The LakeSail platform API.
Beta Notice: This API is currently in beta. All endpoints, request/response
schemas, and authentication flows are subject to change.
Getting Started
Base URL
All API requests are made to:
https://platform.lakesail.com/api/v1
All requests and responses use application/json.
Authentication
Most endpoints require a Bearer token in the Authorization header:
Authorization: Bearer <token>
User sessions are passed as Bearer tokens.
Contact
Servers
authentication
Account signup, login (password, SSO, one-time code), password reset, email verification, and logout.
Operations
List available permissions
Returns all available permission definitions, including their descriptions and applicable resource types.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
List of permission definitions
identity-providers
Configure external identity providers for single sign-on and list available provider types.
List available identity provider types
Returns a list of identity provider types that organizations can configure. Only enabled and visible providers are returned.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
A list of identity provider types is returned.
List identity providers
Returns a paginated list of all identity providers configured for the organization, including their type, status, and issuer information.
Authorizations
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
A list of identity providers is returned.
Create an identity provider
Configures a new external identity provider (e.g. Okta, Entra ID, Google) for single sign-on. Users can then authenticate through this provider to access the organization.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The identity provider was created successfully.
Auto-setup identity provider
Discovers the OIDC configuration from the provider's base URL and automatically
registers LakeSail as an OAuth client using Dynamic Client Registration (RFC 7591).
The provider URL must be a fully-qualified URL including the scheme (http:// or https://).
Note: Not all identity providers support Dynamic Client Registration. The endpoint
will return an error if the provider does not support it.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
Identity provider was successfully auto-configured.
Describe an identity provider
Returns the configuration details of an identity provider, including its type, issuer URL, and client settings.
Authorizations
Responses
The information about the identity provider is returned.
Delete an identity provider
Removes an identity provider configuration. Users who authenticated exclusively through this provider will need an alternative sign-in method.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
Update an identity provider
Modifies an identity provider's configuration, such as its display name, issuer URL, or client settings. Changes take effect for subsequent sign-in attempts.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The identity provider was updated successfully.
Rotate an identity provider's client secret
Updates the client secret for an identity provider. The new secret must be obtained
from the identity provider's admin console first.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The client secret was rotated successfully.
Test an identity provider connection
Validates the identity provider configuration by attempting to discover and fetch
the OIDC configuration from the provider's well-known endpoint.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The connection test result.
users
User account management and self-service profile operations.
Operations
Get current user profile
Returns the profile and organization membership details of the currently authenticated user.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The information about the current identity is returned.
Update my profile
Modifies the authenticated user's profile information such as their display name or preferences.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The user profile was updated successfully.
List my email addresses
Returns all email addresses associated with the authenticated user's account, including their verification status.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
The email addresses of the current identity are returned.
Add an email address
Adds a new email address to the current user's account and sends a verification email. Can only be called from an interactive session, not with a personal access token or other machine credential.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The email address was added and a verification email has been sent.
List my logins
Returns all active (non-expired) logins for the currently authenticated user, including device, IP address, and user agent information.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The logins of the current user are returned.
Revoke a login
Revokes a specific active login for the currently authenticated user. This immediately invalidates the login's access token.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
List my trusted devices
Returns all active (non-expired) trusted devices for the currently authenticated user. Trusted devices bypass two-factor authentication challenges.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The trusted devices of the current user are returned.
Revoke a trusted device
Revokes a specific trusted device for the currently authenticated user. Future logins from this device will require two-factor authentication.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
List my teams
Returns all teams that the authenticated user is a member of, including their role within each team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The teams of the current identity are returned.
List users
Returns a paginated list of all user accounts in the organization.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
A list of users is returned.
Create a user
Creates a new user account in the platform with the specified profile information and credentials.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The user was created successfully.
Describe a user
Returns the full details of a user account, including their profile information and account status.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The information about the user is returned.
Delete a user
Permanently removes a user account and revokes all their active sessions, organization memberships, and team assignments.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
Update a user
Modifies a user account's profile information or account settings.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The user was updated successfully.
Reset user MFA
Deletes all MFA configurations (TOTP and recovery codes) for the specified user
and revokes all their active sessions, trusted devices, and personal access
tokens across every organization the user belongs to. The user will be required
to re-authenticate and set up MFA again. Only allowed for managed accounts;
users with an external account must reset their MFA themselves.
Requires recent interactive authentication.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
Change user password
The current password must be provided in the request body.
For organization administrators, to reset password for a user without their current password, use the ResetPassword operation instead.
Can only be called from an interactive session, not with a personal access token or other machine credential.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The requested operation was done successfully.
Reset user password
Admin operation that generates a new temporary password for a user, revoking the user's active sessions, trusted devices, and personal access tokens across every organization the user belongs to. Only allowed for managed accounts. Requires recent interactive authentication. To change the current user's own password, use ChangePassword instead.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The password was reset successfully.
Get the caller's organization
Returns the organization the caller is signed in to, including the defaults the app needs to render itself (default team, default organization role). Scoped to the caller's own organization - there is no organization parameter, so a member can only ever read the organization they are authenticated against. Staff read other organizations through the admin surface instead.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The caller's organization.
catalogs
Data catalog management, both configured in LakeSail and provisioned into cloud accounts.
Operations
List my catalogs
Returns all catalogs that the current user can access based on their team memberships.
Includes team associations and external catalog references in the normalized response.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The field to sort by.
"name""updatedAt""name"The direction to sort (ascending or descending).
"asc""desc""asc"Responses
A list of catalogs the current user can access is returned.
List catalogs
Returns all catalogs the caller has permission to view across the organization.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100Responses
A list of catalogs is returned.
Create a catalog
Creates a new catalog with the specified provider and configuration. Returns 409 if a catalog with the same name already exists.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The catalog was created successfully.
Describe a catalog
Returns the full details of a catalog, including its provider configuration.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A catalog ID.
Responses
The catalog details.
Disconnect a catalog from the organization
Disconnects a catalog from the organization. The catalog record and its team associations are removed from LakeSail; the underlying external data source (for example, an AWS Glue catalog) is not affected. Queries that reference this catalog will need to be updated.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A catalog ID.
