Skip to main content
Version: 3.4.0-rc.1

ConfidentialMind Manager API Documentation

This document outlines the API endpoints for the ConfidentialMind manager. The API allows for management of services, users, monitoring, logging, and system-wide operations.

Base URL​

All API endpoints documented below are accessed via:

<yourDomain>/v1/admin/manager/{endpoint}

For example, the root endpoint / becomes <yourDomain>/v1/admin/manager/

Authentication & Authorization​

All endpoints require a valid JWT token for authentication. The token should contain the necessary permissions for the requested operation:

  • admin: Full access to modify resources
  • view: Read-only access (limited for model services to main endpoint only)
  • manager admin: Required for system-wide operations

Root Level Endpoints​

GET /​

Retrieves all services/configurations the authenticated user has access to.

Authentication: Valid JWT token required

Response: { "services": ServiceEntrySchema[] }

Secret values in config and metadata are hidden. The response contains *** in their place, for every caller including service admins. See Secret fields.

ServiceEntrySchema

POST /deploy​

Deploy a service from a template with optional additional services and connectors.

Authentication: Valid JWT token required (deployment limits enforced)

Request Body:

{
  "templateId": "string",
  "id": "string (optional)",
  "displayName": "string (optional)",
  "overrides": "object (optional)"
}

Response:

{
  "mainService": "ServiceEntrySchema",
  "additionalServices": "ServiceEntrySchema[]",
  "totalDeployed": "number"
}

Note: Templates of type data_source can no longer be deployed. The request returns 410 Gone with the error code deprecated. Use RAG data sources instead, which you manage from the settings of a RAG endpoint — see RAG Endpoint.

GET /health​

Health check endpoint.

Authentication: None required

Response: { "status": "ok" }

GET /services​

Authentication: Valid JWT token required

Response: { "services": ServiceInfo[] }

ServiceInfo

GET /storageclasses​

Get available Kubernetes storage classes.

Authentication: Valid JWT token required

Response: { "storageClasses": StorageClass[] }

StorageClass

GET /users​

Search for users in the system.

Authentication: Admin access to at least one service required

Query Parameters:

  • query: string (required)

Response: { "users": ResourceUser[] }

ResourceUser

Model Management Endpoints​

GET /model-mappings​

Get all model type to deployment ID mappings.

Authentication: Manager admin permission required

Response: { "mappings": ModelMapping[] }

ModelMapping

PUT /model-mappings​

Update model type to deployment ID mappings.

Authentication: Manager admin permission required

Request Body:

{
  "mappings": [
    {
      "model_type": "string",
      "deployment_id": "string"
    }
  ]
}

Response: { "success": boolean }

GET /model-permissions​

Get permission levels for all model services.

Authentication: Manager admin permission required

Response: ModelPermissionStatus[]

ModelPermissionStatus

POST /model-permissions​

Update global permission levels for multiple models.

Authentication: Manager admin permission required

Request Body:

{
  "modelPermissions": [
    {
      "modelId": "string",
      "permissionLevel": "view" | "admin"
    }
  ]
}

Response: { "success": boolean }

User Management Endpoints​

GET /user-permissions​

Get a user's permission group level.

Authentication: Manager admin permission required

Query Parameters:

  • userId: string (required)

Response: { "permissionLevel": string }

POST /newusersetup​

Initializes a new user account in the system.

Authentication: Valid JWT token required

Response:

{
  "success": true,
  "message": "User setup completed successfully",
  "userId": "string"
}

Tenant Management Endpoints​

GET /tenants​

Retrieves all tenants the authenticated user is a member of.

Authentication: Valid JWT token required

Response: Response: { "tenants": Tenant[], "pendingInvites": PendingInvite[] }

Tenant PendingInvite

POST /tenant​

Creates a new tenant.

Authentication: Valid JWT token required

Request Body:

{
  "name": "string"
}

Response:

{
  "tenant": "object",
  "resourceId": "string"
}

GET /tenants/admin​

Retrieves information about all tenants (Admin only).

