Organizations
AuthorizationBearer <token>API Key access
List of organization invitations
application/json- response
[index: integer]?curl -X GET 'http://localhost:3000/organizations/invitations'[ { "organizationId": "organizationId", "createdAt": "2000-01-23T04:56:07.000+00:00", "invitedBy": "invitedBy", "role": "owner", "organizationName": "organizationName", "assignedRoles": [ { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" }, { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" } ], "id": "id", "email": "email", "expiresAt": "2000-01-23T04:56:07.000+00:00", "status": "pending", "updatedAt": "2000-01-23T04:56:07.000+00:00" }]AuthorizationBearer <token>API Key access
Count of organization invitations
response?numberapplication/jsoncurl -X GET 'http://localhost:3000/organizations/invitations/count'0AuthorizationBearer <token>API Key access
invitationId*stringInvitation ID
Organization invitation accepted successfully
application/json- response
id*stringInvitation ID
email*stringEmail address of the invitee
invitedBy*stringEmail address of the inviter
organizationId*stringOrganization ID
organizationName*stringOrganization name
expiresAt*stringExpiration date of the invitation
date-timestatus*stringInvitation status
"pending""accepted""declined""cancelled"role*stringMember role
"owner""member"assignedRoles*array<>Assigned roles
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timecurl -X POST 'http://localhost:3000/organizations/invitations/string/accept'{ "organizationId": "organizationId", "createdAt": "2000-01-23T04:56:07.000+00:00", "invitedBy": "invitedBy", "role": "owner", "organizationName": "organizationName", "assignedRoles": [ { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" }, { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" } ], "id": "id", "email": "email", "expiresAt": "2000-01-23T04:56:07.000+00:00", "status": "pending", "updatedAt": "2000-01-23T04:56:07.000+00:00"}AuthorizationBearer <token>API Key access
invitationId*stringInvitation ID
Organization invitation declined successfully
curl -X POST 'http://localhost:3000/organizations/invitations/string/decline'AuthorizationBearer <token>API Key access
List of organizations
application/json- response
[index: integer]?curl -X GET 'http://localhost:3000/organizations'[ { "secretQuota": 5.637376656633329, "sandboxCreateRateLimit": 2.027123023002322, "sandboxLifecycleRateLimitTtlSeconds": 1.0246457001441578, "createdAt": "2000-01-23T04:56:07.000+00:00", "sandboxLimitedNetworkEgress": true, "suspendedUntil": "2000-01-23T04:56:07.000+00:00", "ssoEnabled": true, "directorySyncStatusChangedAt": "2000-01-23T04:56:07.000+00:00", "previewWarningEnabled": true, "snapshotDeactivationTimeoutMinutes": 7.061401241503109, "otelConfig": "", "authenticatedRateLimitTtlSeconds": 7.386281948385884, "id": "id", "experimentalConfig": "{}", "updatedAt": "2000-01-23T04:56:07.000+00:00", "defaultRegionId": "defaultRegionId", "sandboxCreateRateLimitTtlSeconds": 1.2315135367772556, "suspensionReason": "suspensionReason", "sandboxLifecycleRateLimit": 4.145608029883936, "suspendedAt": "2000-01-23T04:56:07.000+00:00", "personal": true, "suspensionCleanupGracePeriodHours": 0.8008281904610115, "maxSecretsPerSandbox": 2.3021358869347655, "directorySyncStatus": "", "authenticatedRateLimit": 3.616076749251911, "suspended": true, "defaultQueueTimeout": 9, "maxCpuPerSandbox": 6.027456183070403, "scimEnabled": true, "maxDiskPerSandbox": 5.962133916683182, "createdBy": "createdBy", "workosOrgId": "workosOrgId", "name": "name", "maxMemoryPerSandbox": 1.4658129805029452, "directorySyncTokenRevokedAt": "2000-01-23T04:56:07.000+00:00" }]AuthorizationBearer <token>API Key access
application/json- body
name*stringThe name of organization
defaultRegionId*stringThe ID of the default region for the organization
Organization created successfully
application/json- response
id*stringOrganization ID
name*stringOrganization name
createdBy*stringUser ID of the organization creator
personal*booleanPersonal organization flag
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timesuspended*booleanSuspended flag
suspendedAt*stringSuspended at
date-timesuspensionReason*stringSuspended reason
suspendedUntil*stringSuspended until
date-timesuspensionCleanupGracePeriodHours*numberSuspension cleanup grace period hours
maxCpuPerSandbox*numberMax CPU per sandbox
maxMemoryPerSandbox*numberMax memory per sandbox
maxDiskPerSandbox*numberMax disk per sandbox
secretQuota*numberMaximum number of secrets
maxSecretsPerSandbox*numberMaximum number of secrets that can be mounted to a single sandbox
snapshotDeactivationTimeoutMinutes*numberTime in minutes before an unused snapshot is deactivated
20160defaultQueueTimeout*|Default minutes to wait for runner assignment before cancelling sandbox creation. Applied when sandbox create omits queueTimeout. Null means no default.
sandboxLimitedNetworkEgress*booleanSandbox default network block all
previewWarningEnabled*booleanWhether the proxy shows the preview URL warning page for this organization
ssoEnabled*booleanWhether this organization may configure SSO identity providers
scimEnabled*booleanWhether this organization may use SCIM directory sync
defaultRegionId?stringDefault region ID
workosOrgId?stringID of the WorkOS organization mirrored from this organization (absent for personal organizations, which are never mirrored)
directorySyncStatus?stringConnection state of the WorkOS SCIM directory, as last reported by WorkOS (absent when no directory has ever reported in)
"active""inactive""deleted"directorySyncStatusChangedAt?stringWhen the directory sync status last changed
date-timedirectorySyncTokenRevokedAt?stringWhen the directory bearer token was revoked; absent while a valid token exists. A revoked token stops provisioning even if the directory is still active.
date-timeauthenticatedRateLimit*|Authenticated rate limit per minute
sandboxCreateRateLimit*|Sandbox create rate limit per minute
sandboxLifecycleRateLimit*|Sandbox lifecycle rate limit per minute
experimentalConfig*Experimental configuration
otelConfig*|OpenTelemetry collection configuration
authenticatedRateLimitTtlSeconds*|Authenticated rate limit TTL in seconds
sandboxCreateRateLimitTtlSeconds*|Sandbox create rate limit TTL in seconds
sandboxLifecycleRateLimitTtlSeconds*|Sandbox lifecycle rate limit TTL in seconds
curl -X POST 'http://localhost:3000/organizations' \ -H 'Content-Type: application/json' \ -d '{ "defaultRegionId": "us", "name": "My Organization"}'{ "secretQuota": 5.637376656633329, "sandboxCreateRateLimit": 2.027123023002322, "sandboxLifecycleRateLimitTtlSeconds": 1.0246457001441578, "createdAt": "2000-01-23T04:56:07.000+00:00", "sandboxLimitedNetworkEgress": true, "suspendedUntil": "2000-01-23T04:56:07.000+00:00", "ssoEnabled": true, "directorySyncStatusChangedAt": "2000-01-23T04:56:07.000+00:00", "previewWarningEnabled": true, "snapshotDeactivationTimeoutMinutes": 7.061401241503109, "otelConfig": "", "authenticatedRateLimitTtlSeconds": 7.386281948385884, "id": "id", "experimentalConfig": "{}", "updatedAt": "2000-01-23T04:56:07.000+00:00", "defaultRegionId": "defaultRegionId", "sandboxCreateRateLimitTtlSeconds": 1.2315135367772556, "suspensionReason": "suspensionReason", "sandboxLifecycleRateLimit": 4.145608029883936, "suspendedAt": "2000-01-23T04:56:07.000+00:00", "personal": true, "suspensionCleanupGracePeriodHours": 0.8008281904610115, "maxSecretsPerSandbox": 2.3021358869347655, "directorySyncStatus": "", "authenticatedRateLimit": 3.616076749251911, "suspended": true, "defaultQueueTimeout": 9, "maxCpuPerSandbox": 6.027456183070403, "scimEnabled": true, "maxDiskPerSandbox": 5.962133916683182, "createdBy": "createdBy", "workosOrgId": "workosOrgId", "name": "name", "maxMemoryPerSandbox": 1.4658129805029452, "directorySyncTokenRevokedAt": "2000-01-23T04:56:07.000+00:00"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
application/json- body
defaultRegionId*stringThe ID of the default region for the organization
Default region set successfully
curl -X PATCH 'http://localhost:3000/organizations/string/default-region' \ -H 'Content-Type: application/json' \ -d '{ "defaultRegionId": "us"}'AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
application/json- body
defaultQueueTimeout*|Default minutes to wait for runner assignment before cancelling sandbox creation. Null disables the default. A number must be a positive integer.
Default queue timeout updated successfully
curl -X PATCH 'http://localhost:3000/organizations/string/default-queue-timeout' \ -H 'Content-Type: application/json' \ -d '{ "defaultQueueTimeout": 5}'AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
Organization details
application/json- response
id*stringOrganization ID
name*stringOrganization name
createdBy*stringUser ID of the organization creator
personal*booleanPersonal organization flag
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timesuspended*booleanSuspended flag
suspendedAt*stringSuspended at
date-timesuspensionReason*stringSuspended reason
suspendedUntil*stringSuspended until
date-timesuspensionCleanupGracePeriodHours*numberSuspension cleanup grace period hours
maxCpuPerSandbox*numberMax CPU per sandbox
maxMemoryPerSandbox*numberMax memory per sandbox
maxDiskPerSandbox*numberMax disk per sandbox
secretQuota*numberMaximum number of secrets
maxSecretsPerSandbox*numberMaximum number of secrets that can be mounted to a single sandbox
snapshotDeactivationTimeoutMinutes*numberTime in minutes before an unused snapshot is deactivated
20160defaultQueueTimeout*|Default minutes to wait for runner assignment before cancelling sandbox creation. Applied when sandbox create omits queueTimeout. Null means no default.
sandboxLimitedNetworkEgress*booleanSandbox default network block all
previewWarningEnabled*booleanWhether the proxy shows the preview URL warning page for this organization
ssoEnabled*booleanWhether this organization may configure SSO identity providers
scimEnabled*booleanWhether this organization may use SCIM directory sync
defaultRegionId?stringDefault region ID
workosOrgId?stringID of the WorkOS organization mirrored from this organization (absent for personal organizations, which are never mirrored)
directorySyncStatus?stringConnection state of the WorkOS SCIM directory, as last reported by WorkOS (absent when no directory has ever reported in)
"active""inactive""deleted"directorySyncStatusChangedAt?stringWhen the directory sync status last changed
date-timedirectorySyncTokenRevokedAt?stringWhen the directory bearer token was revoked; absent while a valid token exists. A revoked token stops provisioning even if the directory is still active.