Responses
The requested operation was done successfully.
Update a catalog
Modifies a catalog's name or provider configuration.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A catalog ID.
Request Body
Responses
The catalog was updated successfully.
List catalog teams
Returns all teams that have been granted access to the specified catalog.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A catalog ID.
Responses
A list of catalog teams is returned.
Add teams to a catalog
Grants one or more teams access to the specified catalog.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A catalog ID.
Request Body
Responses
The teams were added to the catalog successfully.
Remove a team from a catalog
Revokes a team's access to the specified catalog.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A catalog ID.
The team ID.
Responses
The team was removed from the catalog successfully.
List queries that use a catalog
Returns all queries that reference the specified catalog as a data source.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100Responses
A list of queries using this catalog is returned.
List team catalogs
Returns all catalogs that have been assigned to the specified team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100Responses
A list of team catalogs is returned.
clusters
Kubernetes cluster management, both self-registered and provisioned into cloud accounts.
Operations
List my clusters
Returns all Kubernetes clusters that the current user can access based on their team memberships.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The field to sort by.
"name""name"The direction to sort (ascending or descending).
"asc""desc""asc"Responses
A list of clusters the current user can access is returned.
Describe an accessible cluster
Returns a single Kubernetes cluster that the current user can access based on their team memberships.
Returns 404 if the cluster does not exist or the user has no access.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The cluster accessible by the current user is returned.
List cluster tier presets
Returns the enabled cluster tier presets offered when creating a BYOC cluster, in display order. Any authenticated user may read them. When a supported region is supplied, each preset also carries region-scoped pricing for the cost estimate (computePricePerHourUsd) and the response includes serviceRates; without a region (or for an unsupported one), presets return unpriced.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
A cloud region code (e.g. us-east-1).
Responses
The list of cluster tier presets.
List provisioned clusters
Returns all provisioned clusters accessible to the organization across all connections, supporting marker-based pagination.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
List of External clusters with connection information.
Describe a provisioned cluster
Returns the details of a specific provisioned cluster including its connection information and related entities.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
External cluster details with connection information.
Delete a provisioned cluster record
Permanently deletes a provisioned cluster record. The cluster's infrastructure must
first be destroyed before the record can be deleted. A cluster in a failed state
may still have active infrastructure and should be destroyed first.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
List provisioned clusters by connection
Returns the provisioned clusters within the specified connection.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
List of External clusters with connection information.
Create a provisioned cluster
Creates a new EKS cluster in your AWS account via the specified connection. Requires an active connection and an active network.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
External cluster created successfully.
Describe a provisioned cluster by connection
Returns the details of a provisioned cluster, including its Kubernetes version, node group configuration, and provisioning status.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
External cluster details with connection information.
Update a provisioned cluster
Update the Kubernetes version or node group configuration of a provisioned cluster. This triggers an asynchronous update process.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
External cluster upgrade started
Destroy a provisioned cluster
Initiates destruction of an active provisioned cluster's cloud infrastructure. The cluster record is retained for reference. Returns an operation ID for tracking progress.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Destruction operation initiated.
Get provisioned cluster health status
Returns the health status of the EKS cluster and its node groups.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
External cluster health status
Get provisioned cluster kubeconfig
Returns a kubeconfig that can be used to access the EKS cluster.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Kubeconfig for the External cluster.
Get provisioned cluster metrics
Returns CPU and memory utilization metrics for the cluster over a specified period.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The period for metrics (e.g., "1h", "24h", "7d"). Default is "1h".
"1h"Responses
External cluster metrics.
Provision a cluster
Triggers provisioning of a cluster in pending status. Returns an operation ID for progress tracking.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Provisioning operation initiated.
List cluster teams
Returns the teams that have been granted access to the specified Kubernetes cluster.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100Responses
The list of teams associated with the cluster is returned.
Add teams to a cluster
Grants one or more teams access to a Kubernetes cluster. Team members can then target this cluster when configuring jobs, based on their team role permissions.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The teams were added to the cluster successfully.
Remove a team from a cluster
Revokes a team's access to a cluster. Unsupported for general use — removing a team may break existing jobs and notebooks still linked to that team. Use at your own risk. Requires cluster Manage and Teams Manage permissions.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
jobs
Job definitions, versioning, drafts, and team assignment.
Operations
List my jobs
Returns all jobs that the current user can access based on their team memberships.
Includes team associations and latest job run references in the normalized response.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The field to sort by.
"jobKey""createdAt""lastRunAt""lastRunAt"The direction to sort (ascending or descending).
"asc""desc""asc"Responses
A list of jobs the current user can access is returned.
List jobs
Returns a paginated list of all jobs in the organization, including their current status, active version, and schedule information.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11Responses
The list of LakeSail jobs is returned.
Create a job
Defines a new job within the organization. The job is created with an initial published version containing the provided configuration, including the target cluster, schedule, and query assignments. Requires an active cluster and at least one team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The LakeSail job was created successfully.
Describe a job
Returns the full details of a job, including its current active version configuration, schedule, and associated cluster and query information.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Responses
Job details with normalized entity references
Delete a job
Permanently removes a job and all its associated versions, runs, and team assignments. Refused while any run is still executing or still being cleaned up: deleting the job removes the run records its teardown reads, which would leave the run's cloud resources behind. Cancel a run in flight to make the job deletable sooner. Runs that keep their resources (see resourceCleanupMode), or whose cleanup gave up, do not block the delete: their cleanup is started here, because once the job is gone nothing can reach them.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Responses
The requested operation was done successfully.
Update a job
Modifies a job's metadata: its key and its status. Description, configuration and schedule belong to the version; change them through the draft operations or by creating a new version.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Request Body
Responses
The LakeSail job was updated successfully.
Activate a job version
Changes the job's active configuration to a previously published version.
The target version must exist and be published. Any existing draft version
must be discarded or published before activating a different version.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Request Body
Responses
The specified version was activated successfully.
Describe the draft version of a job
Returns the current draft version for the specified job.
