resources/platform.ts

Source: sdks/typescript/packages/sdk/src/resources/platform.ts. Back to the TypeScript SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Type alias StorageProvider

Object storage provider: aws_s3, azure_blob, gcs, ibm_cos, s3_compatible or seaweedfs.

Definition: "aws_s3" \| "azure_blob" \| "gcs" \| "ibm_cos" \| "s3_compatible" \| "seaweedfs".

Interface StorageProfileFields

Updatable fields of a storage profile (contract storage-profile); credentials are references only.

Fields:

Name	Type	Required	Description
auth	Doc	no	Authentication settings, with references instead of secret values.
credential_ref	string	no	Reference of the credential in the secret store; the credential itself is never sent.
description	string	no	Description of the profile.
encryption	Doc	no	Encryption settings of the stored objects.
endpoint	string	no	Address of the storage service.
key_prefix	string	no	Prefix added to every object key of the profile.
options	Doc	no	Provider specific options.
presign_prefixes	string[]	no	Prefixes under which presigned URLs and listings are allowed.
purposes	string[]	no	Uses the profile serves.
region	string	no	Region of the bucket.
required_capabilities	string[]	no	Capabilities the verification must find on the bucket.

Interface StorageProfileCreate

Body of StorageProfilesResource.create: name, provider, bucket, scope and the profile fields.

StorageProfileFields

Fields:

Name	Type	Required	Description
name	string	yes	Name of the profile.
provider	StorageProvider	yes	Object storage provider of the profile.
bucket	string	yes	Bucket or container; for filesystem, the root directory.
scope	"platform" | "tenant"	no	What is backed up (clusters, services, data sets), as an object.

Interface StorageProfileUpdate

Body of StorageProfilesResource.update: the profile fields, bucket and status.

StorageProfileFields

Fields:

Name	Type	Required	Description
bucket	string	no	Bucket or container; for filesystem, the root directory.
status	"active" | "disabled"	no	active or disabled.

Class StorageProfilesResource

Storage. Storage profiles: the client buckets and containers the platform writes to (audit exports, evidence, documents, media, exports, backups), with their credential reference and their capabilities discovered by real calls.

Resource

StorageProfilesResource.checks

checks(profileId: string, query: { limit?: number } = {}, opts?: CallOptions)

List the verifications of a profile. History of the capability verifications of the profile, newest first: status, capabilities found, missing capabilities, whether a write probe ran, error, duration in milliseconds and who ran it. One page only (next_cursor is always null). Same readers as the list.

Route: /v1/storage/profiles/{profile_id}/checks (GET).

Name	Type	Default	Required	Description
profileId	string		yes	Identifier (UUID) of the storage profile.
query	{ limit?: number }	{}	no	Query string parameters of the route.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

StorageProfilesResource.create

create(body: StorageProfileCreate, opts?: CallOptions)

Create a storage profile. Creates a profile with status unverified and answers 201. Requires tenant_admin for scope tenant (inside a tenant) or platform_admin for scope platform (403 storage_scope_forbidden), and the policy decision storage.profile.create. Audited (storage.profile.create).

Route: /v1/storage/profiles (POST).

Name	Type	Default	Required	Description
body	StorageProfileCreate		yes	The new storage profile. Unknown fields are refused.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

StorageProfilesResource.delete

delete(profileId: string, opts?: CallOptions)

Delete a storage profile. Deletes the profile (the bucket and its objects are not touched) and answers 204. Requires tenant_admin for a tenant profile, platform_admin for a platform profile (403 storage_scope_forbidden), and the policy decision storage.profile.delete. The audit event storage.profile.delete records the provider, bucket and the number of audit exports that used it. Unknown id: 404 storage_profile_not_found.

Route: /v1/storage/profiles/{profile_id} (DELETE).

Name	Type	Default	Required	Description
profileId	string		yes	Identifier (UUID) of the storage profile.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

StorageProfilesResource.deleteObject

async deleteObject(profileId: string, key: string, body: StorageObjectDelete = {}, opts?: CallOptions): Promise<StorageObjectDeleted>

Delete an object of a profile. Deletes one object (or one version of it) inside the presign prefixes of the profile. A profile serving audit_worm or evidence never deletes through the API (409 storage_object_protected); a retention refusal of the backend is returned as is. Requires tenant_admin, developer or agent (platform profile: platform_admin) and the policy decision storage.object.delete; audited with the full key and version. Other errors: 403 storage_key_out_of_scope, 422 storage_key_invalid, 409 storage_profile_disabled.

Route: /v1/storage/profiles/{profile_id}/objects/delete (POST).

Name	Type	Default	Required	Description
profileId	string		yes	Identifier (UUID) of the storage profile.
key	string		yes	Key of the object relative to the profile key prefix, 1 to 1024 characters, inside a presign prefix; no control character, no leading /, no . or .. segment.
body	StorageObjectDelete	{}	no	Key, and optionally version, of the object to delete.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Returns: Promise<StorageObjectDeleted>. Decoded JSON answer of the operation "Delete an object of a profile".

Raises: EaiError, the typed errors of the transport (Errors).

StorageProfilesResource.get

get(profileId: string, opts?: CallOptions)

Get a storage profile. One storage profile with its status, discovered capabilities, verification time, missing and needed capabilities and last error. Never a secret value. Same readers as the list. Unknown id: 404 storage_profile_not_found.

Route: /v1/storage/profiles/{profile_id} (GET).

Name	Type	Default	Required	Description
profileId	string		yes	Identifier (UUID) of the storage profile.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

StorageProfilesResource.getObject

async getObject(profileId: string, key: string, body: { purpose?: string } = {}, opts?: CallOptions)

Reads one object: presign {scope: read} (policy checked, audited), then GET of the presigned URL.

Name	Type	Default	Required	Description
profileId	string		yes	Id of the storage profile.
key	string		yes	Key of the object, relative to the profile key_prefix.
body	{ purpose?: string }	{}	no	Request body, serialized as JSON.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

StorageProfilesResource.list

list(params?: ListParams & { provider?: string; purpose?: string; scope?: "platform" | "tenant" }, opts?: CallOptions)

List the storage profiles. Storage profiles visible to the caller, ordered by scope then name, each with its needed_capabilities (required capabilities plus those its purposes need). One page only: next_cursor is always null. Requires platform_admin, or a tenant principal with tenant_admin, security_officer, developer or auditor.

Route: /v1/storage/profiles (GET).

Name	Type	Default	Required	Description
params	ListParams & { provider?: string; purpose?: string; scope?: "platform" | "tenant" }		no	Extra fields merged into the request.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

StorageProfilesResource.listObjects

listObjects(profileId: string, query: StorageObjectQuery = {}, opts?: CallOptions)

List the objects of a profile. Objects stored under a prefix inside the presign prefixes of the profile: key relative to the profile key prefix (usable with presign and delete), stored key, size, ETag, content type, SHA-256, version, last modification and storage class. Requires tenant_admin, developer, agent or auditor (platform profile: platform_admin) and the policy decision storage.object.list; the listing is audited. Errors: 422 storage_prefix_required when prefix is omitted and the profile has not exactly one presign prefix, 403 storage_key_out_of_scope outside the presign prefixes, 409 storage_profile_disabled.

Route: /v1/storage/profiles/{profile_id}/objects (GET).

Name	Type	Default	Required	Description
profileId	string		yes	Identifier (UUID) of the storage profile.
query	StorageObjectQuery	{}	no	Query string parameters of the route.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

StorageProfilesResource.presign

presign(profileId: string, body: { key: string; scope: "read" | "write"; content_type?: string; expires_seconds?: number; purpose?: string }, opts?: CallOptions)

Issue a presigned URL. Issues a presigned URL to read (GET) or write (PUT) one object directly in the bucket, and answers 201 with the grant id, URL, method, full key, lifetime and expiry. The key must be inside the presign prefixes (403 storage_key_out_of_scope) and the profile must have a verified, recent presign capability (409 storage_capability_missing). The lifetime may not exceed EAI_STORAGE_PRESIGN_MAX_SECONDS (3600 by default, never more than 604800; 422 storage_presign_expiry_invalid). Requires tenant_admin, developer or agent (platform profile: platform_admin) and the policy decision storage.presign.read or storage.presign.write. The grant is recorded with a SHA-256 of the URL (never the URL itself) and audited.