date-timeauthenticatedRateLimit*|Authenticated rate limit per minute
sandboxCreateRateLimit*|Sandbox create rate limit per minute
sandboxLifecycleRateLimit*|Sandbox lifecycle rate limit per minute
experimentalConfig*Experimental configuration
otelConfig*|OpenTelemetry collection configuration
authenticatedRateLimitTtlSeconds*|Authenticated rate limit TTL in seconds
sandboxCreateRateLimitTtlSeconds*|Sandbox create rate limit TTL in seconds
sandboxLifecycleRateLimitTtlSeconds*|Sandbox lifecycle rate limit TTL in seconds
curl -X GET 'http://localhost:3000/organizations/string'{ "secretQuota": 5.637376656633329, "sandboxCreateRateLimit": 2.027123023002322, "sandboxLifecycleRateLimitTtlSeconds": 1.0246457001441578, "createdAt": "2000-01-23T04:56:07.000+00:00", "sandboxLimitedNetworkEgress": true, "suspendedUntil": "2000-01-23T04:56:07.000+00:00", "ssoEnabled": true, "directorySyncStatusChangedAt": "2000-01-23T04:56:07.000+00:00", "previewWarningEnabled": true, "snapshotDeactivationTimeoutMinutes": 7.061401241503109, "otelConfig": "", "authenticatedRateLimitTtlSeconds": 7.386281948385884, "id": "id", "experimentalConfig": "{}", "updatedAt": "2000-01-23T04:56:07.000+00:00", "defaultRegionId": "defaultRegionId", "sandboxCreateRateLimitTtlSeconds": 1.2315135367772556, "suspensionReason": "suspensionReason", "sandboxLifecycleRateLimit": 4.145608029883936, "suspendedAt": "2000-01-23T04:56:07.000+00:00", "personal": true, "suspensionCleanupGracePeriodHours": 0.8008281904610115, "maxSecretsPerSandbox": 2.3021358869347655, "directorySyncStatus": "", "authenticatedRateLimit": 3.616076749251911, "suspended": true, "defaultQueueTimeout": 9, "maxCpuPerSandbox": 6.027456183070403, "scimEnabled": true, "maxDiskPerSandbox": 5.962133916683182, "createdBy": "createdBy", "workosOrgId": "workosOrgId", "name": "name", "maxMemoryPerSandbox": 1.4658129805029452, "directorySyncTokenRevokedAt": "2000-01-23T04:56:07.000+00:00"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
Organization deleted successfully
curl -X DELETE 'http://localhost:3000/organizations/string'AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
Current usage overview
application/json- response
regionUsage*array<>totalSnapshotQuota*numbercurrentSnapshotUsage*numbertotalVolumeQuota*numbercurrentVolumeUsage*numbercurl -X GET 'http://localhost:3000/organizations/string/usage'{ "totalSnapshotQuota": 6.84685269835264, "currentVolumeUsage": 4.965218492984954, "totalVolumeQuota": 1.1730742509559433, "currentSnapshotUsage": 7.457744773683766, "regionUsage": [ { "totalCpuQuota": 0.8008281904610115, "currentGpuUsage": 9.301444243932576, "allowedGpuTypes": [ "H100", "H100" ], "totalGpuQuota": 7.061401241503109, "maxMemoryPerGpu": 1.0246457001441578, "maxCpuPerSandbox": 3.616076749251911, "maxDiskPerSandbox": 4.145608029883936, "maxDiskPerNonEphemeralSandbox": 7.386281948385884, "regionId": "regionId", "currentDiskUsage": 2.3021358869347655, "maxCpuPerGpu": 1.2315135367772556, "currentMemoryUsage": 5.962133916683182, "currentCpuUsage": 6.027456183070403, "maxMemoryPerSandbox": 2.027123023002322, "maxDiskPerGpu": 1.4894159098541704, "totalMemoryQuota": 1.4658129805029452, "totalDiskQuota": 5.637376656633329, "sandboxClass": "" }, { "totalCpuQuota": 0.8008281904610115, "currentGpuUsage": 9.301444243932576, "allowedGpuTypes": [ "H100", "H100" ], "totalGpuQuota": 7.061401241503109, "maxMemoryPerGpu": 1.0246457001441578, "maxCpuPerSandbox": 3.616076749251911, "maxDiskPerSandbox": 4.145608029883936, "maxDiskPerNonEphemeralSandbox": 7.386281948385884, "regionId": "regionId", "currentDiskUsage": 2.3021358869347655, "maxCpuPerGpu": 1.2315135367772556, "currentMemoryUsage": 5.962133916683182, "currentCpuUsage": 6.027456183070403, "maxMemoryPerSandbox": 2.027123023002322, "maxDiskPerGpu": 1.4894159098541704, "totalMemoryQuota": 1.4658129805029452, "totalDiskQuota": 5.637376656633329, "sandboxClass": "" } ]}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
Available sandbox classes
application/json- response
[index: integer]?curl -X GET 'http://localhost:3000/organizations/string/available-sandbox-classes'[ { "gpuAvailable": true, "regionId": "regionId", "allowedGpuTypes": [ "H100", "H100" ], "sandboxClass": "" }]AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
Organization left successfully
curl -X POST 'http://localhost:3000/organizations/string/leave'AuthorizationBearer <token>API Key access
authToken*stringSandbox Auth Token
OTEL Config
application/json- response
endpoint*stringEndpoint
headers?|Headers
organizationId?stringOrganization ID the config belongs to
curl -X GET 'http://localhost:3000/organizations/otel-config/by-sandbox-auth-token/string'{ "organizationId": "organizationId", "headers": { "x-api-key": "my-api-key" }, "endpoint": "endpoint"}AuthorizationBearer <token>API Key access
authToken*stringSandbox Auth Token
Sandbox identity
application/json- response
sandboxId*stringSandbox ID
organizationId*stringOrganization ID
curl -X GET 'http://localhost:3000/organizations/sandbox-identity/by-sandbox-auth-token/string'{ "organizationId": "organizationId", "sandboxId": "sandboxId"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
OTEL Config
application/json- response
endpoint*stringEndpoint
headers?|Headers
organizationId?stringOrganization ID the config belongs to
curl -X GET 'http://localhost:3000/organizations/string/otel-config'{ "organizationId": "organizationId", "headers": { "x-api-key": "my-api-key" }, "endpoint": "endpoint"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
OpenTelemetry configuration deleted successfully
curl -X DELETE 'http://localhost:3000/organizations/string/otel-config'AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
application/json- body
endpoint*stringEndpoint
headers?|Headers
organizationId?stringOrganization ID the config belongs to
OpenTelemetry configuration updated successfully
curl -X PUT 'http://localhost:3000/organizations/string/otel-config' \ -H 'Content-Type: application/json' \ -d '{ "organizationId": "organizationId", "headers": { "x-api-key": "my-api-key" }, "endpoint": "endpoint"}'AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
Experimental configuration as a JSON object. Set to null to clear the configuration.
application/json- body
[key: string]?anycurl -X PUT 'http://localhost:3000/organizations/string/experimental-config' \ -H 'Content-Type: application/json' \ -d '{ "otel": { "endpoint": "http://otel-collector:4317", "headers": { "api-key": "XXX" } }}'AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
List of organization roles
application/json- response
[index: integer]?curl -X GET 'http://localhost:3000/organizations/string/roles'[ { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" }]AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
application/json- body
name*stringThe name of the role
description*stringThe description of the role
permissions*array<>The list of permissions assigned to the role
Organization role created successfully
application/json- response
id*stringRole ID
name*stringRole name
description*stringRole description
permissions*array<>Roles assigned to the user
isGlobal*booleanGlobal role flag
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timecurl -X POST 'http://localhost:3000/organizations/string/roles' \ -H 'Content-Type: application/json' \ -d '{ "permissions": [ "write:registries", "write:registries" ], "name": "Maintainer", "description": "Can manage all resources"}'{ "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
roleId*stringRole ID
Organization role deleted successfully
curl -X DELETE 'http://localhost:3000/organizations/string/roles/string'AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
roleId*stringRole ID
application/json- body
name*stringThe name of the role
description*stringThe description of the role
permissions*array<>The list of permissions assigned to the role
Role updated successfully
application/json- response
id*stringRole ID
name*stringRole name
description*stringRole description
permissions*array<>Roles assigned to the user
isGlobal*booleanGlobal role flag
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timecurl -X PUT 'http://localhost:3000/organizations/string/roles/string' \ -H 'Content-Type: application/json' \ -d '{ "permissions": [ "write:registries", "write:registries" ], "name": "Maintainer", "description": "Can manage all resources"}'{ "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
List of organization members
application/json- response
[index: integer]?curl -X GET 'http://localhost:3000/organizations/string/users'[ { "organizationId": "organizationId", "createdAt": "2000-01-23T04:56:07.000+00:00", "role": "owner", "assignedRoles": [ { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" }, { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" } ], "name": "name", "userId": "userId", "email": "email", "updatedAt": "2000-01-23T04:56:07.000+00:00" }]AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
userId*stringUser ID
application/json- body
role*stringOrganization member role
"member""owner""member"assignedRoleIds*array<string>Array of assigned role IDs
[ "00000000-0000-0000-0000-000000000001"]Access updated successfully
application/json- response
userId*stringUser ID
organizationId*stringOrganization ID
name*stringUser name
email*stringUser email
role*stringMember role
"owner""member"assignedRoles*array<>Roles assigned to the user
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timecurl -X POST 'http://localhost:3000/organizations/string/users/string/access' \ -H 'Content-Type: application/json' \ -d '{ "role": "member", "assignedRoleIds": [ "assignedRoleIds", "assignedRoleIds" ]}'{ "organizationId": "organizationId", "createdAt": "2000-01-23T04:56:07.000+00:00", "role": "owner", "assignedRoles": [ { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" }, { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" } ], "name": "name", "userId": "userId", "email": "email", "updatedAt": "2000-01-23T04:56:07.000+00:00"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
userId*stringUser ID
User removed from organization successfully
curl -X DELETE 'http://localhost:3000/organizations/string/users/string'AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
List of pending organization invitations
application/json- response
[index: integer]?curl -X GET 'http://localhost:3000/organizations/string/invitations'[ { "organizationId": "organizationId", "createdAt": "2000-01-23T04:56:07.000+00:00", "invitedBy": "invitedBy", "role": "owner", "organizationName": "organizationName", "assignedRoles": [ { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" }, { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" } ], "id": "id", "email": "email", "expiresAt": "2000-01-23T04:56:07.000+00:00", "status": "pending", "updatedAt": "2000-01-23T04:56:07.000+00:00" }]AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
application/json- body
email*stringEmail address of the invitee
role*stringOrganization member role for the invitee
"member""owner""member"assignedRoleIds*array<string>Array of assigned role IDs for the invitee
[ "00000000-0000-0000-0000-000000000001"]expiresAt?stringExpiration date of the invitation
date-timeOrganization invitation created successfully
application/json- response
id*stringInvitation ID
email*stringEmail address of the invitee
invitedBy*stringEmail address of the inviter
organizationId*stringOrganization ID
organizationName*stringOrganization name
expiresAt*stringExpiration date of the invitation
date-timestatus*stringInvitation status
"pending""accepted""declined""cancelled"role*stringMember role
"owner""member"assignedRoles*array<>Assigned roles
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timecurl -X POST 'http://localhost:3000/organizations/string/invitations' \ -H 'Content-Type: application/json' \ -d '{ "role": "member", "assignedRoleIds": [ "assignedRoleIds", "assignedRoleIds" ], "email": "mail@example.com", "expiresAt": "2021-12-31T23:59:59Z"}'{ "organizationId": "organizationId", "createdAt": "2000-01-23T04:56:07.000+00:00", "invitedBy": "invitedBy", "role": "owner", "organizationName": "organizationName", "assignedRoles": [ { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" }, { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" } ], "id": "id", "email": "email", "expiresAt": "2000-01-23T04:56:07.000+00:00", "status": "pending", "updatedAt": "2000-01-23T04:56:07.000+00:00"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
invitationId*stringInvitation ID
application/json- body
role*stringOrganization member role
"owner""member"assignedRoleIds*array<string>Array of role IDs
expiresAt?stringExpiration date of the invitation
date-timeOrganization invitation updated successfully
application/json- response
id*stringInvitation ID
email*stringEmail address of the invitee
invitedBy*stringEmail address of the inviter
organizationId*stringOrganization ID
organizationName*stringOrganization name
expiresAt*stringExpiration date of the invitation
date-timestatus*stringInvitation status
"pending""accepted""declined""cancelled"role*stringMember role
"owner""member"assignedRoles*array<>Assigned roles
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timecurl -X PUT 'http://localhost:3000/organizations/string/invitations/string' \ -H 'Content-Type: application/json' \ -d '{ "role": "owner", "assignedRoleIds": [ "assignedRoleIds", "assignedRoleIds" ], "expiresAt": "2021-12-31T23:59:59Z"}'{ "organizationId": "organizationId", "createdAt": "2000-01-23T04:56:07.000+00:00", "invitedBy": "invitedBy", "role": "owner", "organizationName": "organizationName", "assignedRoles": [ { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" }, { "createdAt": "2000-01-23T04:56:07.000+00:00", "permissions": [ "write:registries", "write:registries" ], "name": "name", "isGlobal": true, "description": "description", "id": "id", "updatedAt": "2000-01-23T04:56:07.000+00:00" } ], "id": "id", "email": "email", "expiresAt": "2000-01-23T04:56:07.000+00:00", "status": "pending", "updatedAt": "2000-01-23T04:56:07.000+00:00"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
invitationId*stringInvitation ID
Organization invitation cancelled successfully
curl -X POST 'http://localhost:3000/organizations/string/invitations/string/cancel'AuthorizationBearer <token>API Key access
X-Daytona-Organization-ID?stringUse with JWT to specify the organization ID
List of all available regions
application/json- response
[index: integer]?curl -X GET 'http://localhost:3000/regions'[ { "otelEndpoint": "https://otel-collector.example.com:4318", "buildContextBucketRegion": "us-east-1", "buildContextRoleArn": "arn:aws:iam::123456789012:role/daytona-build-context", "proxyUrl": "https://proxy.example.com", "sshGatewayUrl": "http://ssh-gateway.example.com", "organizationId": "123e4567-e89b-12d3-a456-426614174000", "createdAt": "2023-01-01T00:00:00.000Z", "snapshotManagerUrl": "http://snapshot-manager.example.com", "regionType": "shared", "buildContextBucket": "my-org-daytona-region-us", "name": "us-east-1", "id": "123456789012", "updatedAt": "2023-01-01T00:00:00.000Z" }]AuthorizationBearer <token>API Key access
X-Daytona-Organization-ID?stringUse with JWT to specify the organization ID
application/json- body
name*stringRegion name
proxyUrl?|Proxy URL for the region
sshGatewayUrl?|SSH Gateway URL for the region
snapshotManagerUrl?|Snapshot Manager URL for the region
otelEndpoint?|OTel collector endpoint for sandboxes created in this region. When set, sandbox OTel data is sent to this endpoint instead of the Daytona-hosted collector and will not be available in the Daytona analytics API or dashboard.
buildContextBucket?|S3 bucket in your AWS account that declarative-build context is uploaded to for this region. Requires buildContextBucketRegion and buildContextRoleArn.