Returns 404 if no draft version exists.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Responses
The draft version details.
Create a new draft version for a job
Creates a new draft version by copying the currently published version's
configuration. Fields provided in the request body override the copied values.
A job can have at most one draft version at a time. If a draft already exists,
returns 409 Conflict.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Request Body
Responses
A new draft version was created successfully.
Discard the draft version of a job
Discards (deletes) the current draft version without publishing it.
The job continues running its current published version unchanged.
Returns 404 if no draft version exists.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Responses
The draft version was discarded successfully.
Update the draft version of a job
Updates fields on the current draft version. Only provided fields are modified;
omitted fields retain their current values. Returns 404 if no draft version exists.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Request Body
Responses
The draft version was updated successfully.
Publish the draft version of a job
Publishes the current draft version, making it the new active configuration.
The draft version's status changes to 'published' and the job's version pointer
is updated. Returns 400 if no draft version exists, 404 if the job does not exist.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Responses
The draft version was published successfully.
List job teams
Returns the teams that have been granted access to the specified job.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11Responses
The list of teams associated with the job is returned.
Add teams to a job
Grants one or more teams access to a job. Team members inherit the ability to view the job and its runs based on their team role permissions.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Request Body
Responses
The teams were added to the job successfully.
Remove a team from a job
Revokes a team's access to a job. Team members will no longer be able to view or interact with the job unless they have access through another team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
The team ID.
Responses
The team was removed from the job successfully.
List job versions
Returns a paginated list of all published versions for a job, ordered by version number. Each version represents a point-in-time configuration snapshot.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11Responses
The list of LakeSail job versions is returned.
Create a job version
Creates and publishes a new version for the job in a single request. This is
equivalent to creating a draft, updating fields, and publishing. The job must
not have an existing draft version.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
Request Body
Responses
The job version was created and published successfully.
Describe a job version
Returns the full configuration snapshot for a specific version of a job, including cluster assignment, schedule, queries, and dependency settings.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
A LakeSail job version.
"int32"1Responses
Job details for the specified version, with normalized entity references
List team jobs
Returns a paginated list of jobs that the specified team has been granted access to.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11Responses
The list of LakeSail jobs accessible to the team is returned.
List jobs on a cluster
Returns a paginated list of jobs whose active version is configured to execute on the specified cluster.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11Responses
The list of LakeSail jobs configured to run on the cluster is returned.
job-runs
Job run execution, monitoring, and lifecycle.
Operations
List my job runs
Returns all job runs that the authenticated user can access based on their team memberships and role permissions.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
The list of job runs accessible by the current user is returned.
List job runs
Returns a paginated list of runs for a specific job, ordered by creation time. Includes status, timing, and trigger information for each run.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
The list of LakeSail job runs is returned.
Create a job run
Triggers a new execution of the job using its currently active version configuration. The run is placed in a pending state until released or automatically dispatched by the scheduler. Send an Idempotency-Key header to make a retry of this request return the same run instead of a second one.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Header Parameters
A key the caller chooses to make a retried request safe. The first request with a
key creates the run. A later request from the same member with the same key for
the same job creates nothing and returns that run with status 200, so a caller
that lost the response can send the request again. The request must match the
first one; a different request with a used key, or any request from another
member with it, is refused with 409. Keys are kept for the life of the run.
"orchestrator:daily_etl:load:2026-09-19T00:00:00+00:00:1"1255Path Parameters
A LakeSail job ID.
Request Body
Responses
The request repeats an earlier one with the same Idempotency-Key. Nothing was created; this is the run the earlier request created.
Describe a job run
Returns the full details of a job run, including its current status, timing information, and execution results.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A LakeSail job ID.
A LakeSail job run ID.
Responses
The LakeSail job run is returned.
Cancel a job run
Stops a job run that has not finished. The run moves to cancelled, its
runner is stopped regardless of resourceCleanupMode, its remaining
resources follow that mode, and the job_run.status.cancelled notification
fires.
Idempotent: a run that is already in a terminal status (succeeded,
failed, cancelled or timeout) is returned unchanged, so a caller can
cancel on every teardown path without checking first.
A run cancelled while its resources are still being created finishes
cleaning them up shortly after the response.
Stopping is not instant: the job code can keep executing for up to about half
a minute. cancelled means the run was stopped and its compute released, not
that the code had no effect. If the code finishes in that window the run stays
cancelled, with its runner timings and results recorded.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The job run. Its status is cancelled, or the terminal status it already had when the request arrived.
Set how long a job run's resources are retained
A run whose resourceCleanupMode retains its resources keeps its Sail server
and namespace after it ends, for debugging. The Sail server keeps running
while they are retained, and that compute is billed.
Sets retainedUntil to the given time, earlier or later than the current one.
It must be in the future and no later than the run's retainedUntilMax. To
end the retention now, use EndJobRunRetention.
Refused with 409 while the run is still executing, when it retains
nothing, and once its retention has ended. Refused with 400 when retainedUntil is in the past or past the
maximum.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The job run, carrying the new retainedUntil.
End a job run's retention now
Ends the retention of a run whose resourceCleanupMode retained its
resources: its Sail server and namespace are cleaned up now, logs included,
and the run stays on record. Removal is not instant: cleanedAt is set once
they are gone.
Refused with 409 while the run is still executing, and when it retains
nothing.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
Release a pending job run for execution
Transitions a job run from pending to ready, making it eligible for execution.
Use this when orchestrating job runs that were created in pending status and
should be released once their dependencies are satisfied.
Returns 409 if the run is not in pending status or its compute profile has
an external data target operation in progress.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The job run has been released and is now in ready status.
Retry a job run
Resets a terminal job run so it can be executed again.
The run keeps its original ID, version, parameters, and audit trail.
The run's status must be failed, timeout, or cancelled. By default
the run transitions to ready (immediately eligible for execution).
If hold is true in the request body, the run transitions to pending
instead, requiring a subsequent Release call before execution.
Returns 409 if the run is not in an allowed terminal status or its compute
profile has an external data target operation in progress.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The job run has been reset. Its status is ready (eligible for execution) or pending (held until released) depending on the hold flag in the request.