Route: /v1/storage/profiles/{profile_id}/presign (POST).

Name	Type	Default	Required	Description
profileId	string		yes	Identifier (UUID) of the storage profile.
body	{ key: string; scope: "read" | "write"; content_type?: string; expires_seconds?: number; purpose?: string }		yes	Object, direction and lifetime of the presigned URL.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

StorageProfilesResource.putObject

async putObject(profileId: string, key: string, data: Uint8Array | string, body: { content_type?: string; purpose?: string; headers?: Record<string, string> } = {}, opts?: CallOptions)

Writes one object: presign {scope: write} (policy checked, audited), then PUT to the presigned URL.

Name	Type	Default	Required	Description
profileId	string		yes	Id of the storage profile.
key	string		yes	Key of the object, relative to the profile key_prefix.
data	Uint8Array | string		yes	Content of the object, bytes or text.
body	{ content_type?: string; purpose?: string; headers?: Record<string, string> }	{}	no	Request body, serialized as JSON.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

StorageProfilesResource.update

update(profileId: string, body: StorageProfileUpdate, opts?: CallOptions)

Update a storage profile. Changes the given fields; the merged profile is validated like a new one. A change of provider, endpoint, region, bucket, auth, credential_ref, encryption or options clears the capabilities and sets the status back to unverified; status: disabled disables the profile, status: active on a disabled profile makes it unverified. Adding the purpose audit_worm without such a change requires a verified object lock capability (409 storage_capability_missing). Requires tenant_admin (platform profile: platform_admin) and the policy decision storage.profile.update; audited with the changed fields.

Route: /v1/storage/profiles/{profile_id} (PATCH).

Name	Type	Default	Required	Description
profileId	string		yes	Identifier (UUID) of the storage profile.
body	StorageProfileUpdate		yes	Fields to change; omitted fields keep their value.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

StorageProfilesResource.verify

verify(profileId: string, body: { probe_write?: boolean } = {}, opts?: CallOptions)

Verify the capabilities of a profile. Discovers the capabilities of the bucket by real calls and stores them. Requires tenant_admin or security_officer (platform profile: platform_admin) and the policy decision storage.profile.verify. A disabled profile answers 409 storage_profile_disabled.

Route: /v1/storage/profiles/{profile_id}/verify (POST).

Name	Type	Default	Required	Description
profileId	string		yes	Identifier (UUID) of the storage profile.
body	{ probe_write?: boolean }	{}	no	Verification options; the body may be omitted.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

Interface StorageObjectQuery

Query of GET /v1/storage/profiles/{profile_id}/objects, every member optional.

Fields:

Name	Type	Required	Description
prefix	string	no	Inside the profile presign_prefixes; optional when the profile has exactly one.
limit	number	no	1 to 500.
cursor	string	no	Opaque cursor returned as next_cursor by the previous page. Omit it to read the first page.

Interface StorageObject

One object of StorageProfilesResource.listObjects: key, size, etag, digest, version and storage class.

Fields:

Name	Type	Required	Description
key	string	yes	Relative to the profile key_prefix, usable with presign and deleteObject.
object_key	string	yes	Key stored in the bucket.
size	number	yes	Size of the object in bytes.
etag	string | null	yes	ETag of the object, or null.
content_type	string | null	yes	Content type passed to the backend when the URL is signed (the type the upload is expected to send); 200 characters at most.
sha256	string | null	yes	SHA-256 digest of the object when known, or null.
version_id	string | null	yes	Version of the object to delete on a versioned bucket, 1 to 1024 characters. Omit it to delete the current version.
last_modified	string | null	yes	Time of the last change, or null.
storage_class	string | null	yes	Storage class of the object, or null.

Interface StorageObjectList

One page of StorageProfilesResource.listObjects.

Fields:

Name	Type	Required	Description
items	StorageObject[]	yes	Objects of the page.
next_cursor	string | null	yes	Cursor of the next page, null on the last page.
prefix	string	yes	Prefix that was listed.

Interface StorageObjectDelete

Options of POST /v1/storage/profiles/{profile_id}/objects/delete besides the key.

Fields:

Name	Type	Required	Description
version_id	string	no	Deletes this version on a versioned bucket.

Interface StorageObjectDeleted

Answer of deleteObject: deleted true, the key and the version id.

Fields:

Name	Type	Required	Description
deleted	true	yes	Always true; another answer makes deleteObject throw storage_delete_unconfirmed.
key	string	yes	Key of the deleted object, relative to the key prefix of the profile.
version_id	string | null	yes	Version of the object to delete on a versioned bucket, 1 to 1024 characters. Omit it to delete the current version.

Type alias MarketplaceEnvironment

Environment of a marketplace installation: dev, test, staging or prod.

Definition: "dev" \| "test" \| "staging" \| "prod".

Interface MarketplaceInstall

Body of MarketplaceResource.install and preflight: package, version, environment, permissions, configuration and secret references.

Fields:

Name	Type	Required	Description
package	string	yes	Name of the package.
version	string	yes	Version of the package to install.
environment	MarketplaceEnvironment	yes	Environment to install into.
approved_permissions	string[]	no	Permissions of the package approved for this installation.
config	Doc	no	Configuration of the installation.
secret_refs	Doc	no	References (names) of secrets kept in the secret store. Values are never sent or returned.

Interface MarketplacePublish

Body of MarketplaceResource.publish: the package archive with its signature, SBOM and test, evaluation and vulnerability reports.

Fields:

Name	Type	Required	Description
archive	string	yes	The .tar.gz pack, base64 encoded (up to 12 MiB of text).
evaluation_report	Doc	no	Evaluation report bound to the archive digest.
oci	Doc	no	OCI artifact of the pack; its digest is required later by the production gate.
sbom	Doc	no	Software bill of materials of the pack.
signature	string	no	Signature of the archive digest by a trusted publisher.
skill_signatures	Doc	no	Signatures of the skills of the pack, by skill name.
test_report	Doc	no	Test report bound to the archive digest.
vulnerability_scan	Doc	no	Vulnerability scan report bound to the archive digest.

Class MarketplaceResource

Signed packages, publishers and governed installations.

Resource

MarketplaceResource.advanceChange

advanceChange(id: string, body: { evidence?: Record<string, unknown>; approval_id?: string } = {}, opts?: CallOptions)

Advance a change to the next stage. Moves the change to the next stage. Needs tenant_admin, developer or security_officer. Gates per target stage: 1. test: only the author (or tenant_admin) leaves draft (403 change_not_author). 2. security_review: evidence.tests must pass (passed > 0, no failed, no errors), else 422 change_evidence_missing. 3. business_approval: approval change.security_review by a security_officer. 4. staging: approval change.business_approval by a tenant_admin. 5. production: passing staging_smoke, then approval change.production with a quorum of two. 6. monitoring: passing production_smoke. Without approval_id, a gated stage answers 202 with the approval to obtain; call again with the approved id to get 200. The author never approves. A closed change answers 409 change_closed.

Route: /v1/marketplace/changes/{change_id}/advance (POST).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the change request.
body	{ evidence?: Record<string, unknown>; approval_id?: string }	{}	no	Evidence to add and the approved request, when the stage needs one.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.apply

apply(id: string, opts?: CallOptions)

Apply an approved installation. Executes the pending install or upgrade once its approval is approved: the policy and the preflight are checked again, the objects of the pack are created inside a savepoint, the objects of the former version that are no longer part of it are removed and a smoke test runs. A failed smoke test rolls everything back and answers 422 smoke_failed. Needs tenant_admin. 409 installation_state when nothing is pending. Audited as marketplace.install or marketplace.upgrade.