buildContextBucketRegion?|AWS region of buildContextBucket (standard aws partition only)
buildContextRoleArn?|IAM role Daytona assumes (with your organization ID as ExternalId) to issue upload credentials for buildContextBucket
The region has been successfully created.
application/json- response
id*stringID of the created region
proxyApiKey?|Proxy API key for the region
sshGatewayApiKey?|SSH Gateway API key for the region
snapshotManagerUsername?|Snapshot Manager username for the region
snapshotManagerPassword?|Snapshot Manager password for the region
curl -X POST 'http://localhost:3000/regions' \ -H 'Content-Type: application/json' \ -d '{ "otelEndpoint": "https://otel-collector.example.com:4318", "snapshotManagerUrl": "https://snapshot-manager.example.com", "buildContextBucketRegion": "us-east-1", "buildContextRoleArn": "arn:aws:iam::123456789012:role/daytona-build-context", "buildContextBucket": "my-org-daytona-region-us", "proxyUrl": "https://proxy.example.com", "name": "us-east-1", "sshGatewayUrl": "ssh://ssh-gateway.example.com"}'{ "proxyApiKey": "proxy-api-key-xyz", "snapshotManagerUsername": "daytona", "snapshotManagerPassword": "snapshotManagerPassword", "id": "region_12345", "sshGatewayApiKey": "ssh-gateway-api-key-abc"}AuthorizationBearer <token>API Key access
id*stringRegion ID
X-Daytona-Organization-ID?stringUse with JWT to specify the organization ID
application/json- response
id*stringRegion ID
name*stringRegion name
organizationId?|Organization ID
regionType*stringThe type of the region
"shared""dedicated""custom"createdAt*stringCreation timestamp
updatedAt*stringLast update timestamp
proxyUrl?|Proxy URL for the region
sshGatewayUrl?|SSH Gateway URL for the region
snapshotManagerUrl?|Snapshot Manager URL for the region
otelEndpoint?|OTel collector endpoint for sandboxes created in this region. When set, sandbox OTel data is sent to this endpoint instead of the Daytona-hosted collector and will not be available in the Daytona analytics API or dashboard.
buildContextBucket?|S3 bucket in your AWS account that declarative-build context is uploaded to for this region. Requires buildContextBucketRegion and buildContextRoleArn.
buildContextBucketRegion?|AWS region of buildContextBucket (standard aws partition only)
buildContextRoleArn?|IAM role Daytona assumes (with your organization ID as ExternalId) to issue upload credentials for buildContextBucket
curl -X GET 'http://localhost:3000/regions/string'{ "otelEndpoint": "https://otel-collector.example.com:4318", "buildContextBucketRegion": "us-east-1", "buildContextRoleArn": "arn:aws:iam::123456789012:role/daytona-build-context", "proxyUrl": "https://proxy.example.com", "sshGatewayUrl": "http://ssh-gateway.example.com", "organizationId": "123e4567-e89b-12d3-a456-426614174000", "createdAt": "2023-01-01T00:00:00.000Z", "snapshotManagerUrl": "http://snapshot-manager.example.com", "regionType": "shared", "buildContextBucket": "my-org-daytona-region-us", "name": "us-east-1", "id": "123456789012", "updatedAt": "2023-01-01T00:00:00.000Z"}AuthorizationBearer <token>API Key access
id*stringRegion ID
X-Daytona-Organization-ID?stringUse with JWT to specify the organization ID
application/json- body
proxyUrl?|Proxy URL for the region
sshGatewayUrl?|SSH Gateway URL for the region
snapshotManagerUrl?|Snapshot Manager URL for the region
otelEndpoint?|OTel collector endpoint for sandboxes created in this region. When set, sandbox OTel data is sent to this endpoint instead of the Daytona-hosted collector and will not be available in the Daytona analytics API or dashboard.
buildContextBucket?|S3 bucket in your AWS account that declarative-build context is uploaded to for this region. Requires buildContextBucketRegion and buildContextRoleArn.
buildContextBucketRegion?|AWS region of buildContextBucket (standard aws partition only)
buildContextRoleArn?|IAM role Daytona assumes (with your organization ID as ExternalId) to issue upload credentials for buildContextBucket
curl -X PATCH 'http://localhost:3000/regions/string' \ -H 'Content-Type: application/json' \ -d '{ "otelEndpoint": "https://otel-collector.example.com:4318", "snapshotManagerUrl": "https://snapshot-manager.example.com", "buildContextBucketRegion": "us-east-1", "buildContextRoleArn": "arn:aws:iam::123456789012:role/daytona-build-context", "buildContextBucket": "my-org-daytona-region-us", "proxyUrl": "https://proxy.example.com", "sshGatewayUrl": "ssh://ssh-gateway.example.com"}'AuthorizationBearer <token>API Key access
id*stringRegion ID
X-Daytona-Organization-ID?stringUse with JWT to specify the organization ID
The region has been successfully deleted.
curl -X DELETE 'http://localhost:3000/regions/string'AuthorizationBearer <token>API Key access
id*stringRegion ID
X-Daytona-Organization-ID?stringUse with JWT to specify the organization ID
The proxy API key has been successfully regenerated.