Authentication: Tenant Admin permissions required

Response: { "tenants": TenantInfo[], "uniqueUsers": number }

TenantInfo

GET /tenants/admin/users​

Retrieves all platform users (Admin only).

Authentication: Tenant Admin permissions required

Response: { "users": PlatformUser[] }

PlatformUser

DELETE /tenants/{tenantId}​

Deletes a tenant (Admin only).

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Response: { "success": true, "message": "string" }

POST /tenants/{tenantId}/join​

Joins a tenant as an admin (Admin only).

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Response: { "success": true, "message": "string" }

POST /tenants/{tenantId}/leave​

Leaves a tenant (Admin only).

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Response: { "success": true, "message": "string" }

GET /tenants/{tenantId}/subgroups​

Retrieves subgroups for a tenant.

Authentication: Tenant member or Admin required

Path Parameters:

  • tenantId: string (required)

Response: { "subgroups": Subgroup[] }

Subgroup

POST /tenants/{tenantId}/subgroups​

Creates a subgroup in a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Request Body:

{
  "subgroupName": "string"
}

Response: CreateTenantSubgroupResponse

DELETE /tenants/{tenantId}/subgroups/{subgroupId}​

Deletes a subgroup.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)
  • subgroupId: string (required)

Response: { "success": true, "message": "string" }

GET /tenants/{tenantId}/services​

Retrieves services belonging to a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Response: TenantService[]

TenantService

GET /tenants/{tenantId}/users​

Retrieves users of a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Response: { "users": TenantUser[] }

TenantUser

POST /tenants/{tenantId}/users/{userId}​

Adds a user to a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)
  • userId: string (required)

Query Parameters:

  • subgroupId: string (optional)

Response: { "success": true }

DELETE /tenants/{tenantId}/users/{userId}​

Removes a user from a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)
  • userId: string (required)

Query Parameters:

  • subgroupId: string (optional)

Response: { "success": true }

GET /tenants/{tenantId}/limits​

Retrieves deployment limits for a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Response: TenantLimit[]

TenantLimit

POST /tenants/{tenantId}/limits​

Updates deployment limits for a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Request Body:

{
  "limits": [
    {
      "type": "string",
      "limit": number
    }
  ],
  "useDefaultLimits": boolean
}

Note: You can use a specific tenantId or DEFAULT to configure global limits. For detailed information on how tenant limits work, please refer to Tenant Limits.

Response: { "success": true }

PATCH /tenants/{tenantId}/restrictions​

Updates tenant restrictions.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Request Body:

{
  "restrictCustomDeployments": boolean
}

Response:

{
  "success": true,
  "message": "string",
  "restrict_custom_deployments": boolean
}

Invite Management Endpoints​

GET /tenants/{tenantId}/invites​

Retrieves invites for a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Query Parameters:

  • email: string (optional)
  • pendingOnly: boolean (optional, default true)
  • beforeTimestamp: number (optional)
  • limit: number (optional)

Response: Response: { "invites": Invite[], "pagination": Pagination, "filters": Filters }

Invite

POST /tenants/{tenantId}/invites​

Creates an invite for a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Request Body:

{
  "email": "string"
}

Response:

{
  "success": true,
  "message": "string",
  "inviteId": "string",
  "userId": "string"
}

DELETE /tenants/{tenantId}/invites/{inviteId}​

Deletes (cancels) an invite.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)
  • inviteId: string (required)

Response: { "success": true, "message": "string" }

POST /tenants/{tenantId}/invites/{inviteId}/resend​

Resends an invite.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)
  • inviteId: string (required)

Response: { "success": true, "message": "string", "inviteId": "string" }

POST /invites/{email}​

Creates a platform invite (Admin only).

Authentication: Tenant Admin permissions required

Path Parameters:

  • email: string (required)

Request Body:

{
  "tenantIds": ["string"]
}

Response:

{
  "success": true,
  "message": "string",
  "userId": "string"
}

POST /invites/{inviteId}/{response}​

Responds to an invite.