Issue a job run log stream
Issues a short-lived token and URL for streaming the live log of one of the job run's pods, selected by source, from the customer-side session proxy. Available while the run is live and, after it finishes, until the run's resources are cleaned up; once cleaned, the endpoint returns 410. Returns 409 while the selected pod is not yet running (retry shortly) or when the cluster requires re-provisioning for live logs.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
Which of the run's pods to stream. runner (default) is the job runner that submits the work; engine is the Sail driver that executes it, where engine-side failures such as out-of-memory kills and panics appear.
"runner""engine""runner"Responses
Connection details for the job run's live log stream.
Reset my MFA
Deletes all MFA configurations (TOTP and recovery codes) for the currently
authenticated user and revokes all active sessions, trusted devices, and
personal access tokens across every organization the user belongs to,
requiring re-authentication. Can only be called from an interactive session,
not with a personal access token or other machine credential.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
List my queries
Returns all queries that the current user can access based on their team memberships.
Includes team associations for each query in the normalized response.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The field to sort by.
"name""updatedAt""updatedAt"The direction to sort (ascending or descending).
"asc""desc""asc"Responses
A list of queries the current user can access is returned.
List queries
Returns a paginated list of all queries in the organization, including their SQL statements and catalog configuration.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100Responses
A list of queries is returned.
Create a query
Defines a new reusable SQL query within the organization. Queries can be referenced by one or more jobs and shared with teams for collaborative use.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The query was created successfully.
Describe a query
Returns the full details of a query, including its SQL statement, catalog provider, schema, and associated teams.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A query ID.
Responses
Query details with normalized entity references.
Delete a query
Permanently removes a query and its team assignments. Queries that are still referenced by active jobs cannot be deleted.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A query ID.
Responses
The requested operation was done successfully.
Update a query
Modifies a query's properties such as its name, SQL statement, catalog provider, or schema configuration.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A query ID.
Request Body
Responses
The query was updated successfully.
List query teams
Returns the teams that have been granted access to the specified query.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100Responses
The list of teams associated with the query is returned.
Add teams to a query
Grants one or more teams access to a query. Team members inherit the ability to view and use the query based on their team role permissions.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A query ID.
Request Body
Responses
The teams were added to the query successfully.
Remove a team from a query
Revokes a team's access to a query. Team members will no longer be able to view or use the query unless they have access through another team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A query ID.
The team ID.
Responses
The team was removed from the query successfully.
List team queries
Returns a paginated list of queries that the specified team has been granted access to.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100Responses
A list of queries accessible to the team is returned.
tokens
Personal access tokens for programmatic access with the member's own permissions, including organization-wide token administration.
List my personal access tokens
Returns a paginated list of the currently authenticated member's personal access tokens, including expired tokens. Deleted tokens are not returned. Token secrets are not included in the response.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
A list of personal access tokens is returned.
Create a personal access token
Creates a new personal access token for the currently authenticated member. The token acts as the member and carries the member's permissions. The token secret is returned only once in the response and cannot be retrieved later. An expiry is required and must not exceed the organization's maximum token lifetime. Creating a token requires recent interactive authentication.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The personal access token was created successfully.
Describe a personal access token
Returns the information about one of the currently authenticated member's personal access tokens. Deleted tokens are not found. The token secret is not included in the response.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The information about the personal access token is returned.
Delete a personal access token
Deletes one of the currently authenticated member's personal access tokens. The token immediately stops working and no longer appears in the member's token list. Organization administrators can still see recently deleted tokens until they are purged after the retention period.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
Regenerate a personal access token
Replaces the secret of one of the currently authenticated member's personal access tokens. The old secret immediately stops working. The new secret is returned only once in the response and cannot be retrieved later. A new expiry is required and must not exceed the organization's maximum token lifetime. Regenerating a token requires recent interactive authentication.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The personal access token was regenerated successfully.
List the organization's personal access tokens
Returns a paginated list of the personal access tokens in the organization, optionally filtered by owning member. Token secrets are never included in the response.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
Filter by the member owning the tokens.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
A list of personal access tokens is returned.
List per-member personal access token summaries
Returns paginated, server-computed personal access token aggregates per member of the organization: active token count, nearest expiry, and most recent use. Members without tokens are not included.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
A list of per-member personal access token summaries is returned.
Revoke a member's personal access token
Revokes a personal access token belonging to any member of the organization. The token immediately stops working. The token's owner can see that the token was revoked and by whom.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
notebooks
Marimo-based interactive Python notebooks backed by Sail (Spark) sessions.
Operations
List my team notebooks
Returns all notebooks shared with the current user's teams that they are
permitted to view, aggregated across every team they belong to.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The notebook field to sort by.
"name""status""updatedAt""updatedAt"The direction to sort notebooks.
"asc""desc""desc"Responses
A list of notebooks the current user can access via their teams is returned.
List notebooks
Returns a paginated list of the notebooks owned by the requesting member. Notebooks shared with the member's teams are returned by ListMyTeamNotebooks.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The notebook field to sort by.
"name""status""updatedAt""updatedAt"The direction to sort notebooks.
"asc""desc""desc"Responses
A paginated list of notebooks is returned.
Create a notebook
Creates a new Marimo notebook associated with a workload configuration. The notebook starts in stopped state. Call StartNotebook to provision the Sail and Marimo pods. Name a sourceUploadId to start it from an uploaded marimo file instead of an empty one.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The notebook was created successfully.
Upload a notebook source
Step one of starting a notebook from a marimo .py file. Returns a short-lived authorization to upload the file directly to the workspace storage of the given compute profile; the file does not pass through this API. Send it as the provider's form upload with the returned parameters, then name the returned uploadId in CreateNotebook, to create a notebook from it, or in ImportNotebookSource, to replace the file of an existing notebook on a compute profile in the same network. Only the member who made an upload can use it. An upload that is never used changes nothing; that member's next upload clears it once it is a day old.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
A short-lived authorization to upload a notebook source to workspace storage.
