SystemAPI
Use your configured control-plane origin. The SAH HTTP client supplies X-API-Key; permissions still depend on the configured account and route.
| Method | Path | Purpose |
|---|---|---|
| GET | /api/v1/fleet | Fleet inventory |
| GET | /api/v1/alerts | Fleet alerts |
| GET | /api/v1/audit/verify | Audit-chain verification |
sahconnect api GET /api/v1/fleet
sahconnect api GET /api/v1/alerts
sahconnect api GET /api/v1/audit/verifySysscripts
The Go agent executes Starlark with explicit entitlements. Container and Kubernetes modules are exposed only when their corresponding access is enabled. Individual mutations may require additional limits.
print(sys.containers.list())
print(sys.containers.inspect("web"))
print(sys.containers.logs("web"))These are script examples for an enrolled host with the required permissions. They are not browser-executable commands. See execution boundaries.
ComputeAPI
The Go API exposes the compute routes below under /api/v2. Configure the API deployment origin separately from the marketing website. Provider names are vast and ionet.
| Method | Path | Purpose |
|---|---|---|
| GET | /compute/providers | Configured adapters and health |
| GET | /compute/offers | Search offers; optional gpu_type, min_gpu_count, provider |
| POST | /compute/provision | Provision from a provider offer |
| GET | /compute/instances/:provider/:instance_id | Inspect a provider instance |
| DELETE | /compute/instances/:provider/:instance_id | Destroy an instance |
curl "$COMPUTEAPI_URL/api/v2/compute/offers?gpu_type=a100" \
-H "X-API-Key: $COMPUTEAPI_API_KEY"Provision request body
Obtain a real offer ID from the offer search. Replace the illustrative values below before sending a request. Provisioning creates billable provider resources.
{
"provider": "vast",
"offer_id": "REPLACE_WITH_OFFER_ID",
"image": "YOUR_CONTAINER_IMAGE",
"label": "YOUR_LABEL"
}Optional fields also include ssh_key and on_start_script. The current route configuration requires write permission for provision, instance detail, and deletion. Read permission covers offer and provider queries.
There are no unified start/stop/restart endpoints yet. The KaaS namespace service stores records and generated configuration but does not create live Kubernetes resources. Cloud adapters, bare-metal allocation, and automatic SystemAPI enrollment remain planned.
sahapi: local HTTP
Default listener: 127.0.0.1:8787. Use Authorization: Bearer with SAHAPI_TOKEN for every route except health.
| Method | Local path | Upstream path |
|---|---|---|
| GET | /health | None; unauthenticated health |
| GET | /v1/suite | None; local suite catalog |
| GET | /v1/systemapi/fleet | /api/v1/fleet |
| GET | /v1/systemapi/alerts | /api/v1/alerts |
| GET | /v1/systemapi/audit/verify | /api/v1/audit/verify |
curl http://127.0.0.1:8787/v1/suite \
-H "Authorization: Bearer $SAHAPI_TOKEN"The upstream origin is operator-configured, not caller-supplied. The proxy does not forward the client bearer or query string. Unconfigured upstreams return 503, denied local authentication returns 401, and failed upstream calls return 502.
sah/1: shell stdio
Opt in with ADSSH_SAH=1. Send one JSON frame to adssh sah. The hello frame is read-only:
{"v":1,"id":"hello-1","type":"hello"}An execute frame uses a command argument array. Execution requires a loaded, allowing policy. The response currently advertises handoff: "not_wired". A frame’s lease_id is not an authorization credential.