Authentication: Valid JWT token required

Path Parameters:

  • inviteId: string (required)
  • response: "accepted" (required)

Response: { "success": true, "message": "string" }

System Information Endpoints​

GET /gpu-info​

Get GPU information and usage metrics.

Authentication: Manager admin permission required

Response: Response: { "nodes": NodeInfo[], "pods": PodInfo[], "prometheusMetrics": boolean }

  • nodes: List of nodes with GPU resources.
  • pods: List of pods using GPU resources.
  • prometheusMetrics: Indicates if the system is successfully collecting GPU metrics from Prometheus.

NodeInfo PodInfo

Monitoring & Metrics Endpoints​

GET /metrics/{serviceId}/timeseries​

Get time series metrics for a specific service.

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Query Parameters:

  • start: Unix timestamp (optional)
  • end: Unix timestamp (optional)
  • step: string (optional)
  • apikey: string (optional)
  • pathFilter: string (optional)

Response: ServiceMetrics

ServiceMetrics

GET /tenants/{tenantId}/metrics​

Get metrics for a tenant.

Authentication: Tenant Admin permissions required

Path Parameters:

  • tenantId: string (required)

Response: ServiceMetricsSchema

ServiceMetricsSchema

Logging Endpoints​

GET /logs/{serviceId}​

Get logs for a specific service with filtering and pagination.

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Query Parameters:

  • limit: number (optional, max 1000, default 100)
  • offset: number (optional, default 0)
  • startTime: Unix timestamp (optional)
  • endTime: Unix timestamp (optional)
  • search: string (optional)
  • severity: string (optional)
  • namespace: string (optional)
  • podName: string (optional)
  • containerName: string (optional)
  • structured: boolean (optional, default false)

Response: LogsResponse

LogsResponse

GET /logs/{serviceId}/latest​

Get latest logs for a specific service.

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Query Parameters:

  • limit: number (optional, max 1000, default 50)
  • structured: boolean (optional, default false)

Response: { "logs": LogEntry[] }

LogEntry

GET /logs/{serviceId}/search​

Search logs for a specific service.

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Query Parameters:

  • q: string (required)
  • limit: number (optional, max 1000, default 100)
  • structured: boolean (optional, default false)

Response: { "logs": LogEntry[], "query": string }

LogEntry

Service-Specific Endpoints​

GET /{serviceId}/​

Retrieves the current status and configuration of a specific service.

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Response: ServiceEntrySchema

Secret values in config and metadata are hidden. The response contains *** in their place, for every caller including service admins. See Secret fields.

ServiceEntrySchema

POST /{serviceId}/​

Creates a new service with the specified ID.

Authentication: Manager admin permission required (deployment limits enforced)

Path Parameters:

  • serviceId: string (required)

Request Body: ServiceEntrySchema (varies by service type)

Response: ServiceEntrySchema

Note: Services of type data_source can no longer be created. The request returns 410 Gone with the error code deprecated. Use RAG data sources instead, which you manage from the settings of a RAG endpoint — see RAG Endpoint. Data sources created before this change stay listed and keep working.

PATCH /{serviceId}/​

Updates an existing service configuration.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)

Request Body: Partial ServiceEntrySchema

Secret fields you read back as *** can be sent unchanged. The API keeps the value it already has for them. To change a secret, send the new value in its place. See Secret fields.

Response: { "status": "ok" }

DELETE /{serviceId}/​

Deletes a specific service and all associated resources.

Authentication: Manager admin permission required

Path Parameters:

  • serviceId: string (required)

Response: { "status": "ok" }

POST /{serviceId}/start​

Starts a specific service deployment.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)

Response: { "deploymentState": "starting" }

GET /{serviceId}/stop​

Stops a specific service deployment.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)

Response: { "deploymentState": "stopping" | "not_deployed" }

GET /{serviceId}/test​

Test endpoint for service connectivity.

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Response: { "test": "ok" }

GET /{serviceId}/podhealth​

Get pod health status for a service.