Describe a notebook
Returns the full details of a notebook, including its current status, configuration, associated workload config, and team access list.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Responses
Notebook details with normalized entity references.
Delete a notebook
Permanently removes a notebook and its team assignments. If the notebook is currently running, it will be stopped before deletion.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Responses
The requested operation was done successfully.
Update a notebook
Modifies a notebook's display name, description, or idle timeout. The workload configuration can only be changed when the notebook is stopped.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Request Body
Responses
The notebook was updated successfully.
Start a notebook
Provisions the Sail (Spark Connect) and Marimo pods for this notebook. The notebook must be in stopped state. Status transitions to starting immediately; the session proxy URL becomes available once status reaches running.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Responses
Notebook start initiated; status has transitioned to starting.
Stop a notebook
Tears down the Sail and Marimo pods for this notebook. The notebook must be in running state. Status transitions to stopping immediately; a stopped status confirms teardown is complete.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Responses
Notebook stop initiated; status has transitioned to stopping.
Open a notebook
Returns a proxy authentication URL for embedding the notebook UI as an iframe. The notebook must be running. Used as the iframe src, the URL has the session proxy validate the embedded JWT, set a same-site access cookie, and redirect to the notebook. The URL and the cookie share one lifetime, returned as expiresAt; call this operation again before then and load the new URL with redirect=none to renew the cookie without reloading the notebook.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Responses
A short-lived proxy authentication URL for embedding the notebook as an iframe.
Issue a notebook log stream
Issues a short-lived token and URL for streaming the notebook pod's live log from the customer-side session proxy. Returns 409 while the notebook's pod is not yet running (retry shortly) or when the cluster requires re-provisioning for live logs; 410 when the notebook's resources have been cleaned up.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Connection details for the notebook's live log stream.
Record notebook activity
Records the authenticated user's presence while a notebook is open in the browser. Updates the client activity timestamp read by the idle-timeout monitor. It is one of the activity signals: a request through the session proxy and a running cell count as well, so a notebook is not stopped for a missed ping while a cell runs. The notebook must be running. Intended to be called on the frontend's heartbeat interval while the notebook iframe is rendered.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Responses
Activity recorded.
Describe a notebook's source
Returns what is saved of the notebook's source file. It is absent until the notebook has saved or imported one. A running notebook saves as it changes, so this describes its last save.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Responses
What is saved of the notebook's source file.
Import an uploaded notebook source
Replaces an existing notebook's source with a file uploaded with CreateNotebookSourceUpload, for a compute profile in the notebook's network. Checks that the file is a marimo notebook and makes it the notebook's source, which the notebook starts from next time. To start a new notebook from a file instead, name the upload in CreateNotebook. The check reads only the start of the file, and the file is copied within workspace storage, so it does not pass through this API. This replaces the notebook's cells: download them first to keep them. A copy of the replaced file is also kept in workspace storage, beside the notebook's own, which this API does not read back. The notebook must be stopped, and the named upload must be waiting.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Request Body
Responses
The notebook's source after the import.
Download a notebook source
Returns a short-lived URL that downloads the notebook's source file directly from workspace storage; the file does not pass through this API. Allowed in any status. While a session runs, the file is its last save, which can be a few seconds behind the editor.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Responses
A short-lived URL that downloads the notebook source from workspace storage.
List notebook teams
Returns the teams that have been granted access to the specified notebook.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Query Parameters
The maximum number of items to list.
"int32"0100100Responses
A list of teams associated with the notebook is returned.
Add teams to a notebook
Grants one or more teams access to a notebook. Team members will be able to view and open the notebook (in read-only mode if the owner is active).
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
Request Body
Responses
The teams were added to the notebook successfully.
Remove a team from a notebook
Revokes a team's access to a notebook. Team members will no longer be able to view or open the notebook unless they have access through another team or are the notebook owner.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
A notebook ID.
The team ID.
Responses
The team was removed from the notebook successfully.
List team notebooks
Returns a paginated list of notebooks that the specified team has been granted access to.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11Responses
A list of notebooks accessible to the team is returned.
List teams
Returns all teams within the organization, including their member counts and descriptions.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The maximum number of items to list.
"int32"0100100The field to sort by.
"name""email""name"The direction to sort (ascending or descending).
"asc""desc""asc"Responses
A list of teams is returned.
Create a team
Creates a new team within the organization. Teams are used to group members and control access to clusters, jobs, and queries.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
Successfully created team.
Describe a team
Returns the full details of a team, including its name, description, and member count.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The team response.
Delete a team
Permanently removes a team and all its member assignments. Resources previously shared with this team become inaccessible to its former members unless they have access through another team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
Update a team
Modifies a team's metadata such as its name or description.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
Successfully updated team.
List team members
Returns all members of a team, including their assigned team roles.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The maximum number of items to list.
"int32"0100100The field to sort by.
"name""email""name"The direction to sort (ascending or descending).
"asc""desc""asc"Responses
A list of team members is returned.
Add a team member
Adds an existing organization member to a team, granting them access to the team's associated resources (clusters, jobs, queries). If roleIds is omitted or empty, the team's configured default role is used.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The member was added to the team successfully.
Remove a team member
Removes a member from a team. The member loses access to resources shared with this team unless they have access through another team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The member was removed from the team successfully.
Update team member roles
Syncs the team roles for a team member by replacing all existing roles with the provided list.
At least one role must be provided; to remove a member from the team entirely use the
remove-team-member endpoint instead.
The member must be a member of the team before roles can be assigned.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The requested operation was done successfully.
List organization roles
Returns all roles available within the organization, including their names and descriptions. Organization roles define the permissions a member has at the organization level.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The maximum number of items to list.
"int32"0100100Search term to filter results. Searches across relevant text fields like names and descriptions.
""The field to sort by.
"name""name"The direction to sort (ascending or descending).
"asc""desc""asc"Responses
A list of organization roles is returned.
Describe an organization role
Retrieves detailed information about a specific organization role, including all assigned permissions and permission bundles.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
The organization role ID.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"Responses
Organization role details retrieved successfully
List team roles
Returns all team roles within the organization that can be assigned to team members.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The maximum number of items to list.