Route: /v1/marketplace/installations/{installation_id}/apply (POST).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the installation.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.authorize

authorize(id: string, body: { permission: string }, opts?: CallOptions)

Check a runtime permission. Runtime permission check used by the pack MCP servers and connectors: allowed only when the installation is installed, the permission was granted, is not suspended and is not an external export denied by the data protection settings. Otherwise 403 with permission_not_granted, permission_suspended, installation_suspended or external_export_denied, recorded as an authorize_denied event. Needs tenant_admin, developer, agent or service.

Route: /v1/marketplace/installations/{installation_id}/authorize (POST).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the installation.
body	{ permission: string }		yes	Permission scope to check.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.createChange

createChange(body: { kind: string; ref: string; version: string; title?: string }, opts?: CallOptions)

Open a change request. Opens a change of a prompt, skill, connector, rule, model, policy, tool, agent or pack at stage draft. Needs tenant_admin or developer; the policy change.create is evaluated. Audited as change.create.

Route: /v1/marketplace/changes (POST).

Name	Type	Default	Required	Description
body	{ kind: string; ref: string; version: string; title?: string }		yes	Kind, object name, version and title of the change.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.createPublisher

createPublisher(body: { name: string; public_key: string }, opts?: CallOptions)

Add a trusted publisher key. Registers a public signing key for the tenant; pack signatures are verified against the active keys. Needs tenant_admin or security_officer. An unreadable key answers 422 publisher_invalid_key. Audited as marketplace.publisher.add.

Route: /v1/marketplace/publishers (POST).

Name	Type	Default	Required	Description
body	{ name: string; public_key: string }		yes	Publisher name and public key.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.getChange

getChange(id: string, opts?: CallOptions)

Get a change request. Returns the change with its stage, evidence, pending approval and history (one entry per transition with actor and time). 404 change_not_found.

Route: /v1/marketplace/changes/{change_id} (GET).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the change request.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.getInstallation

getInstallation(id: string, opts?: CallOptions)

Get an installation. Returns the installation: status, package and version, granted and suspended permissions, configuration, last preflight and smoke results, created objects and assets. 404 installation_not_found.

Route: /v1/marketplace/installations/{installation_id} (GET).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the installation.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.getPackage

getPackage(name: string, opts?: CallOptions)

Get a package and its versions. Returns the package and every version, oldest first, with gate results and a vulnerability summary. 404 marketplace_package_not_found.

Route: /v1/marketplace/packages/{name} (GET).

Name	Type	Default	Required	Description
name	string		yes	Name of the package.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.getVersion

getVersion(name: string, version: string, opts?: CallOptions)

Get a package version. Returns one version: manifest, digest, file digests, signature and its status, licence, OCI reference, gate results, provenance status and production approval. The archive and the SBOM are not included. 404 marketplace_version_not_found.

Route: /v1/marketplace/packages/{name}/versions/{version} (GET).

Name	Type	Default	Required	Description
name	string		yes	Name of the package.
version	string		yes	Semantic version, for example 1.2.0.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.install

install(body: MarketplaceInstall, opts?: CallOptions)

Request the installation of a pack. Opens an installation request and answers 202 with the installation, the approval_id, the quorum and the preflight report. Needs tenant_admin. Steps: 1. The preflight runs (see POST /v1/marketplace/preflight); a failure answers 403 permission_unsafe, 422 config_invalid, 422 permission_not_requested, 409 package_suspended or 422 preflight_failed. 2. An approval marketplace.install is opened for tenant_admin or security_officer: quorum 1 by default, at least 2 when a sensitive permission is granted or the environment is prod. 3. Once approved, call POST .../installations/{id}/apply. 409 installation_exists when the package is already installed or suspended in this environment.

Route: /v1/marketplace/installations (POST).

Name	Type	Default	Required	Description
body	MarketplaceInstall		yes	Package, version, environment, granted permissions, configuration and secret references.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.installationEvents

installationEvents(id: string, opts?: CallOptions)

List the events of an installation. Lifecycle history of the installation, oldest first: requests, installs, upgrades, rollbacks, failed smoke tests, suspensions, resumptions, refused authorizations, with versions, outcome and actor. One page only.

Route: /v1/marketplace/installations/{installation_id}/events (GET).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the installation.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.listChanges

listChanges(query: { kind?: string; ref?: string; stage?: string } = {}, opts?: CallOptions)

List the change requests. Change requests of the tenant, newest first, at most 200, optionally filtered by kind, reference and stage. Any tenant principal may call it.

Route: /v1/marketplace/changes (GET).

Name	Type	Default	Required	Description
query	{ kind?: string; ref?: string; stage?: string }	{}	no	Query string parameters of the route.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.listInstallations

listInstallations(query: { environment?: MarketplaceEnvironment } = {}, opts?: CallOptions)

List the installations. Installations of the tenant, oldest first, each with package, version and created assets. One page only.

Route: /v1/marketplace/installations (GET).

Name	Type	Default	Required	Description
query	{ environment?: MarketplaceEnvironment }	{}	no	Query string parameters of the route.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.listPackages

listPackages(query: { domain?: string } = {}, opts?: CallOptions)

List the packages. Packages of the catalogue in name order, with status, latest version, publisher and category. One page only.

Route: /v1/marketplace/packages (GET).

Name	Type	Default	Required	Description
query	{ domain?: string }	{}	no	Query string parameters of the route.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.listPublishers

listPublishers(opts?: CallOptions)

List the publishers. Trusted signing keys, by name: algorithm, status (active or revoked) and scope (platform for a key shared by every tenant, tenant for a key of this tenant). Public keys are not returned.

Route: /v1/marketplace/publishers (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.preflight

preflight(body: MarketplaceInstall, opts?: CallOptions)

Dry run the installation checks. Dry run of the installation checks, nothing is installed: package active, environment, configuration against the pack configSchema, version available (and in production for prod), platform compatibility, dependencies installed, archive digest, signature, permissions requested and safe, secret references of the connectors, approved model, no name conflict. Returns passed, every check, the granted, not granted and sensitive permissions, the approvals required and the data protection applied. Needs tenant_admin or security_officer. Audited as marketplace.preflight.

Route: /v1/marketplace/preflight (POST).

Name	Type	Default	Required	Description
body	MarketplaceInstall		yes	Same body as an installation request.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.promoteToProduction

promoteToProduction(name: string, version: string, body: { approval_id?: string } = {}, opts?: CallOptions)

Promote a version to production. Production gate, required to install a version in prod. Needs tenant_admin or security_officer. Steps: 1. Without approval_id: every stored gate must have passed, the signature must still verify and an OCI artifact digest must be attached (else 422 publication_gate_failed); then a marketplace.promote approval is opened with a quorum of at least two and the answer is 202 with the checks. 2. With the approved approval_id: the version becomes production (200). A version already in production answers 200 at once; 409 package_suspended while the kill switch is on.

Route: /v1/marketplace/packages/{name}/versions/{version}/production (POST).

Name	Type	Default	Required	Description
name	string		yes	Name of the package.
version	string		yes	Semantic version, for example 1.2.0.
body	{ approval_id?: string }	{}	no	Approved request, on the second call.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.publish

publish(body: MarketplacePublish, opts?: CallOptions)

Publish a package version. Publishes a pack archive as a new version (201). Needs tenant_admin or developer; the policy marketplace.publish is evaluated. Steps: 1. The archive is decoded (422 marketplace_archive_invalid) and scanned by ClamAV and YARA-X before unpacking (422 file_blocked, 503 file_scan_unavailable). 2. Every gate runs: schema, signature, SBOM, vulnerability scan, tests, evaluations, licence, permissions, documentation, secrets, provenance, privacy, security, approvals, configuration, resilience. Any failure answers 422 publication_gate_failed with the result of each gate. 3. The package is created on first publication. 409 package_suspended when its kill switch is on, 409 marketplace_version_exists for a version already published. Audited as marketplace.publish.

Route: /v1/marketplace/packages (POST).

Name	Type	Default	Required	Description
body	MarketplacePublish		yes	The pack archive and its supply chain evidence.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.rejectChange

rejectChange(id: string, body: { reason: string }, opts?: CallOptions)

Reject a change request. Closes the change at stage rejected from any open stage, with the reason kept in history. Needs tenant_admin or security_officer. 409 change_closed if already closed. Audited as change.reject.

Route: /v1/marketplace/changes/{change_id}/reject (POST).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the change request.
body	{ reason: string }		yes	Reason of the rejection.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.revokePublisher

revokePublisher(name: string, opts?: CallOptions)

Revoke a publisher. Revokes every key of the tenant registered under this name; signatures made with them no longer verify. Needs tenant_admin or security_officer. 404 publisher_not_found. Platform keys cannot be revoked here. Audited as marketplace.publisher.revoke.

Route: /v1/marketplace/publishers/{name}/revoke (POST).

Name	Type	Default	Required	Description
name	string		yes	Name of the publisher.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.rollback

rollback(id: string, opts?: CallOptions)

Roll back to the previous version. Reinstalls the previous version with its previous grant, inside a savepoint with a smoke test (422 smoke_failed keeps the current version). Needs tenant_admin. 409 installation_state unless installed; 409 rollback_unavailable when there is no previous version. Audited as marketplace.rollback.

Route: /v1/marketplace/installations/{installation_id}/rollback (POST).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the installation.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.sbom

sbom(name: string, version: string, opts?: CallOptions)

Get the SBOM of a version. Returns the software bill of materials stored at publication, its digest and the vulnerability scan report.

Route: /v1/marketplace/packages/{name}/versions/{version}/sbom (GET).

Name	Type	Default	Required	Description
name	string		yes	Name of the package.
version	string		yes	Semantic version, for example 1.2.0.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.setInstallationStatus

setInstallationStatus(id: string, body: { status: "suspended" | "installed"; reason?: string; permissions?: string[]; approval_id?: string }, opts?: CallOptions)

Suspend or resume an installation. Needs tenant_admin or security_officer. - status: suspended: immediate. Without permissions, the whole installation is suspended (tools blocked, agents suspended, MCP servers disabled, assets suspended); with permissions, only those granted capabilities (422 permission_not_granted for others). Answers 200. - status: installed: resume. Without approval_id, opens a marketplace.resume approval with a quorum of two and answers 202; with the approved id, lifts the suspension and answers 200. Refused with 409 package_suspended while the package kill switch is on. 409 installation_state for a state that does not allow the change.

Route: /v1/marketplace/installations/{installation_id}/status (POST).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the installation.
body	{ status: "suspended" | "installed"; reason?: string; permissions?: string[]; approval_id?: string }		yes	Target status, reason, capabilities to suspend and approval for a resumption.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.setPackageStatus

setPackageStatus(name: string, body: { status: "suspended" | "active"; reason?: string; approval_id?: string }, opts?: CallOptions)

Set the kill switch of a package. Needs tenant_admin or security_officer. - status: suspended: immediate. Every installed installation of the package is suspended; installs, upgrades, publications and promotions are refused. Answers 200 with suspended_installations. - status: active: lifts the kill switch. Without approval_id, opens a marketplace.package.resume approval with a quorum of two (202); with the approved id, the package and the installations it suspended resume (200 with resumed_installations). 409 installation_state when lifting a package that is not suspended.

Route: /v1/marketplace/packages/{name}/status (POST).

Name	Type	Default	Required	Description
name	string		yes	Name of the package.
body	{ status: "suspended" | "active"; reason?: string; approval_id?: string }		yes	Target status, reason and approval for a lifting.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.supervision

supervision(id: string, opts?: CallOptions)

Supervise an installed pack. Activity, quality, costs and incidents of an installed pack, aggregated from the objects it created: tool invocations and runs per state, refused authorizations, evaluation results, last smoke result, run success rate, run costs per currency, and the incidents naming its objects (50 most recent).

Route: /v1/marketplace/installations/{installation_id}/supervision (GET).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the installation.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.uninstall

uninstall(id: string, opts?: CallOptions)

Uninstall a pack. Removes every object and asset the installation created and sets it to uninstalled (grants, suspensions and previous version cleared). Allowed from installed, failed, pending_approval or suspended (else 409 installation_state). Needs tenant_admin; the policy marketplace.uninstall is evaluated. The answer lists removed. Audited as marketplace.uninstall.

Route: /v1/marketplace/installations/{installation_id}/uninstall (POST).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the installation.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

MarketplaceResource.upgrade

upgrade(id: string, body: { version: string; approved_permissions?: string[]; config?: Doc; secret_refs?: Doc }, opts?: CallOptions)

Request the upgrade of an installation. Opens an upgrade request to a higher version (202 with approval, quorum and preflight), then apply it with POST .../apply once approved. The installation must be installed and the version strictly higher (else 409 installation_state). Configuration and secret references default to the current ones. Needs tenant_admin. Preflight failures answer as for an installation request.

Route: /v1/marketplace/installations/{installation_id}/upgrade (POST).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the installation.
body	{ version: string; approved_permissions?: string[]; config?: Doc; secret_refs?: Doc }		yes	Target version, granted permissions, configuration and secret references.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

Type alias AUDIT_PATH_PREFIX

Prefix of the Audit Gateway routes (client.audit): every read under it and under /v1/evidence writes an access log row and its own audit event.

Class EvidenceResource

Evidence Service: seals, verification, legal holds, retention and run configuration evidence.

Resource

EvidenceResource.accessLog

accessLog(query: { limit?: number } = {}, opts?: CallOptions)

Read the audit access log. Returns the latest accesses to the audit trail, newest first: actor, roles, kind (read, search, verify, export, payload_decrypt, seal_read), query, number of results, reason and the audit event written. Needs auditor or security_officer. Reading the log is itself recorded.

Route: /v1/evidence/access-log (GET).

Name	Type	Default	Required	Description
query	{ limit?: number }	{}	no	Query string parameters of the route.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.alerts

alerts(query: { status?: "open" | "acknowledged" } = {}, opts?: CallOptions)

List the integrity alerts. Lists the integrity alerts of the tenant opened by the monitor: chain_broken, sequence_gap, seal_invalid, outbox_missing or clock_skew, refreshed while the problem persists. Needs auditor, security_officer or tenant_admin.

Route: /v1/evidence/alerts (GET).

Name	Type	Default	Required	Description
query	{ status?: "open" | "acknowledged" }	{}	no	Query string parameters of the route.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.bundle

bundle(opts?: CallOptions)

Export an offline evidence bundle. Returns bundle (events, seals and public keys of the tenant) and manifest (format, counts, SHA-256 of the canonical bundle, alg: Ed25519, key id, public key and signature by the seal key). An external auditor verifies it offline with python -m eai.domains.evidence.verify. Needs auditor or security_officer. Answers 503 audit_seal_key_unavailable without signing key. The export is recorded in the access log.

Route: /v1/evidence/bundle (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.createHold

createHold(body: { case_id: string; reason: string; time_from?: string; time_to?: string }, opts?: CallOptions)

Place an evidence legal hold. Places a legal hold on the payloads of the tenant for a case and an optional period of event time: while it is active, the payload retention purge and erasures skip the events it covers. time_to must be after time_from (400 invalid_request). Needs auditor, security_officer or tenant_admin. Writes the audit event audit.legal_hold.create. Answers 201 with the hold.

Route: /v1/evidence/holds (POST).

Name	Type	Default	Required	Description
body	{ case_id: string; reason: string; time_from?: string; time_to?: string }		yes	Case, reason and optional period of the hold.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.createSeal

createSeal(opts?: CallOptions)

Seal the audit chain now. Writes a seal over the events written since the previous seal (up to the platform maximum per seal) and returns it (201). Needs security_officer or auditor. Answers 409 audit_nothing_to_seal when no event is waiting, 503 audit_seal_key_unavailable without signing key.

Route: /v1/evidence/seals (POST).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.decryptPayload

decryptPayload(eventId: string, body: { reason: string }, opts?: CallOptions)

Decrypt the payload of an audit event. Returns the decrypted sensitive fields of one event in payload, with access_event_id, the audit event that records this access. Only auditor or security_officer held explicitly: platform_admin is not enough (403 forbidden). A reason is required. Errors: 404 not_found (no payload), 410 audit_payload_purged (expired or erased), 409 audit_payload_tampered (ciphertext digest mismatch), 503 audit_payload_key_unavailable.

Route: /v1/evidence/events/{event_id}/payload (POST).

Name	Type	Default	Required	Description
eventId	string		yes	Identifier (UUID) of the audit event.
body	{ reason: string }		yes	Reason of the decryption, written to the access log.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.gateway

gateway(opts?: CallOptions)

Get the Audit Gateway status. Returns the delivery state of the audit events of the tenant to the SIEM: configured targets, pending and delivered counts, max_attempts of a pending event and oldest_pending. Needs auditor, security_officer or tenant_admin.

Route: /v1/evidence/gateway (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.listHolds

listHolds(opts?: CallOptions)

List the evidence legal holds. Lists the legal holds of the tenant with their case, period, reason, status and release approvals. Needs auditor, security_officer or tenant_admin.

Route: /v1/evidence/holds (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.listSeals

listSeals(opts?: CallOptions)

List the audit seals. Lists the seals of the tenant chain: number, sequence range, Merkle root, first and last hashes, previous seal hash, key id, signature and date. Needs auditor, security_officer or tenant_admin. The read is recorded in the access log.

Route: /v1/evidence/seals (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.recordComponents

recordComponents(runId: string, body: { components: Doc[]; step_seq?: number }, opts?: CallOptions)

Record the components of a run. Records, append only, the versions of the components used by an agent run, or by one step of it with step_seq (tool call, model call). Each report is audited with the versions field of the Audit Event. Needs tenant_admin, agent_operator or developer. Answers 201 with the recorded items, or 404 not_found for an unknown run.

Route: /v1/evidence/runs/{run_id}/components (POST).

Name	Type	Default	Required	Description
runId	string		yes	Identifier (UUID) of the agent run.
body	{ components: Doc[]; step_seq?: number }		yes	Optional step and 1 to 100 components.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.releaseHold

releaseHold(id: string, body: { reason: string }, opts?: CallOptions)

Approve the release of a legal hold. Records one release approval with its reason. The hold is released at the second approval by a distinct approver; the same person twice answers 409 audit_hold_same_approver, a hold no longer active 409 audit_hold_not_active, an unknown hold 404. Needs auditor, security_officer or tenant_admin. Writes audit.legal_hold.release_approve, then audit.legal_hold.release.

Route: /v1/evidence/holds/{hold_id}/release (POST).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the legal hold.
body	{ reason: string }		yes	Reason of the approval.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.retentionEvidence

retentionEvidence(opts?: CallOptions)

List the purge evidence. Lists the purge evidence records of the tenant: kind, cutoff, purged and held counts, purged sequences and the Merkle root of the purged ciphertext digests, never the contents. Needs auditor, security_officer or tenant_admin.

Route: /v1/evidence/retention/evidence (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.runConfiguration

runConfiguration(runId: string, opts?: CallOptions)

Get the execution configuration of a run. Rebuilds the execution configuration of an agent run: agent version and manifest digest, components reported by kind (model, prompt, tool, skill, plugin) with their versions and digests, and the policy decisions recorded for the run. Needs auditor, security_officer or tenant_admin, agent_operator or developer. The read is recorded in the access log. Answers 404 not_found for an unknown run.

Route: /v1/evidence/runs/{run_id}/configuration (GET).

Name	Type	Default	Required	Description
runId	string		yes	Identifier (UUID) of the agent run.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.runRetention

runRetention(body: { kind?: "retention" | "erasure"; cutoff?: string; dry_run?: boolean; event_ids?: string[] }, opts?: CallOptions)

Purge expired audit payloads. Deletes encrypted audit payloads; the events, the chain and the seals stay and keep verifying.

Route: /v1/evidence/retention/run (POST).

Name	Type	Default	Required	Description
body	{ kind?: "retention" | "erasure"; cutoff?: string; dry_run?: boolean; event_ids?: string[] }		yes	Kind of purge, cutoff, events and simulation flag.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.verify

verify(opts?: CallOptions)

Verify the chain and every seal. Verifies the whole tenant chain and every seal and returns tenant_id, valid, chain (hash chain result), seals (count and failures), clock (timestamp failures) and events (number checked). Needs auditor, security_officer or tenant_admin. The verification is recorded in the access log.

Route: /v1/evidence/verify (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

EvidenceResource.verifySeal

verifySeal(id: string, opts?: CallOptions)

Verify an audit seal. Recomputes the seal from the events it covers and the seals before it and checks its signature. Returns seal, valid and failures. Needs auditor, security_officer or tenant_admin. Answers 404 not_found for an unknown seal. The verification is recorded in the access log.

Route: /v1/evidence/seals/{seal_id}/verify (GET).

Name	Type	Default	Required	Description
id	string		yes	Identifier (UUID) of the seal.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

Type alias PlatformManagerAction

Actions of a Platform Manager service operation (the Manager decides: RBAC, approvals, stop rules).

Definition: "start" \| "stop" \| "restart" \| "rolling_restart" \| "reinstall".

Interface PlatformManagerOperationOptions

Options of a Platform Manager operation request.

Fields:

Name	Type	Required	Description
components	string[]	no	Components to act on; null: every component.
hosts	string[]	no	Hosts the operation is limited to.
batch_size	number	no	Hosts handled at the same time, 1 to 100, default 1.
tolerate_failures	number	no	Host failures tolerated before the operation stops, 0 to 100, default 0.
approval_id	string	no	Identifier of the approved request (four-eyes approval) that authorizes this action.

Interface PlatformManagerInstallService

One service of an install request: the catalog mode and method, the hosts of each component, the configuration.

Fields:

Name	Type	Required	Description
name	string	yes	Catalog name of the service.
mode	string	no	Install mode of the catalog descriptor.
method	string	no	Name of the method, for example basic, token or none.
placements	Record<string	yes	Hosts of each component: component name to a list of up to 500 host ids; up to 50 components.
config	Record<string	no	Configuration of the service.
bindings	Record<string	no	Bindings of the service to other services or to connections, for example {kind: connection, ref: <connection id>}; up to 50.
version	string	no	Version to install.

Interface PlatformManagerInstallRequest

Body of the install routes (validate and install): 1 to 20 services.

Fields:

Name	Type	Required	Description
services	PlatformManagerInstallService[]	yes	Services to install, 1 to 20.
start	boolean	no	Start the services once installed. Default true.
service_check	boolean	no	Run the service checks after the install (default true).

Interface PlatformManagerConnectRequest

Configure & Connect: an existing service checked against the connect section of its catalog descriptor.

Fields:

Name	Type	Required	Description
name	string	yes	Catalog name of the service.
endpoint	string	yes	Address of the existing service.
credentials_ref	string	no	Reference such as secret://tenant/path, never a secret value.
tls_verify	boolean	no	Whether the TLS certificate of the server is verified. Keep it true outside a sandbox.
ca_pem	string	no	Private certificate authority of the service (PEM).
config	Record<string	no	Configuration of the connected service.
auth	{ method: string; fields?: Record<string, string> }	no	A method of connect.auth of the descriptor and its fields; the Manager checks them on the service and seals the secret ones.
mtls	{ client_cert?: string; client_key?: string }	no	Client certificate and private key (PEM) added to the method for mutual TLS.

Class PlatformManagerResource

Platform Manager space of the console (ADR-0128), platform_admin only. The Control Plane relays every call to the Navin Platform Manager on behalf of the caller; a Manager refusal comes back with its status and a platform_manager_<code> error.

Resource

PlatformManagerResource.approveDrExercise

approveDrExercise(exerciseId: string, opts?: CallOptions)

Approve a DR exercise. Adds the approval of the user to a DR exercise; the Manager refuses a self approval. Audited (platform_manager.dr.exercise.approve) with the new status. Requires platform_admin.

Route: /v1/platform-manager/dr/exercises/{exercise_id}/approve (POST).

Name	Type	Default	Required	Description
exerciseId	string		yes	Identifier of the DR exercise in the Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.approveRestore

approveRestore(planId: string, opts?: CallOptions)

Approve a restore plan. Adds the approval of the user to a restore plan; the Manager refuses a self approval and counts two distinct approvers. Audited (platform_manager.restore.approve) with the new status and approval count. Requires platform_admin.

Route: /v1/platform-manager/backup/restores/{plan_id}/approve (POST).

Name	Type	Default	Required	Description
planId	string		yes	Identifier of the restore plan in the Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.backupJobs

backupJobs(opts?: CallOptions)

List the backup jobs. Backup jobs of the Manager with their status, relayed on behalf of the user (backup:read there). Requires platform_admin.

Route: /v1/platform-manager/backup/jobs (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.backupPlans

backupPlans(opts?: CallOptions)

List the backup plans. Backup policies (scope, interval, retention, immutability) and the late or failed alerts of the Manager. Requires platform_admin.

Route: /v1/platform-manager/backup/plans (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.backups

backups(opts?: CallOptions)

List the backup artefacts. Backup artefacts with SHA-256, size and the outcome of their last verification, relayed from the Manager (backup:read there). Requires platform_admin.

Route: /v1/platform-manager/backup/backups (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.catalog

catalog(opts?: CallOptions)

List the Manager catalog. Services of the Manager catalog (stack name, version and categories) with their display names, category, version, components, modes, methods, requirements, delivery (install, connect, job, package), layer and licence. Requires platform_admin.

Route: /v1/platform-manager/catalog (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.catalogService

catalogService(service: string, opts?: CallOptions)

Get the install descriptor of a service. Install descriptor of one catalog service: modes with their components and cardinalities, methods, requirements, sections and parameters with their defaults. A secret parameter never carries a default and says whether it is generated; templates and artefacts never leave the bridge. Requires platform_admin.

Route: /v1/platform-manager/catalog/{service} (GET).

Name	Type	Default	Required	Description
service	string		yes	Name of the catalog service.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.clusters

clusters(opts?: CallOptions)

List the clusters. Clusters (environments) of the Navin Manager visible to the user. Requires platform_admin.

Route: /v1/platform-manager/clusters (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.connect

connect(clusterId: string, body: PlatformManagerConnectRequest, opts?: CallOptions)

Connect an existing service. Registers an existing service of the customer on behalf of the user and answers 201; the Manager checks services:install and the connect section of the descriptor, then health checks it. A connected service is never installed, started or stopped by the Manager. Secret fields are relayed and sealed by the Manager; the audit keeps the endpoint, TLS, method and field names only. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/connect (POST).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
body	PlatformManagerConnectRequest		yes	The service to connect.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.connections

connections(query: { type?: "postgresql" | "redis" | "oidc" } = {}, opts?: CallOptions)

List the connections. Existing connections of the types the portal binds (PostgreSQL, Redis, OIDC), filtered by type when given; the secret only says whether it is set. Needs connections:read in the Manager. Requires platform_admin.

Route: /v1/platform-manager/connections (GET).

Name	Type	Default	Required	Description
query	{ type?: "postgresql" | "redis" | "oidc" }	{}	no	Query string parameters of the route.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.console

console(opts?: CallOptions)

Get the console links. Whether the Manager is configured, the base address of its console (EAI_PLATFORM_MANAGER_CONSOLE_URL, else EAI_PLATFORM_MANAGER_URL) and the operator consoles (Opik, Grafana, Keycloak, LiteLLM, OpenSearch Dashboards): from their setting when set (source setting), else from the service of the same name the Manager installed or connected (source manager). A console address that is not https or that carries credentials is never returned (problem says why). Requires platform_admin.

Route: /v1/platform-manager/console (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.createCluster

createCluster(body: { name: string; mode?: "production" | "sandbox"; description?: string; profile?: "development" | "standard" | "banking-secure" | "air-gapped" | "hybrid" }, opts?: CallOptions)

Create a cluster. Creates a cluster (environment) in the Manager and answers 201; the delegated user needs clusters:create. Audited (platform_manager.cluster_create), allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/clusters (POST).

Name	Type	Default	Required	Description
body	{ name: string; mode?: "production" | "sandbox"; description?: string; profile?: "development" | "standard" | "banking-secure" | "air-gapped" | "hybrid" }		yes	Name, mode, description and profile of the cluster.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.createConnection

createConnection(body: { name: string; type: "postgresql" | "redis" | "oidc"; params?: Record<string, unknown>; secret?: string; description?: string }, opts?: CallOptions)

Save a connection. Saves an existing PostgreSQL, Redis or OIDC issuer as a Manager connection and answers 201 (the secret is sealed by the Manager and never returned). Install forms then bind a service to it. Needs connections:manage in the Manager. The audit keeps name, type, parameter keys and whether a secret was given. Requires platform_admin.

Route: /v1/platform-manager/connections (POST).

Name	Type	Default	Required	Description
body	{ name: string; type: "postgresql" | "redis" | "oidc"; params?: Record<string, unknown>; secret?: string; description?: string }		yes	The connection to save.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.createEnrollmentToken

createEnrollmentToken(clusterId: string, body: { expires_in_hours?: number; max_uses?: number } = {}, opts?: CallOptions)

Create an enrollment token. Bootstrap token of the node agent and the register command to run on each machine, answered with 201; shown once, the token and the command are never written to the audit (only its id and expiry). Needs hosts:manage in the Manager. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/enrollment-tokens (POST).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
body	{ expires_in_hours?: number; max_uses?: number }	{}	no	Lifetime and number of uses of the token.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.createVaultEntry

createVaultEntry(body: { name: string; url?: string; login?: string; password?: string; api_key?: string }, opts?: CallOptions)

Add a vault entry. Adds a service to the IT vault (source manual) and answers 201 without the password nor the key. URL, login, password and key are sealed together with AES-256-GCM (key derived from the platform master key, entry id as associated data); only the name is stored in clear. A name already used answers 409 it_vault_name_taken; an empty name 422 validation_failed. Audited (it_vault.create, name only). Requires platform_admin.

Route: /v1/platform-manager/vault/entries (POST).

Name	Type	Default	Required	Description
body	{ name: string; url?: string; login?: string; password?: string; api_key?: string }		yes	The service to add. Unknown fields are refused.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.decommissionHost

decommissionHost(hostId: string, opts?: CallOptions)

Decommission a machine. Decommissions a machine without components (agent stopped, certificate revoked) and answers 202 with the operation id. Audited (platform_manager.decommission), allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/hosts/{host_id}/decommission (POST).

Name	Type	Default	Required	Description
hostId	string		yes	Identifier of the machine in the Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.deleteConnection

deleteConnection(connectionId: string, opts?: CallOptions)

Delete a connection. Forgets a connection and answers 204; the Manager refuses (409 platform_manager_connection_in_use) while a service is bound to it. Needs connections:manage in the Manager. Audited, allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/connections/{connection_id} (DELETE).

Name	Type	Default	Required	Description
connectionId	string		yes	Identifier of the connection in the Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.deleteVaultEntry

deleteVaultEntry(entryId: string, opts?: CallOptions)

Delete a vault entry. Deletes a service of the IT vault and answers 204. An entry pre-filled from the platform settings comes back at the next import. Audited (it_vault.delete, name only). Unknown id: 404 it_vault_entry_not_found. Requires platform_admin.

Route: /v1/platform-manager/vault/entries/{entry_id} (DELETE).

Name	Type	Default	Required	Description
entryId	string		yes	Identifier (UUID) of the vault entry.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.disconnect

disconnect(clusterId: string, service: string, opts?: CallOptions)

Disconnect a connected service. Forgets a connected service (the service itself is untouched); the Manager refuses while a consumer uses it. Audited (platform_manager.disconnect), allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/{service}/connection (DELETE).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
service	string		yes	Name of the connected service.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.drExercises

drExercises(opts?: CallOptions)

List the DR exercises. DR exercises with the observed RPO and RTO and whether each target was met (null when not measured). Requires platform_admin.

Route: /v1/platform-manager/dr/exercises (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.drPlans

drPlans(opts?: CallOptions)

List the DR plans. DR plans: mode, primary and secondary sites, the client's RPO and RTO targets (null until set). Requires platform_admin.

Route: /v1/platform-manager/dr/plans (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.enrollmentTokens

enrollmentTokens(clusterId: string, opts?: CallOptions)

List the enrollment tokens. Bootstrap tokens of a cluster: prefix, expiry, uses and revocation (the token itself is never listed). Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/enrollment-tokens (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.host

host(hostId: string, opts?: CallOptions)

Get a machine. One machine with its facts (operating system, resources, agent version, last heartbeat). Requires platform_admin.

Route: /v1/platform-manager/hosts/{host_id} (GET).

Name	Type	Default	Required	Description
hostId	string		yes	Identifier of the machine in the Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.importVault

importVault(opts?: CallOptions)

Import the configured services into the vault. Pre-fills the vault with the services the platform is configured with (PostgreSQL, Redis, Keycloak, OpenBao, OpenFGA, OPA, LiteLLM, Qdrant, NATS, Temporal, LiveKit, Opik, ClickHouse, S3, Platform Manager, installer account of the portal), from the EAI_* settings. Only missing services are added: an entry is never overwritten, a deleted one comes back. Answers the created and skipped names. Audited (it_vault.import). The same import runs at each API start. Requires platform_admin.

Route: /v1/platform-manager/vault/import (POST).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.install

install(clusterId: string, body: PlatformManagerInstallRequest, opts?: CallOptions)

Install catalog services. Installs catalog services on the chosen hosts, on behalf of the user, and answers 202 with the operation id; the Manager checks services:install, the modes, methods, placements and configuration, then starts the install operation. The audit keeps services, modes, methods, hosts and configured keys, never the configuration values. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services (POST).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
body	PlatformManagerInstallRequest		yes	Services to install and install options.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.nodes

nodes(clusterId: string, opts?: CallOptions)

List the machines of a cluster. Hosts of the cluster as the Manager knows them (state, facts, agent). Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/nodes (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.operations

operations(clusterId: string, opts?: CallOptions)

List the operations of a cluster. Operations of the Manager on the cluster (install, start, stop, preflight, bootstrap...) with their target and status. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/operations (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.planRestore

planRestore(body: { artifact_id: string; environment: "isolated" | "staging" | "production"; target_versions?: Record<string, string> }, opts?: CallOptions)

Plan a restore. Plans a restore of one artefact and answers 201 with the plan; the plan always precedes an execution and needs two approvers other than the requester. The Manager compares the target versions with the artefact. Executing the restore stays in the Manager console. Audited (platform_manager.restore.plan), allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/backup/restores (POST).

Name	Type	Default	Required	Description
body	{ artifact_id: string; environment: "isolated" | "staging" | "production"; target_versions?: Record<string, string> }		yes	Artefact to restore and target environment.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.preflightResults

preflightResults(hostId: string, opts?: CallOptions)

Read the preflight results. Results of the last preflight checks of a machine (check, status, message in both languages). Requires platform_admin.

Route: /v1/platform-manager/hosts/{host_id}/preflight (GET).

Name	Type	Default	Required	Description
hostId	string		yes	Identifier of the machine in the Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.refreshFacts

refreshFacts(hostId: string, opts?: CallOptions)

Refresh the facts of a machine. Asks the node agent to collect the facts of the machine again (operating system, resources...) and answers 202 with the operation id. Audited (platform_manager.facts_refresh), allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/hosts/{host_id}/facts/refresh (POST).

Name	Type	Default	Required	Description
hostId	string		yes	Identifier of the machine in the Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.requestDrExercise

requestDrExercise(planId: string, opts?: CallOptions)

Request a DR exercise. Requests a DR exercise of a DR plan and answers 201; the Manager applies its approval rule (dr:manage there). Completing the exercise and a real failover stay in the Manager console. Audited (platform_manager.dr.exercise.request), allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/dr/exercises (POST).

Name	Type	Default	Required	Description
planId	string		yes	Identifier of the DR plan to exercise, 1 to 100 characters.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.requestOperation

requestOperation(clusterId: string, service: string, action: PlatformManagerAction, options: PlatformManagerOperationOptions = {}, opts?: CallOptions)

Request a service operation. Forwards an operation (start, stop, restart, rolling restart, reinstall) with the user's identity and answers 202 with the operation id; the Manager decides (RBAC, approvals, stop rules). Audited (platform_manager.<action>), allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/{service}/operations (POST).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
service	string		yes	Name of the service.
action	PlatformManagerAction		yes	start, stop, restart, rolling_restart or reinstall.
options	PlatformManagerOperationOptions	{}	no	Per call options (idempotency key, traceparent, headers, abort signal).
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.requestSupportBundle

requestSupportBundle(clusterId: string, opts?: CallOptions)

Request a support bundle. Asks the Manager for a sanitized support bundle (cluster:manage there) and answers 202 with the operation to follow and the bundle id; the bundle is downloaded from the Manager console. Audited (platform_manager.support_bundle), allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/support-bundles (POST).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.restores

restores(opts?: CallOptions)

List the restore plans. Restore plans with their status and approval count (two approvers other than the requester). Requires platform_admin.

Route: /v1/platform-manager/backup/restores (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.revokeEnrollmentToken

revokeEnrollmentToken(clusterId: string, tokenId: string, opts?: CallOptions)

Revoke an enrollment token. Revokes a bootstrap token of the node agent in the Manager (hosts:manage there) and answers 204; machines already enrolled are not affected. Audited (platform_manager.enrollment_token_revoke), allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/enrollment-tokens/{token_id} (DELETE).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
tokenId	string		yes	Identifier of the enrollment token, as listed.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.runPreflight

runPreflight(hostId: string, opts?: CallOptions)

Run the preflight checks. Runs the preflight checks of a machine (Manager operation host.preflight, hosts:manage there) and answers 202 with the operation id; read the results with GET .../preflight. Audited, allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/hosts/{host_id}/preflight (POST).

Name	Type	Default	Required	Description
hostId	string		yes	Identifier of the machine in the Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.service

service(clusterId: string, service: string, opts?: CallOptions)

Get a service sheet. One service with its state fields and instance counts, its security state (TLS, number of secrets set out of the total) and the full sheet of the Manager. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/{service} (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
service	string		yes	Name of the service.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.serviceConfig

serviceConfig(clusterId: string, service: string, opts?: CallOptions)

Read the configuration of a service. Current configuration version of a service as the Manager shows it (secret values masked), with recommendations, groups and stale hosts. Needs configs:read in the Manager; editing stays in the Manager console. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/{service}/config (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
service	string		yes	Name of the service.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.serviceConfigDiff

serviceConfigDiff(clusterId: string, service: string, from: number, to: number, opts?: CallOptions)

Compare two configuration versions. Changed parameters between two configuration versions of a service, one entry per parameter; a secret parameter only says whether it is set in each version, never its value. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/{service}/config/diff (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
service	string		yes	Name of the service.
from	number		yes	Older configuration version, integer of at least 1 (required).
to	number		yes	Newer configuration version, integer of at least 1 (required).
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.serviceConfigVersions

serviceConfigVersions(clusterId: string, service: string, opts?: CallOptions)

List the configuration versions. Configuration version history of a service in the Manager (configs:read there). Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/{service}/config/versions (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
service	string		yes	Name of the service.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.serviceDashboard

serviceDashboard(clusterId: string, service: string, query: { from?: string; to?: string; step?: number } = {}, opts?: CallOptions)

Read the dashboard of a service. Monitoring dashboard of a service relayed from the Manager (cluster:read there): instances, health and latest checks, availability, the machines it detected with their components and metrics, alerts, operations, configuration and, for a connected service, its connection. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/{service}/dashboard (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
service	string		yes	Name of the service.
query	{ from?: string; to?: string; step?: number }	{}	no	Query string parameters of the route.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.services

services(clusterId: string, opts?: CallOptions)

List the services of a cluster. Services of the cluster with the five state fields (desired, observed, health, operation, security), the administrative state and its reason, the running and total instance counts, drift (observed differs from desired), the delivery and the connection of a connected service. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.setMode

setMode(clusterId: string, service: string, mode: string, options: { reason?: string; drain_timeout_s?: number; approval_id?: string } = {}, opts?: CallOptions)

Set the operating mode of a service. Operating mode of a service (drain, scale to zero, security suspension, emergency stop, disable, quarantine, maintenance, enable), forwarded on behalf of the user; the Manager enforces the state it leaves behind and may require an approval. Audited (platform_manager.mode.<mode>) with the operation id and the resulting administrative state, allowed or refused. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/{service}/mode (POST).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
service	string		yes	Name of the service.
mode	string		yes	drain, scale_to_zero, security_suspend, emergency_stop, disable, quarantine, maintenance or enable.
options	{ reason?: string; drain_timeout_s?: number; approval_id?: string }	{}	no	Per call options (idempotency key, traceparent, headers, abort signal).
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.setup

setup(opts?: CallOptions)

Read the setup status. Getting started status, never a secret and never an error because the Manager is absent. core: API, PostgreSQL, migrations, Redis (optional) and Keycloak (optional), each with a state (ok, missing, down, error), the setting to fix and messages in English and French. manager: address and token reference set, credential found, Manager reachable, delegated user known, number of clusters, the suggested token reference and the permissions the Manager API token needs (changes need a restart). Requires platform_admin.

Route: /v1/platform-manager/setup (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.sshBootstrap

sshBootstrap(clusterId: string, body: { hosts: string[]; ssh_user: string; ssh_port?: number; private_key: string; host_key_fingerprints: Record<string, string>; use_sudo?: boolean }, opts?: CallOptions)

Install the node agent over SSH. Installs the node agent on machines over SSH (Manager operation host.ssh_bootstrap, hosts:manage there) and answers 202 with the operation to follow. The private key is relayed to the Manager, which keeps it in memory for the bootstrap tasks only; the Control Plane never stores nor audits it (the audit keeps hosts, user, port, sudo and fingerprints). Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/hosts/ssh-bootstrap (POST).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
body	{ hosts: string[]; ssh_user: string; ssh_port?: number; private_key: string; host_key_fingerprints: Record<string, string>; use_sudo?: boolean }		yes	Machines, SSH account and host key fingerprints.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.summary

summary(opts?: CallOptions)

Read the platform summary. Real counts per cluster (environment): services total, healthy, warning, failed; hosts; alerts; operations. Requires platform_admin.

Route: /v1/platform-manager/summary (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.supportBundles

supportBundles(clusterId: string, opts?: CallOptions)

List the support bundles. Sanitized support bundles of a cluster; a bundle is downloaded from the Manager console, never through the Control Plane. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/support-bundles (GET).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.testConnection

testConnection(connectionId: string, opts?: CallOptions)

Test a saved connection. Runs the protocol test of a saved connection now (its sealed secret stays in the Manager). Audited. Requires platform_admin.

Route: /v1/platform-manager/connections/{connection_id}/test (POST).

Name	Type	Default	Required	Description
connectionId	string		yes	Identifier of the connection in the Manager.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.updateVaultEntry

updateVaultEntry(entryId: string, body: { name?: string; url?: string; login?: string; password?: string; api_key?: string }, opts?: CallOptions)

Update a vault entry. Changes the given fields of a vault entry and seals them again (AES-256-GCM). A name used by another entry (case insensitive) answers 409 it_vault_name_taken; an empty name 422 validation_failed. Audited (it_vault.update, name and changed field names only). Requires platform_admin.

Route: /v1/platform-manager/vault/entries/{entry_id} (PATCH).

Name	Type	Default	Required	Description
entryId	string		yes	Identifier (UUID) of the vault entry.
body	{ name?: string; url?: string; login?: string; password?: string; api_key?: string }		yes	Fields to change. Unknown fields are refused.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.validateConnect

validateConnect(clusterId: string, body: PlatformManagerConnectRequest, opts?: CallOptions)

Validate a service connection. Dry run of a connect by the Manager: answers ok, the errors (service, field, code, messages in both languages) and the health check result; nothing is stored. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/connect/validate (POST).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
body	PlatformManagerConnectRequest		yes	The service to connect, as for the real connect.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.validateConnection

validateConnection(body: { type: "postgresql" | "redis" | "oidc"; params?: Record<string, unknown>; secret?: string }, opts?: CallOptions)

Test a connection before saving it. Real protocol test of a connection before it is saved: answers ok, latency in milliseconds, server version, error code and messages; nothing is stored and the secret is never sent back. Audited without the secret. Requires platform_admin.

Route: /v1/platform-manager/connections/validate (POST).

Name	Type	Default	Required	Description
body	{ type: "postgresql" | "redis" | "oidc"; params?: Record<string, unknown>; secret?: string }		yes	Type, parameters and secret of the connection to test.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.validateInstall

validateInstall(clusterId: string, body: PlatformManagerInstallRequest, opts?: CallOptions)

Validate a services install. Dry run of an install by the Manager planner: answers ok, the errors (service, field, code, messages in both languages) and the plan it would run; nothing is installed. Requires platform_admin.

Route: /v1/platform-manager/clusters/{cluster_id}/services/validate (POST).

Name	Type	Default	Required	Description
clusterId	string		yes	Identifier of the cluster in the Navin Manager.
body	PlatformManagerInstallRequest		yes	The install to check, as for the real install.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.vaultEntries

vaultEntries(opts?: CallOptions)

List the vault entries. Services of the IT vault by name, with URL, login, source (manual or installed:<service>) and whether a password and a key are set (has_password, has_api_key), never their values. Requires platform_admin.

Route: /v1/platform-manager/vault/entries (GET).

Name	Type	Default	Required	Description
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.vaultEntry

vaultEntry(entryId: string, opts?: CallOptions)

Get a vault entry. One service of the vault without its password nor key (use POST .../reveal for them). Unknown id: 404 it_vault_entry_not_found. Requires platform_admin.

Route: /v1/platform-manager/vault/entries/{entry_id} (GET).

Name	Type	Default	Required	Description
entryId	string		yes	Identifier (UUID) of the vault entry.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).

PlatformManagerResource.vaultReveal

vaultReveal(entryId: string, opts?: CallOptions)

Reveal the secrets of a vault entry. Password and key of one service in clear (show and copy in the console). Each reveal is audited (it_vault.reveal) with the service name, never the values. Unknown id: 404 it_vault_entry_not_found. Requires platform_admin.

Route: /v1/platform-manager/vault/entries/{entry_id}/reveal (POST).

Name	Type	Default	Required	Description
entryId	string		yes	Identifier (UUID) of the vault entry.
opts	CallOptions		no	Per call options (query, idempotency key, traceparent, headers).

Raises: the typed errors of the transport (Errors).