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Response:

{
  "ready": boolean,
  "status": "string",
  "message": "string",
  "totalPods": number,
  "runningPods": number,
  "failedPods": number,
  "pendingPods": number,
  "pods": [
    {
      "name": "string",
      "phase": "string"
    }
  ]
}

POST /{serviceId}/usage​

Submit usage data for a service.

Authentication: Valid JWT token required

Path Parameters:

  • serviceId: string (required)

Request Body:

{
  "usages": [
    {
      "originId": "string",
      "targetId": "string",
      "timestamp": number,
      "apiKey": "string",
      "traceId": "string",
      "type": "string",
      "value": number,
      "tenant_id": "string"
    }
  ]
}

Response: { "status": "ok", "message": "string" }

User Access Management​

GET /{serviceId}/users​

Retrieves the list of users with access to a specific service.

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Response: { "users": ResourceUser[] }

ResourceUser

PATCH /{serviceId}/users​

Updates user access permissions for a specific service.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)

Request Body: { "users": PatchResourceUser[] }

PatchResourceUser

Response: { "status": "ok" }

DELETE /{serviceId}/users​

Removes a user's access from a specific service.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)

Query Parameters:

  • userId: string (required)
  • scope: string (required)

Response: { "status": "ok" }

GET /{serviceId}/groups​

Get groups for a service.

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Response: { "groups": ServiceGroup[] }

ServiceGroup

PATCH /{serviceId}/groups​

Update groups for a service.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)

Request Body:

{
  "groups": [
    {
      "id": "string",
      "scope": "view" | "admin"
    }
  ]
}

Response: { "status": "ok" }

DELETE /{serviceId}/groups​

Delete a group from a service.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)

Query Parameters:

  • subgroupId: string (required)
  • scope: "view" | "admin" (optional)

Response: { "status": "ok" }

API Key Management​

GET /{serviceId}/apikeys​

Get all API keys for a service (only available for api-services namespace).

Authentication: Service admin or view permission required

Path Parameters:

  • serviceId: string (required)

Response: { "apiKeys": ApiKey[] }

ApiKey

POST /{serviceId}/apikeys​

Create a new API key for a service.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)

Request Body:

{
  "label": "string",
  "expiration_date": "string (optional)"
}

Response: { "apiKey": "string" }

PATCH /{serviceId}/apikeys/{apiKeyJWT}/pause​

Pause an API key.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)
  • apiKeyJWT: string (required)

Response: { "success": true, "state": "paused" }

PATCH /{serviceId}/apikeys/{apiKeyJWT}/enable​

Enable a paused API key.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)
  • apiKeyJWT: string (required)

Response: { "success": true, "state": "active" }

DELETE /{serviceId}/apikeys/{apiKey}​

Delete an API key.

Authentication: Service admin permission required

Path Parameters:

  • serviceId: string (required)
  • apiKey: string (required)

Response: { "success": true }

Internal Endpoints​

ALL /internal/{serviceId}/**​

Internal API endpoints for service management that allow internal patch operations. These endpoints mirror the regular service endpoints but support internal system operations.

Authentication: Internal requests only

Note: These endpoints are used for internal system operations and should not be used by external clients.

Error Responses​

In case of errors, the API will return appropriate HTTP status codes along with error details in the response body:

  • 400 Bad Request: Invalid request parameters or body
  • 403 Forbidden: Insufficient permissions or authentication failure
  • 404 Not Found: Resource not found
  • 410 Gone: The service type is no longer supported. Creating or deploying a data source returns this code.
  • 500 Internal Server Error: Server-side error

Error response format:

{
  "error": "error_code",
  "message": "Human readable error message",
  "detail": "Additional error details (optional)"
}

Rate Limiting & Deployment Limits​

  • Log endpoints are limited to a maximum of 1000 results per request
  • Deployment limits are enforced based on user permission levels
  • Users can only deploy services up to their configured limits

Data Schemas​

For detailed information about the data structures used in these endpoints, please refer to the following schema documentation: