ConfidentialMind Manager API Documentation
This document outlines the API endpoints for the ConfidentialMind manager. The API allows for management of services, users, monitoring, logging, and system-wide operations.
Base URL
All API endpoints documented below are accessed via:
<yourDomain>/v1/admin/manager/{endpoint}
For example, the root endpoint / becomes <yourDomain>/v1/admin/manager/
Authentication & Authorization
All endpoints require a valid JWT token for authentication. The token should contain the necessary permissions for the requested operation:
- admin: Full access to modify resources
- view: Read-only access (limited for model services to main endpoint only)
- manager admin: Required for system-wide operations
Root Level Endpoints
GET /
Retrieves all services/configurations the authenticated user has access to.
Authentication: Valid JWT token required
Response: { "services": ServiceEntrySchema[] }
Secret values in config and metadata are hidden. The response contains *** in their place, for every caller including service admins. See Secret fields.
POST /deploy
Deploy a service from a template with optional additional services and connectors.
Authentication: Valid JWT token required (deployment limits enforced)
Request Body:
{
"templateId": "string",
"id": "string (optional)",
"displayName": "string (optional)",
"overrides": "object (optional)"
}
Response:
{
"mainService": "ServiceEntrySchema",
"additionalServices": "ServiceEntrySchema[]",
"totalDeployed": "number"
}
GET /health
Health check endpoint.
Authentication: None required
Response: { "status": "ok" }
GET /services
Authentication: Valid JWT token required
Response: { "services": ServiceInfo[] }
GET /storageclasses
Get available Kubernetes storage classes.
Authentication: Valid JWT token required
Response: { "storageClasses": StorageClass[] }
GET /users
Search for users in the system.
Authentication: Admin access to at least one service required
Query Parameters:
query: string (required)
Response: { "users": ResourceUser[] }
Model Management Endpoints
GET /model-mappings
Get all model type to deployment ID mappings.
Authentication: Manager admin permission required
Response: { "mappings": ModelMapping[] }
PUT /model-mappings
Update model type to deployment ID mappings.
Authentication: Manager admin permission required
Request Body:
{
"mappings": [
{
"model_type": "string",
"deployment_id": "string"
}
]
}
Response: { "success": boolean }
GET /model-permissions
Get permission levels for all model services.
Authentication: Manager admin permission required
Response: ModelPermissionStatus[]
POST /model-permissions
Update global permission levels for multiple models.
Authentication: Manager admin permission required
Request Body:
{
"modelPermissions": [
{
"modelId": "string",
"permissionLevel": "view" | "admin"
}
]
}
Response: { "success": boolean }
User Management Endpoints
GET /user-permissions
Get a user's permission group level.
Authentication: Manager admin permission required
Query Parameters:
userId: string (required)
Response: { "permissionLevel": string }
POST /newusersetup
Initializes a new user account in the system.
Authentication: Valid JWT token required
Response:
{
"success": true,
"message": "User setup completed successfully",
"userId": "string"
}
Tenant Management Endpoints
GET /tenants
Retrieves all tenants the authenticated user is a member of.
Authentication: Valid JWT token required
Response:
Response: { "tenants": Tenant[], "pendingInvites": PendingInvite[] }
POST /tenant
Creates a new tenant.
Authentication: Valid JWT token required
Request Body:
{
"name": "string"
}
Response:
{
"tenant": "object",
"resourceId": "string"
}
GET /tenants/admin
Retrieves information about all tenants (Admin only).
Authentication: Tenant Admin permissions required
Response: { "tenants": TenantInfo[], "uniqueUsers": number }
GET /tenants/admin/users
Retrieves all platform users (Admin only).
Authentication: Tenant Admin permissions required
Response: { "users": PlatformUser[] }
DELETE /tenants/{tenantId}
Deletes a tenant (Admin only).
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Response: { "success": true, "message": "string" }
POST /tenants/{tenantId}/join
Joins a tenant as an admin (Admin only).
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Response: { "success": true, "message": "string" }
POST /tenants/{tenantId}/leave
Leaves a tenant (Admin only).
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Response: { "success": true, "message": "string" }
GET /tenants/{tenantId}/subgroups
Retrieves subgroups for a tenant.
Authentication: Tenant member or Admin required
Path Parameters:
tenantId: string (required)
Response: { "subgroups": Subgroup[] }
POST /tenants/{tenantId}/subgroups
Creates a subgroup in a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Request Body:
{
"subgroupName": "string"
}
Response: CreateTenantSubgroupResponse
DELETE /tenants/{tenantId}/subgroups/{subgroupId}
Deletes a subgroup.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)subgroupId: string (required)
Response: { "success": true, "message": "string" }
GET /tenants/{tenantId}/services
Retrieves services belonging to a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Response: TenantService[]
GET /tenants/{tenantId}/users
Retrieves users of a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Response: { "users": TenantUser[] }
POST /tenants/{tenantId}/users/{userId}
Adds a user to a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)userId: string (required)
Query Parameters:
subgroupId: string (optional)
Response: { "success": true }
DELETE /tenants/{tenantId}/users/{userId}
Removes a user from a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)userId: string (required)
Query Parameters:
subgroupId: string (optional)
Response: { "success": true }
GET /tenants/{tenantId}/limits
Retrieves deployment limits for a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Response: TenantLimit[]
POST /tenants/{tenantId}/limits
Updates deployment limits for a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Request Body:
{
"limits": [
{
"type": "string",
"limit": number
}
],
"useDefaultLimits": boolean
}
Note: You can use a specific
tenantIdorDEFAULTto configure global limits. For detailed information on how tenant limits work, please refer to Tenant Limits.
Response: { "success": true }
PATCH /tenants/{tenantId}/restrictions
Updates tenant restrictions.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Request Body:
{
"restrictCustomDeployments": boolean
}
Response:
{
"success": true,
"message": "string",
"restrict_custom_deployments": boolean
}
Invite Management Endpoints
GET /tenants/{tenantId}/invites
Retrieves invites for a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Query Parameters:
email: string (optional)pendingOnly: boolean (optional, default true)beforeTimestamp: number (optional)limit: number (optional)
Response:
Response: { "invites": Invite[], "pagination": Pagination, "filters": Filters }
POST /tenants/{tenantId}/invites
Creates an invite for a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Request Body:
{
"email": "string"
}
Response:
{
"success": true,
"message": "string",
"inviteId": "string",
"userId": "string"
}
DELETE /tenants/{tenantId}/invites/{inviteId}
Deletes (cancels) an invite.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)inviteId: string (required)
Response: { "success": true, "message": "string" }
POST /tenants/{tenantId}/invites/{inviteId}/resend
Resends an invite.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)inviteId: string (required)
Response: { "success": true, "message": "string", "inviteId": "string" }
POST /invites/{email}
Creates a platform invite (Admin only).
Authentication: Tenant Admin permissions required
Path Parameters:
email: string (required)
Request Body:
{
"tenantIds": ["string"]
}
Response:
{
"success": true,
"message": "string",
"userId": "string"
}
POST /invites/{inviteId}/{response}
Responds to an invite.
Authentication: Valid JWT token required
Path Parameters:
inviteId: string (required)response: "accepted" (required)
Response: { "success": true, "message": "string" }
System Information Endpoints
GET /gpu-info
Get GPU information and usage metrics.
Authentication: Manager admin permission required
Response:
Response: { "nodes": NodeInfo[], "pods": PodInfo[], "prometheusMetrics": boolean }
nodes: List of nodes with GPU resources.pods: List of pods using GPU resources.prometheusMetrics: Indicates if the system is successfully collecting GPU metrics from Prometheus.
Monitoring & Metrics Endpoints
GET /metrics/{serviceId}/timeseries
Get time series metrics for a specific service.
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Query Parameters:
start: Unix timestamp (optional)end: Unix timestamp (optional)step: string (optional)apikey: string (optional)pathFilter: string (optional)
Response: ServiceMetrics
GET /tenants/{tenantId}/metrics
Get metrics for a tenant.
Authentication: Tenant Admin permissions required
Path Parameters:
tenantId: string (required)
Response: ServiceMetricsSchema
Logging Endpoints
GET /logs/{serviceId}
Get logs for a specific service with filtering and pagination.
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Query Parameters:
limit: number (optional, max 1000, default 100)offset: number (optional, default 0)startTime: Unix timestamp (optional)endTime: Unix timestamp (optional)search: string (optional)severity: string (optional)namespace: string (optional)podName: string (optional)containerName: string (optional)structured: boolean (optional, default false)
Response: LogsResponse
GET /logs/{serviceId}/latest
Get latest logs for a specific service.
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Query Parameters:
limit: number (optional, max 1000, default 50)structured: boolean (optional, default false)
Response: { "logs": LogEntry[] }
GET /logs/{serviceId}/search
Search logs for a specific service.
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Query Parameters:
q: string (required)limit: number (optional, max 1000, default 100)structured: boolean (optional, default false)
Response: { "logs": LogEntry[], "query": string }
Service-Specific Endpoints
GET /{serviceId}/
Retrieves the current status and configuration of a specific service.
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Response: ServiceEntrySchema
Secret values in config and metadata are hidden. The response contains *** in their place, for every caller including service admins. See Secret fields.
POST /{serviceId}/
Creates a new service with the specified ID.
Authentication: Manager admin permission required (deployment limits enforced)
Path Parameters:
serviceId: string (required)
Request Body: ServiceEntrySchema (varies by service type)
Response: ServiceEntrySchema
PATCH /{serviceId}/
Updates an existing service configuration.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)
Request Body: Partial ServiceEntrySchema
Secret fields you read back as *** can be sent unchanged. The API keeps the value it already has for them. To change a secret, send the new value in its place. See Secret fields.
Response: { "status": "ok" }
DELETE /{serviceId}/
Deletes a specific service and all associated resources.
Authentication: Manager admin permission required
Path Parameters:
serviceId: string (required)
Response: { "status": "ok" }
POST /{serviceId}/start
Starts a specific service deployment.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)
Response: { "deploymentState": "starting" }
GET /{serviceId}/stop
Stops a specific service deployment.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)
Response: { "deploymentState": "stopping" | "not_deployed" }
GET /{serviceId}/test
Test endpoint for service connectivity.
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Response: { "test": "ok" }
GET /{serviceId}/podhealth
Get pod health status for a service.
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Response:
{
"ready": boolean,
"status": "string",
"message": "string",
"totalPods": number,
"runningPods": number,
"failedPods": number,
"pendingPods": number,
"pods": [
{
"name": "string",
"phase": "string"
}
]
}
POST /{serviceId}/usage
Submit usage data for a service.
Authentication: Valid JWT token required
Path Parameters:
serviceId: string (required)
Request Body:
{
"usages": [
{
"originId": "string",
"targetId": "string",
"timestamp": number,
"apiKey": "string",
"traceId": "string",
"type": "string",
"value": number,
"tenant_id": "string"
}
]
}
Response: { "status": "ok", "message": "string" }
User Access Management
GET /{serviceId}/users
Retrieves the list of users with access to a specific service.
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Response: { "users": ResourceUser[] }
PATCH /{serviceId}/users
Updates user access permissions for a specific service.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)
Request Body: { "users": PatchResourceUser[] }
Response: { "status": "ok" }
DELETE /{serviceId}/users
Removes a user's access from a specific service.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)
Query Parameters:
userId: string (required)scope: string (required)
Response: { "status": "ok" }
GET /{serviceId}/groups
Get groups for a service.
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Response: { "groups": ServiceGroup[] }
PATCH /{serviceId}/groups
Update groups for a service.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)
Request Body:
{
"groups": [
{
"id": "string",
"scope": "view" | "admin"
}
]
}
Response: { "status": "ok" }
DELETE /{serviceId}/groups
Delete a group from a service.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)
Query Parameters:
subgroupId: string (required)scope: "view" | "admin" (optional)
Response: { "status": "ok" }
API Key Management
GET /{serviceId}/apikeys
Get all API keys for a service (only available for api-services namespace).
Authentication: Service admin or view permission required
Path Parameters:
serviceId: string (required)
Response: { "apiKeys": ApiKey[] }
POST /{serviceId}/apikeys
Create a new API key for a service.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)
Request Body:
{
"label": "string",
"expiration_date": "string (optional)"
}
Response: { "apiKey": "string" }
PATCH /{serviceId}/apikeys/{apiKeyJWT}/pause
Pause an API key.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)apiKeyJWT: string (required)
Response: { "success": true, "state": "paused" }
PATCH /{serviceId}/apikeys/{apiKeyJWT}/enable
Enable a paused API key.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)apiKeyJWT: string (required)
Response: { "success": true, "state": "active" }
DELETE /{serviceId}/apikeys/{apiKey}
Delete an API key.
Authentication: Service admin permission required
Path Parameters:
serviceId: string (required)apiKey: string (required)
Response: { "success": true }
Internal Endpoints
ALL /internal/{serviceId}/**
Internal API endpoints for service management that allow internal patch operations. These endpoints mirror the regular service endpoints but support internal system operations.
Authentication: Internal requests only
Note: These endpoints are used for internal system operations and should not be used by external clients.
Error Responses
In case of errors, the API will return appropriate HTTP status codes along with error details in the response body:
- 400 Bad Request: Invalid request parameters or body
- 403 Forbidden: Insufficient permissions or authentication failure
- 404 Not Found: Resource not found
- 500 Internal Server Error: Server-side error
Error response format:
{
"error": "error_code",
"message": "Human readable error message",
"detail": "Additional error details (optional)"
}
Rate Limiting & Deployment Limits
- Log endpoints are limited to a maximum of 1000 results per request
- Deployment limits are enforced based on user permission levels
- Users can only deploy services up to their configured limits
Data Schemas
For detailed information about the data structures used in these endpoints, please refer to the following schema documentation: