1/telemetry (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get the telemetry export state".

Raises: the typed errors of the transport (Errors).

Class UsersApi​

Users and roles. Administration of the console accounts and of their role bindings. Operations of this group of the Navin Manager API.

ManagerResource

UsersApi.createUser​

createUser(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Create a local user. Creates a local account with its password and role bindings and returns it (201). Permission users:manage. Errors: 409 username_taken, 422 password_policy, 422 role_invalid, 422 role_global_only, 422 binding_cluster_not_found, 403 user_manage_denied (granting admin without being a full administrator). Audited as user.create.

Route: /api/v1/users (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe new account.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Create a local user".

Raises: the typed errors of the transport (Errors).

UsersApi.deleteUser​

deleteUser(userId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete a user. Deletes the account. Answers 204. Permission users:manage. Errors: 404 user_not_found, 409 cannot_delete_self, 409 last_admin, 403 user_manage_denied. Audited as user.delete.

Route: /api/v1/users/{user_id} (DELETE).

NameTypeDefaultRequiredDescription
userIdstringyesIdentifier of the user account of the console.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete a user".

Raises: the typed errors of the transport (Errors).

UsersApi.getUser​

getUser(userId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a user. Returns the account with its role bindings (role, cluster_id, source). Permission users:read; 404 user_not_found.

Route: /api/v1/users/{user_id} (GET).

NameTypeDefaultRequiredDescription
userIdstringyesIdentifier of the user account of the console.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a user".

Raises: the typed errors of the transport (Errors).

UsersApi.listUsers​

listUsers(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Page<Doc>>

List the users. Users sorted by username, each with its role bindings, MFA state, lock and last sign in. Paginated with limit and cursor. Permission users:read.

Route: /api/v1/users (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Page<Doc>>. Decoded JSON answer of the operation "List the users".

Raises: the typed errors of the transport (Errors).

UsersApi.patchUser​

patchUser(userId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update or disable a user. Changes the fields given, keeps the others, and returns the user. Disabling an account revokes its sessions at once. Permission users:manage. Errors: 404 user_not_found, 409 cannot_disable_self, 409 last_admin, 403 user_manage_denied. Audited as user.update.

Route: /api/v1/users/{user_id} (PATCH).

NameTypeDefaultRequiredDescription
userIdstringyesIdentifier of the user account of the console.
bodyunknown{}noFields of the user to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update or disable a user".

Raises: the typed errors of the transport (Errors).

UsersApi.putRoles​

putRoles(userId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Replace the role bindings of a user. Replaces the manual bindings by the list given; bindings synchronized from LDAP or OIDC are kept. When a new role requires MFA and the user has none, its sessions are revoked. Returns the user. Permission users:manage. Errors: 409 last_admin, 422 role_invalid, 422 role_global_only, 422 binding_cluster_not_found, 403 user_manage_denied. Audited as user.roles with the bindings before and after.

Route: /api/v1/users/{user_id}/roles (PUT).

NameTypeDefaultRequiredDescription
userIdstringyesIdentifier of the user account of the console.
bodyunknown{}noThe complete list of manual bindings.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Replace the role bindings of a user".

Raises: the typed errors of the transport (Errors).

UsersApi.resetMfa​

resetMfa(userId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Reset the second factor of a user. Turns MFA off for the user, deletes its secret and recovery codes and revokes its sessions; the user enrolls again at the next sign in when its role requires MFA. Returns the user. Permission users:manage. Audited as user.mfa_reset.

Route: /api/v1/users/{user_id}/mfa/reset (POST).

NameTypeDefaultRequiredDescription
userIdstringyesIdentifier of the user account of the console.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Reset the second factor of a user".

Raises: the typed errors of the transport (Errors).

UsersApi.resetPassword​

resetPassword(userId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Set the password of a local user. Sets a new password following the policy, unlocks the account and revokes its sessions. Answers 204. Permission users:manage. Errors: 409 not_local_user, 422 password_policy, 404 user_not_found, 403 user_manage_denied. Audited as user.password_reset.

Route: /api/v1/users/{user_id}/password (POST).

NameTypeDefaultRequiredDescription
userIdstringyesIdentifier of the user account of the console.
bodyunknown{}noThe new password and whether it must be changed at the next sign in.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Set the password of a local user".

Raises: the typed errors of the transport (Errors).

UsersApi.roles​

roles(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the roles and their permissions. Every role with its name, its label in both languages, its sorted permissions and its scopes (global, and cluster when it can be bound to one cluster). Permission users:read.

Route: /api/v1/roles (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the roles and their permissions".

Raises: the typed errors of the transport (Errors).

UsersApi.unlockUser​

unlockUser(userId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Unlock a user. Clears the lock set after repeated failed sign ins and resets the failure counter. Returns the user. Permission users:manage. Audited as user.unlock.

Route: /api/v1/users/{user_id}/unlock (POST).

NameTypeDefaultRequiredDescription
userIdstringyesIdentifier of the user account of the console.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Unlock a user".

Raises: the typed errors of the transport (Errors).

Class VaultApi​

Vault. The vault of the platform administrators: the credentials of the platform services. An entry is a service name, its URL, a login, a password and an API key or secret key. Only the name is stored in clear; URL, login, password and key are one document sealed with AES-256-GCM and the master key. Lists and sheets never carry the password nor the key (has_password, has_api_key); POST .../reveal returns them and is audited, the audit keeping the service name only, never a value. Operations of this group of the Navin Manager API.

ManagerResource

VaultApi.createEntry​

createEntry(body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Add a vault entry. Creates a manual entry and returns it (201). Permission vault:manage. Errors: 409 vault_name_taken, 422 vault_name_required. Audited as vault.create.

Route: /api/v1/vault/entries (POST).

NameTypeDefaultRequiredDescription
bodyunknown{}noThe service and its credentials.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Add a vault entry".

Raises: the typed errors of the transport (Errors).

VaultApi.deleteEntry​

deleteEntry(entryId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Delete a vault entry. Deletes the entry. Answers 204. Permission vault:manage; 404 vault_entry_not_found. Audited as vault.delete.

Route: /api/v1/vault/entries/{entry_id} (DELETE).

NameTypeDefaultRequiredDescription
entryIdstringyesIdentifier of the vault entry.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Delete a vault entry".

Raises: the typed errors of the transport (Errors).

VaultApi.getEntry​

getEntry(entryId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Get a vault entry. Returns the sheet of one entry without its password nor key. Permission vault:manage; 404 vault_entry_not_found.

Route: /api/v1/vault/entries/{entry_id} (GET).

NameTypeDefaultRequiredDescription
entryIdstringyesIdentifier of the vault entry.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Get a vault entry".

Raises: the typed errors of the transport (Errors).

VaultApi.importEntries​

importEntries(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Import the credentials of the installed services. Creates or refreshes the entries of the installed services of every cluster; fields changed by hand are kept. Returns the names of the entries by outcome. Permission vault:manage. Audited as vault.import.

Route: /api/v1/vault/import (POST).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Import the credentials of the installed services".

Raises: the typed errors of the transport (Errors).

VaultApi.listEntries​

listEntries(query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

List the vault entries. Services of the vault sorted by name, with their URL and login but without their password nor key. Permission vault:manage.

Route: /api/v1/vault/entries (GET).

NameTypeDefaultRequiredDescription
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "List the vault entries".

Raises: the typed errors of the transport (Errors).

VaultApi.revealEntry​

revealEntry(entryId: string, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Reveal the password and key of an entry. Returns the password and the key of one service in clear, to show and copy them in the console. Permission vault:manage; 404 vault_entry_not_found. Audited as vault.reveal (service name only).

Route: /api/v1/vault/entries/{entry_id}/reveal (POST).

NameTypeDefaultRequiredDescription
entryIdstringyesIdentifier of the vault entry.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Reveal the password and key of an entry".

Raises: the typed errors of the transport (Errors).

VaultApi.updateEntry​

updateEntry(entryId: string, body: unknown = {}, query: ManagerQuery = {}, opts: ManagerCallOptions = {}): Promise<Doc>

Update a vault entry. Changes the fields given and returns the entry. Permission vault:manage. Errors: 404 vault_entry_not_found, 409 vault_name_taken, 422 vault_name_required, 409 vault_entry_managed (credentials of a console the Manager rotates). Audited as vault.update (field names only).

Route: /api/v1/vault/entries/{entry_id} (PATCH).

NameTypeDefaultRequiredDescription
entryIdstringyesIdentifier of the vault entry.
bodyunknown{}noFields of the entry to change.
queryManagerQuery{}noQuery string parameters of the route.
optsManagerCallOptions{}noPer call options (query, idempotency key, traceparent, headers).

Returns: Promise<Doc>. Decoded JSON answer of the operation "Update a vault entry".

Raises: the typed errors of the transport (Errors).

Type alias MANAGER_OPERATIONS​

operationId -> [group, method, HTTP method, path template].

Definition: Record<string, readonly [string, string, string, string]>.

Type alias MANAGER_EXEMPT​

Operations deliberately not wrapped, with the reason.

Definition: Record<string, string>.

Functions​

managerGroups​

managerGroups(http: HttpClient)

Every sub-client of ManagerClient, keyed by property name.

NameTypeDefaultRequiredDescription
httpHttpClientyesHTTP client shared by the sub-clients of one client.