application/json- response
apiKey*stringThe newly generated API key
curl -X POST 'http://localhost:3000/regions/string/regenerate-proxy-api-key'{ "apiKey": "api-key-xyz123"}AuthorizationBearer <token>API Key access
id*stringRegion ID
X-Daytona-Organization-ID?stringUse with JWT to specify the organization ID
The SSH gateway API key has been successfully regenerated.
application/json- response
apiKey*stringThe newly generated API key
curl -X POST 'http://localhost:3000/regions/string/regenerate-ssh-gateway-api-key'{ "apiKey": "api-key-xyz123"}AuthorizationBearer <token>API Key access
id*stringRegion ID
X-Daytona-Organization-ID?stringUse with JWT to specify the organization ID
The snapshot manager credentials have been successfully regenerated.
application/json- response
username*stringSnapshot Manager username for the region
password*stringSnapshot Manager password for the region
curl -X POST 'http://localhost:3000/regions/string/regenerate-snapshot-manager-credentials'{ "password": "password", "username": "daytona"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
application/json- body
intent*stringWhich setup flow to open: sso for a single sign-on connection, dsync for SCIM directory sync
"sso""dsync"Admin Portal link generated; it expires five minutes after issuance
application/json- response
link*stringSingle-purpose WorkOS Admin Portal URL. Expires five minutes after issuance; open it immediately.
curl -X POST 'http://localhost:3000/organizations/string/identity-providers/workos-admin-portal-link' \ -H 'Content-Type: application/json' \ -d '{ "intent": ""}'{ "link": "link"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
SSO connections as configured in the WorkOS Admin Portal; empty when none exist
application/json- response
[index: integer]?curl -X GET 'http://localhost:3000/organizations/string/identity-providers/workos-sso-connections'[ { "createdAt": "2000-01-23T04:56:07.000+00:00", "name": "name", "domains": [ "domains", "domains" ], "id": "id", "state": "active", "connectionType": "OktaSAML", "updatedAt": "2000-01-23T04:56:07.000+00:00" }]AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
List of identity providers
application/json- response
[index: integer]?curl -X GET 'http://localhost:3000/organizations/string/identity-providers'[ { "organizationId": "123e4567-e89b-12d3-a456-426614174000", "createdAt": "2025-01-01T00:00:00Z", "trustEmailVerified": false, "defaultAssignedRoleIds": [ "00000000-0000-0000-0000-000000000001" ], "oidcConfig": "", "name": "Company Okta", "emailDomains": [ "company.com", "corp.company.com" ], "id": "123e4567-e89b-12d3-a456-426614174000", "allowAnyDomain": false, "enabled": true, "updatedAt": "2025-01-01T00:00:00Z" }]AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
application/json- body
name*stringDisplay name for the identity provider
oidcConfig*OIDC configuration
emailDomains*array<string>Email domains used for IdP discovery on the login form and to validate the user identity returned by the IdP. Required and must be non-empty unless allowAnyDomain is true.
[]allowAnyDomain?booleanWhen true, the IdP accepts any email domain returned by the external provider. Disables the post-callback domain check and allows emailDomains to be empty. Only enable for trusted IdPs that strictly control which users can authenticate.
falsetrustEmailVerified?booleanWhen true, skip the email_verified claim check on SSO logins through this identity provider. Only intended for providers that never emit the claim (e.g. Microsoft Entra ID). Risky: only enable if the IdP strictly controls its users' email addresses.
falsedefaultAssignedRoleIds?array<string>Organization role IDs assigned to users who join the organization via SSO through this identity provider. Roles must be global or belong to this organization. Empty (default) grants the lowest access: membership with no resource permissions.
[]enabled?booleanWhether the identity provider is enabled
trueIdentity provider created successfully
application/json- response
id*stringUnique identifier
organizationId*stringOrganization ID
name*stringDisplay name for the identity provider
oidcConfig*OIDC configuration (secret redacted)
emailDomains*array<string>Email domains used for IdP discovery on the login form. May be empty when allowAnyDomain is true.
allowAnyDomain*booleanWhether the IdP accepts any email domain returned by the external provider
trustEmailVerified*booleanWhether the email_verified claim check is skipped on SSO logins through this identity provider
defaultAssignedRoleIds*array<string>Organization role IDs assigned to users who join via SSO through this identity provider
enabled*booleanWhether the identity provider is enabled
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timecurl -X POST 'http://localhost:3000/organizations/string/identity-providers' \ -H 'Content-Type: application/json' \ -d '{ "trustEmailVerified": false, "defaultAssignedRoleIds": [ "00000000-0000-0000-0000-000000000001" ], "oidcConfig": "", "name": "Company Okta", "emailDomains": [ "company.com", "corp.company.com" ], "allowAnyDomain": false, "enabled": true}'{ "organizationId": "123e4567-e89b-12d3-a456-426614174000", "createdAt": "2025-01-01T00:00:00Z", "trustEmailVerified": false, "defaultAssignedRoleIds": [ "00000000-0000-0000-0000-000000000001" ], "oidcConfig": "", "name": "Company Okta", "emailDomains": [ "company.com", "corp.company.com" ], "id": "123e4567-e89b-12d3-a456-426614174000", "allowAnyDomain": false, "enabled": true, "updatedAt": "2025-01-01T00:00:00Z"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
id*stringIdentity provider ID
Identity provider details
application/json- response
id*stringUnique identifier
organizationId*stringOrganization ID
name*stringDisplay name for the identity provider
oidcConfig*OIDC configuration (secret redacted)
emailDomains*array<string>Email domains used for IdP discovery on the login form. May be empty when allowAnyDomain is true.
