API reference

Base URL and responses

The versioned API is served below /v1. Browser clients use the authenticated session cookie. Editor and service integrations use scoped X-API-Key or device Bearer credentials where the endpoint requires them. Successful responses use { success: true, data }; failures use { success: false, error }. API responses include X-Request-ID for support and audit correlation, plus rate-limit headers on versioned and compatibility API routes.

GET /v1/health
GET /v1/auth/me
GET /v1/organizations
GET /v1/projects/{projectId}

Core endpoint groups

Use the OpenAPI contract in contracts/openapi.yaml as the machine-readable reference. Compatibility terrain routes remain available for the UnrealOS plugin while the versioned job APIs evolve.

• Auth: registration, login, logout, verification, reset, and current user.
• Organizations: membership, invitations, projects, audit events, and policy.
• Projects: settings, environments, devices, providers, keys, usage, and operations.
• Editor: enrollment, authenticated heartbeats, and Control Plane-backed chat.
• Operations: status, events, artifacts, cancellation, and retries.
• Administration: platform users, organizations, usage, audit, and service configuration.

Access and redaction

A valid identifier does not grant access. The API verifies session membership, project ownership, role, credential scope, and resource relationship before returning data. Secrets, password material, session tokens, enrollment codes after issuance, and raw provider credentials must not appear in responses or logs.