"int32"0100100Search term to filter results. Searches across relevant text fields like names and descriptions.
""The field to sort by.
"name""name"The direction to sort (ascending or descending).
"asc""desc""asc"Responses
A list of team roles is returned.
Describe a team role
Retrieves detailed information about a specific team role, including all assigned permissions and permission bundles.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Path Parameters
The ID of the team role.
Responses
Team role details retrieved successfully
Create an invitation
Sends an email invitation to a user to join the organization. If the user does not yet have an account, they will be guided through signup.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The invite was created successfully.
Describe an invitation
Returns the details of a pending invitation, including the invited email address, expiration time, and current status.
Responses
The invite details.
Accept an invitation
Accepts a pending invitation, adding the authenticated user as a member of the organization.
Request Body
Responses
The invite was accepted successfully.
Search members
Returns a filtered list of organization members matching the search criteria, including their profiles and role assignments.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11The maximum number of items to list.
"int32"0100100The field to sort by.
"name""email""name"The direction to sort (ascending or descending).
"asc""desc""asc"Filter criteria for members
Responses
A paginated list of organization users with details is returned.
Describe an organization member
Returns the full details of an organization member, including their profile, assigned roles, and team memberships.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Organization user details retrieved successfully
Remove a member
Removes a user from the organization and revokes all their assigned roles and team memberships.
The last Owner of the organization cannot be removed.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
Update a member
Modifies an organization member's profile information such as their display name.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The updated organization user.
Update member roles
Replaces all organization roles for a member with the provided list.
At least one role must be provided; to remove a member entirely use the
remove-member endpoint instead.
The last Owner of the organization cannot have their Owner role removed.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The requested operation was done successfully.
connections
Cloud account connections, CloudFormation template management, and resource discovery.
Operations
List cloud accounts
Returns a paginated list of cloud accounts configured for the organization.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
List of External connections.
Create a cloud account
Creates a new cloud account and returns the CloudFormation template information needed for deployment.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
External connection created successfully.
Describe a cloud account
Returns the details of a cloud account, including its provider, region, deployment status, and associated resources.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
External connection details.
Delete a cloud account
Permanently removes a cloud account. While the account is still reachable, associated clusters and networks must be destroyed and deleted first, and catalog records deleted; a catalog's Glue database may stay, so destroying a catalog first is only needed if its data should be removed too. Once the account can no longer be reached, deletion removes the records without teardown. A connection whose verification is failing sits between those states: teardown through Lakesail is likely to fail too, so passing force asserts that access will not be restored and removes the records the same way an unreachable account's deletion does. Deleting a connection never removes a catalog's Glue database; only an explicit destroy on the catalog itself does, and even that deletes the Glue metadata only, never the data objects in the retained workspace S3 bucket. Databases whose records went with an unreachable account stay in the customer's account until removed there manually.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
Delete the connection even though child records still exist, tombstoning them without teardown. Only meaningful while the connection status is failed, which records that the account's last verification or operation failed; the role may or may not still work, so the flag is the caller's assertion that access will not be restored. While the account is reachable, the flag is refused and children must still be destroyed and deleted leaf-first. From the failed state, the forced delete is additionally refused while workloads or job runs still run on the account's clusters. On an account that is already unreachable (disconnected or deleted) the flag is redundant and accepted, and deletion behaves exactly as it would without it. Anything provisioned, including catalog Glue databases, stays in the AWS account until removed there manually.
falseResponses
The requested operation was done successfully.
Update a cloud account
Modifies a cloud account's metadata such as its name.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
Updated external connection.
List available cloud instance types
Returns EC2 instance types available in the cloud provider account for the specified connection. Supports filtering by region, architecture, CPU, and memory.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
AWS region to list instance types for. If not provided, defaults to the connection's configured region.
The maximum number of items to list.
"int32"0100100Filter by architecture (x86_64 or arm64)
"x86_64""arm64"Minimum number of vCPUs
1Minimum memory in MiB
1024Responses
List of available instance types for the cloud provider.
List available cloud provider regions
Returns the cloud provider regions available for provisioning external clusters and networks.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
List of available cloud provider regions
Sync cloud account IaC template
Updates the CloudFormation stack for this connection with the latest template. The update runs asynchronously. Only available for active connections with a deployed stack.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Template sync operation initiated.
Get connection template
Returns the CloudFormation template URL and parameters needed to deploy the connection stack in the cloud account.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
CloudFormation template information.
Download connection template
Downloads the CloudFormation template file with parameter defaults pre-filled, ready for upload to the AWS CloudFormation console. Use Get connection template for the URL and raw parameters instead.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
CloudFormation template with defaults injected.
Verify a cloud account
Validates that the cloud account is correctly configured. Call this after deploying the CloudFormation template.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
External connection verification result.
networks
Cloud network provisioning and lifecycle management.
Operations
List available cloud provider networks
Returns VPCs and subnets available in the cloud provider account for the specified connection and region.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
AWS region to list networks for. If not provided, defaults to the connection's configured region.
Responses
List of available networks
List cloud networks
Returns all managed networks created through the API across all connections, supporting marker-based pagination.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
List of managed external networks
Delete a cloud network record
Permanently deletes a cloud network record. The network's infrastructure must
first be destroyed before the record can be deleted. A network in a failed state
may still have active infrastructure and should be destroyed first.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
List cloud networks by connection
Returns the managed networks provisioned through the specified connection.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
List of managed external networks
Create a cloud network
Creates a new network in the customer's cloud account via the specified connection. Requires an active connection.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
Managed external network created successfully.
Describe a cloud network
Returns the details of a cloud network, including its VPC configuration, subnets, and provisioning status.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Managed external network details with connection information.
Destroy a cloud network
Initiates destruction of an active cloud network and all associated networking resources. All clusters in the network must be destroyed first. Catalogs are left intact, together with their data, and can be used again once the network is re-provisioned; the workspace S3 bucket and the data in it are retained as well. The network record is kept for reference. Returns an operation ID for tracking progress.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Destruction operation initiated.
Update a cloud network
Modifies a cloud network's metadata such as its name.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
Updated external network.
Provision a cloud network
Triggers provisioning of a cloud network in pending status. Returns an operation ID for progress tracking.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Provisioning operation initiated.
List files
Returns files of the given type owned by the given team in the specified network workspace bucket. The caller must be a member of the team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The kind of file to list. Scopes the listing to a single file-type location in the workspace bucket.
"pythonJob""pythonLibrary""pythonRequirements"The owning team whose files to list. The caller must be a member of this team; only that team's files are returned.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
List of files
Create a file upload
Returns a short-lived authorization for uploading a file directly to the specified network workspace storage.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
A short-lived file upload authorization for the selected network workspace.
Create a file download
Returns a short-lived authorization for downloading a file directly from the specified network workspace storage. The caller must be a member of the team that owns the file.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
A short-lived file download authorization for the selected network workspace.
data-targets
External data targets and their grants to compute profiles.
Operations
List external data targets
Returns external data targets across the organization's cloud accounts.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
A paginated list of external data targets.
List external data targets by connection
Returns the external data targets registered beneath a cloud account.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
A paginated list of external data targets.
Register an external data target
Registers an external data target beneath a cloud account without changing the external resource.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
External data target registered.
Describe an external data target
Returns an external data target and its optional connection-wide customer policy statements.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
External data target details.
Remove an external data target
Soft-deletes an external data target after verifying that no compute profiles still use it. The external resource and its bucket policy are not changed.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
List compute profiles granted access to the external data target
Returns the compute profiles with non-deleted grants to the external data target.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
A paginated list of compute profiles granted access to the external data target.
List grants
Returns the grants for a compute profile.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
Grants for the compute profile.
Describe a grant
Returns one grant and its configuration.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Grant configuration details.
Grant a compute profile access to an external data target
Grants a compute profile access to a registered external data target and starts its IAM configuration. Target registration authorizes profiles on the same cloud account to use the target. The compute profile can use only the target's approved access levels. Once the grant is active, workloads on this profile use its profile IAM role. Customer-managed grants to the cluster's Job Runner Role do not carry over to that role. Returns 409 while workloads using this compute profile are running.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
Grant configuration details.
Remove a grant from a compute profile
Applies the remaining grants before deleting the grant. Target registration authorizes profiles on the same cloud account to use the target. Edit access to the compute profile controls this action. Returns 409 while workloads using this compute profile are running.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Grant removal operation initiated.
Retry grant configuration
Retries a failed IAM configuration using the access already stored on the grant. Target registration authorizes profiles on the same cloud account to use the target. Edit access to the compute profile controls this action.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
External data target configuration operation initiated.
Test access through a grant
Starts a workload-equivalent access test for an active target grant. Target registration authorizes profiles on the same cloud account to use the target. Profile editors and callers permitted to run workloads through the profile can start this test.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Access test operation initiated.
List secrets
Returns managed workload secrets visible to the current member through team membership.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The page number to retrieve (1-indexed). Used with limit to support offset-based pagination.
"int32"11Responses
A list of secrets is returned.
Create a secret
Creates a managed workload secret. Secret values are stored encrypted and are never returned.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The secret was created successfully.
Describe a secret
Returns managed workload secret metadata. The secret value is never returned.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The secret was returned successfully.
Delete a secret
Soft-deletes an unreferenced managed workload secret.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The secret was deleted successfully.
Update a secret
Updates managed workload secret metadata and team assignments. Team removals that would break existing references are rejected.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The secret was updated successfully.
Replace a secret value
Replaces the current secret value by appending a new internal version. The value is never returned.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The secret value was replaced successfully.
Revoke a secret
Emergency-revokes the current secret version. Future runtime resolution fails closed until a replacement value is provided.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The secret current version was revoked successfully.
List sessions
Returns sessions visible to the caller: sessions they own plus sessions belonging to teams they are a member of. Passing teamId narrows the list to that team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
Filter sessions by team.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"Filter sessions by endpoint type.
"spark_connect""marimo"Filter sessions by status.
"pending""active""idle""closed""failed"The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
The list of sessions.
Create a session
Creates a new session. Resolves or creates a compute config, finds a reusable compute instance or provisions a new one, and returns the session in pending state. The session transitions to active on the first proxy request after the compute instance is ready.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The session was created successfully.
Describe a session
Returns the session details. For the session owner, includes connectionInfo with the proxy authentication URL (HTTP-transport endpoints) or gRPC endpoint (gRPC-transport endpoints).
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The session was retrieved successfully.
Close a session
Closes the session immediately. The session transitions to closed and closed_at is set. Infrastructure cleanup (marimo pod, compute instance) is handled asynchronously. Can be called by the session owner, team admin, or org admin.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The session was closed successfully.
Issue a session proxy token
Issues a short-lived signed JWT bearer token for authenticating with the session gRPC proxy. Use the grpcEndpoint from the session's connectionInfo as the dial address and pass the token as Authorization: Bearer
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
A bearer token for gRPC proxy access.
Issue a session log stream
Issues a short-lived token and URL for streaming the session's Sail server log from the customer-side session proxy. Worker pods in cluster mode are not exposed. Returns 409 while the session's pod is not yet running (retry shortly) or when the cluster requires re-provisioning for live logs; 410 when the session's resources have been cleaned up.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Connection details for the session's live log stream.
Relaunch a closed session
Creates a new session using the same workload configuration as a previously closed or failed session. Useful for restarting a recurring session without having to reconfigure compute settings from scratch.
The original session must be in a terminal state (closed or failed). A brand-new session ID is returned — the original session is not mutated. The caller must be the original session owner.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The session was relaunched successfully.
Destroy a session's compute infrastructure
Re-runs teardown of the session's compute infrastructure when a previous automatic teardown failed and the workload is stuck in cleanup_failed (for example, the compute cluster was temporarily unreachable). The teardown is re-attempted asynchronously.
When force is true, the failed teardown is instead abandoned: the workload is marked as needing manual cleanup (cleanup_abandoned_at is set) and removed from the user's active view. This does NOT delete the namespace in the customer cluster — the caller acknowledges they will remove it themselves. Use only when the infrastructure is unrecoverable.
Can be called by the session owner, team admin, or org admin.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The teardown was re-attempted, or the workload was abandoned.
compute-profiles
Reusable cluster, compute, library, environment, and catalog settings for workloads. Called workload configs in the API.
List workload configs
Returns workload configs visible to the caller. When teamId is provided, only workload configs whose cluster is linked to that team are returned. Anonymous (inline) configs are excluded.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
Filter workload configs by team.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Responses
The list of workload configs.
Create a workload config
Creates a named workload config for a cluster. It can be reused by jobs, sessions, and notebooks that have access to the cluster. Once created, workloadType and clusterId are immutable. Access follows the teams linked to the cluster; a workload config does not have a separate owning team.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The workload config was created successfully.
Describe a workload config
Returns the full detail of a workload config.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The workload config was retrieved successfully.
Delete a workload config
Deletes a workload config. Jobs and notebooks that reference it prevent deletion. An active runtime prevents deletion while it still depends on the config's catalogs, default catalog, or secrets. After deletion, the config is removed from listings and cannot be used by new workloads.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The requested operation was done successfully.
Update a workload config
Updates a workload config's mutable fields. workloadType and clusterId are immutable. Editing is rejected while an active runtime uses the config. Changes apply to future workloads; existing compute snapshots remain unchanged.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The workload config was updated successfully.
Get workload config references
Returns the resources that currently reference a workload config. Notebooks and jobs are durable references that prevent deletion until repointed. Active workloads block deletion while they still depend on workload config resources such as secrets, catalogs, or a default catalog.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The workload config references were retrieved successfully.
notifications
Notification channels, delivery rules, event types, and notification history.
Operations
List available notification event types
Returns the list of event types that notification rules can subscribe to. Includes shortcut types (e.g., 'any terminal status') that expand into individual event types at rule creation time.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
A list of available notification event types.
List notification channels
Lists notification channels for the organization, optionally filtered by team or member ownership.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Filter by team ID.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"Filter by member ID.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"Responses
A list of notification channels.
Create a notification channel
Creates a new notification channel for delivering notifications to a team or member destination (email or webhook).
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The notification channel was created successfully.
Get notification channel details
Returns the details of a specific notification channel.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The notification channel details.
Delete a notification channel
Soft-deletes a notification channel. The channel is marked as deleted but preserved for delivery log history.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The notification channel was deleted successfully.
Update a notification channel
Updates the configuration of an existing notification channel.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The notification channel was updated successfully.
Send a test notification
Sends a test notification to verify the channel is configured correctly. On success, sets the channel's verifiedAt timestamp.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The test notification was sent successfully.
List notification rules
Lists notification rules for the organization, optionally filtered by team, member, resource type, or scope type.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Filter by team ID.
Filter by member ID.
Filter rules by resource type.
Filter rules by scope type.
"resource""team""organization""own_resources"Responses
A list of notification rules.
Create a notification rule
Creates a new notification rule that maps event types to notification channels.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The notification rule was created successfully.
Get notification rule details
Returns the details of a specific notification rule.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The notification rule details.
Delete a notification rule
Deletes a notification rule. Future events will no longer match this rule.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The notification rule was deleted successfully.
Update a notification rule
Updates an existing notification rule (including enable/disable).
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Request Body
Responses
The notification rule was updated successfully.
List notification delivery history
Lists notification delivery log entries, optionally filtered by channel, rule, or status.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Filter by channel ID.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"Filter by rule ID.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"Filter by delivery status.
"pending""delivering""delivered""failed""skipped"Responses
A list of notification delivery log entries.
List the organization's billing subscriptions
Returns the calling organization's current and historical billing subscriptions across all providers (AWS Marketplace and Stripe). Historical rows support final-period usage navigation and provider-specific resubscribe guidance. Abandoned Stripe checkout reservations are excluded. Provider- agnostic; the per-row provider discriminator distinguishes providers.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The organization's current billing subscriptions.
Get submission workload composition
Returns workload-level contributions included in a metering submission window, including the physical usage factors used to compute the submitted amount.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Workload-level billing composition for one submission.
Get the organization's free-trial status
Returns the calling organization's org-level free-trial status (trials are one per org): whether a trial is active, when it ends, and whether the org already has an entitling subscription. Drives the in-app trial banner, so it is readable by any member.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
The organization's free-trial status.
Get the organization's usage
Returns the organization's usage for the selected range. When a subscription is selected, usage is returned per collection window and each window says whether it was charged.
Subscription usage includes every customer-meaningful submission outcome. Only accepted outcomes count as billed or trial-covered; every other outcome is explicitly unconfirmed. Trial-covered estimates are returned only where the deployment enables that disclosure. Range totals keep billed, trial-rated, and unconfirmed attempted amounts separate.
Omitting subscription is a narrower trial-only case. It is available only to an organization currently in its trial that has never held a subscription and is not billing-exempt. Because that usage comes from the internal shadow ledger, only the aggregate totals authorized by ADR-082 are returned; items is empty and pagination does not apply.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Parameters
Query Parameters
The maximum number of items to list.
"int32"0100100The pagination token returned from the previous list operation.
Limit the usage to one subscription. Omit for the organization's usage that no subscription accounts for, which is what an organization inside a free trial without a subscription has.
"A1B2C3D4E5"120"^[A-Z0-9]{1,20}$"Include submissions with period_start at or after this timestamp.
"date-time"Include submissions with period_end at or before this timestamp.
"date-time"Include windows where submitted usage quantity was zero.
falseResponses
Usage windows for the selected range.
Get async operation status
Returns the current status and results of a long-running operation, such as cluster provisioning or infrastructure deployment. Poll this endpoint to track progress.
Authorizations
API token sent in the Authorization header. Most tokens use the Bearer scheme. For organizations with the requireDpop setting enabled, access tokens are sender-constrained per RFC 9449: the token MUST be presented as "Authorization: DPoP
Responses
Operation status and results.