allowAnyDomain*booleanWhether the IdP accepts any email domain returned by the external provider
trustEmailVerified*booleanWhether the email_verified claim check is skipped on SSO logins through this identity provider
defaultAssignedRoleIds*array<string>Organization role IDs assigned to users who join via SSO through this identity provider
enabled*booleanWhether the identity provider is enabled
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timecurl -X GET 'http://localhost:3000/organizations/string/identity-providers/string'{ "organizationId": "123e4567-e89b-12d3-a456-426614174000", "createdAt": "2025-01-01T00:00:00Z", "trustEmailVerified": false, "defaultAssignedRoleIds": [ "00000000-0000-0000-0000-000000000001" ], "oidcConfig": "", "name": "Company Okta", "emailDomains": [ "company.com", "corp.company.com" ], "id": "123e4567-e89b-12d3-a456-426614174000", "allowAnyDomain": false, "enabled": true, "updatedAt": "2025-01-01T00:00:00Z"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
id*stringIdentity provider ID
application/json- body
name?stringDisplay name for the identity provider
oidcConfig?OIDC configuration
emailDomains?array<string>Email domains used for IdP discovery on the login form and to validate the user identity returned by the IdP. If provided and allowAnyDomain is not being set to true, must contain at least one domain. To clear domains in the same request, set allowAnyDomain: true and emailDomains: [].
allowAnyDomain?booleanWhen true, the IdP accepts any email domain returned by the external provider. Disables the post-callback domain check and allows emailDomains to be empty. Only enable for trusted IdPs that strictly control which users can authenticate.
trustEmailVerified?booleanWhen true, skip the email_verified claim check on SSO logins through this identity provider. Only intended for providers that never emit the claim (e.g. Microsoft Entra ID). Risky: only enable if the IdP strictly controls its users' email addresses.
defaultAssignedRoleIds?array<string>Organization role IDs assigned to users who join the organization via SSO through this identity provider. Roles must be global or belong to this organization. Empty grants the lowest access: membership with no resource permissions.
enabled?booleanWhether the identity provider is enabled
Identity provider updated successfully
application/json- response
id*stringUnique identifier
organizationId*stringOrganization ID
name*stringDisplay name for the identity provider
oidcConfig*OIDC configuration (secret redacted)
emailDomains*array<string>Email domains used for IdP discovery on the login form. May be empty when allowAnyDomain is true.
allowAnyDomain*booleanWhether the IdP accepts any email domain returned by the external provider
trustEmailVerified*booleanWhether the email_verified claim check is skipped on SSO logins through this identity provider
defaultAssignedRoleIds*array<string>Organization role IDs assigned to users who join via SSO through this identity provider
enabled*booleanWhether the identity provider is enabled
createdAt*stringCreation timestamp
date-timeupdatedAt*stringLast update timestamp
date-timecurl -X PATCH 'http://localhost:3000/organizations/string/identity-providers/string' \ -H 'Content-Type: application/json' \ -d '{ "trustEmailVerified": false, "defaultAssignedRoleIds": [ "00000000-0000-0000-0000-000000000001" ], "oidcConfig": "", "name": "Company Okta", "emailDomains": [ "company.com", "corp.company.com" ], "allowAnyDomain": false, "enabled": true}'{ "organizationId": "123e4567-e89b-12d3-a456-426614174000", "createdAt": "2025-01-01T00:00:00Z", "trustEmailVerified": false, "defaultAssignedRoleIds": [ "00000000-0000-0000-0000-000000000001" ], "oidcConfig": "", "name": "Company Okta", "emailDomains": [ "company.com", "corp.company.com" ], "id": "123e4567-e89b-12d3-a456-426614174000", "allowAnyDomain": false, "enabled": true, "updatedAt": "2025-01-01T00:00:00Z"}AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
id*stringIdentity provider ID
Identity provider deleted successfully
curl -X DELETE 'http://localhost:3000/organizations/string/identity-providers/string'AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
application/json- body
issuerUrl*stringOIDC Issuer URL to test
Connection test result
application/json- response
success*booleanWhether the connection test was successful
issuer?stringThe discovered issuer from the OIDC configuration
error?stringError message if the connection test failed
curl -X POST 'http://localhost:3000/organizations/string/identity-providers/test-connection' \ -H 'Content-Type: application/json' \ -d '{ "issuerUrl": "https://company.okta.com"}'{ "success": true, "error": "error", "issuer": "https://company.okta.com"}Returns a short-lived observation of the shared GPU fleet. Organization quotas and entitlements are not applied. Capacity can change immediately and sandbox creation remains authoritative.
AuthorizationBearer <token>API Key access
organizationId*stringOrganization ID
Shared GPU capacity grouped by GPU type.
application/json- response
observedAt*stringTime at which this capacity snapshot was calculated. Responses may be cached for up to five seconds.
date-timecapacity*array<>curl -X GET 'http://localhost:3000/organizations/string/gpu-capacity'{ "observedAt": "2000-01-23T04:56:07.000+00:00", "capacity": [ { "availableOnDemand": 0, "gpuType": "H100", "availableSpot": 0 }, { "availableOnDemand": 0, "gpuType": "H100", "availableSpot": 0 } ]}