Developer docs
Every category's endpoints, grouped and real. Auth is one model everywhere: an SS-01 bearer token plus X-Tenant-Id. 224 representative endpoints are documented here across 1,300 category operations; the whole platform exposes 1,420.
Auth model
Every /api/v1 route on Nexocloud takes an SS-01 bearer token and an X-Tenant-Id header. Mint a token from Identity, then call any category's API the same way — compute, storage, payments or comms. Money and usage writes also take an Idempotency-Key.
Authorization: Bearer <token>An SS-01 OIDC access token from POST /api/v1/auth/token.X-Tenant-Id: <tenant>Scopes the request to your tenant; enforced structurally (ADR-0019).Idempotency-Key: <uuid>Required on money/usage writes (ADR-0039); safe to retry.Public base https://api.nexocloud.io/api/v1 · external via the SS-07 gateway https://gateway.<region>.nexocloud.io. The same bearer + X-Tenant-Id works for compute, storage, payments and comms alike.
Quickstart
Use the nexo CLI for the everyday workflow, or drive the API directly with curl.
# install and log in
npm i -g @nexocloud/cli
nexo login --tenant acme
# deploy an app (compute)
nexo apps create storefront --repo git@github.com:acme/storefront
nexo deploy storefront --wait
# make a bucket (storage) and a database (data)
nexo storage buckets create assets --versioning
nexo db claims create orders --engine postgres# mint a token
curl -s https://api.nexocloud.io/api/v1/auth/token \
-H 'X-Tenant-Id: acme' \
-d '{"grant_type":"client_credentials","client_id":"...","client_secret":"..."}'
# create an app on the compute plane
curl -s https://api.nexocloud.io/api/v1/apps \
-H 'Authorization: Bearer '$TOKEN \
-H 'X-Tenant-Id: acme' \
-d '{"name":"storefront","repo":"git@github.com:acme/storefront"}'Full request/response examples for each service live in the platform API reference (docs/product/api-reference/SS-XX-*.md), and the canonical contracts are the services/<svc>/openapi.json files.
Endpoint catalog
Every path below is a real route from services/<svc>/openapi.json. Jump into a category for its worked example and architecture.
Run anything — a git repo, a backend, a fleet of demo stacks — on governed compute.
/api/v1/appsCreate an app from a git repo or image./api/v1/apps/{app}/deploy/sagaStart a crash-safe build → gate → admit → roll → route deploy saga./api/v1/apps/{app}/rollout/healthReport rollout health; an unhealthy signal triggers auto-rollback./api/v1/apps/{app}/scaleSet autoscaling min/max against cpu, memory or http_rate./api/v1/apps/{app}/previewsOpen a per-PR preview environment on a TTL lease./api/v1/apps/{app}/exportEmit the app's full portable desired state for sovereign exit./api/v1/apps/{app}/applyApply a declarative backend revision (collections, functions, engines)./api/v1/apps/{app}/collectionsDefine a data collection with a schema and access rules./api/v1/apps/{app}/collections/{coll}/recordsCreate a record in a collection./api/v1/apps/{app}/functions/{fn}/invokeInvoke a backend function synchronously./api/v1/apps/{app}/collections/{coll}/feedSubscribe to a collection's realtime change feed./api/v1/environmentsProvision a full ephemeral environment from a blueprint./api/v1/environments/{id}/costGet a live cost estimate for a running environment./api/v1/environments/{id}/lease/extendExtend an environment's TTL lease before teardown./api/v1/guardrailsDefine a cost guardrail that breaches into teardown./api/v1/sandboxesCreate a seeded sandbox with a reproducible dataset.Build, sign, scan and ship artifacts through a governed delivery spine.
/api/v1/runsStart a classified build run./api/v1/runs/{id}/buildExecute the build step for a run./api/v1/runs/{id}/gatesEvaluate policy gates against a run./api/v1/runs/{id}/attestProduce a signed build attestation./api/v1/runs/{id}/approveRecord a human approval on a gated run./api/v1/apps/{id}/detectDetect build targets (web, iOS, Android) from a repo./api/v1/pipelinesCreate a delivery pipeline from a detected target./api/v1/buildsQueue a build./api/v1/releases/promotePromote a release across channels./api/v1/releases/rollbackRoll a channel back to a prior release./api/v1/test-runsStart a test run against a suite./api/v1/quality-gates/evaluateEvaluate a release against quality gates./api/v1/flaky-tests/{id}/quarantineQuarantine a detected flaky test./api/v1/evidence/{release}Pull the signed quality-evidence bundle for a release./api/v1/device-farm/reservationsReserve a physical device for a session./api/v1/admissionAdmit an image: verify signature, SBOM and scan verdict./api/v1/projects/{project}/artifacts/{repo}/{tag}/scanScan an artifact for vulnerabilities./api/v1/exceptionsRecord a time-boxed, audited admission exception./api/v1/proxy-cache/{project}/resolveResolve an upstream image through the proxy cache.S3-compatible object storage and 3-2-1 backup on a data plane you own.
/api/v1/bucketsCreate a bucket backed by a sovereign storage claim./api/v1/buckets/{bucket}/versioningEnable or suspend object versioning./api/v1/buckets/{bucket}/lifecycleSet lifecycle rules (transition, expiry) on a bucket./api/v1/buckets/{bucket}/presignPresign a GET or PUT for a key (HMAC canonical signature)./api/v1/object/access-keysIssue an S3 access key (R2-style API token)./s3/{bucket}/{key}Native S3 PutObject / UploadPart./api/v1/sets/{set}/backupsTake a backup of a protected set./api/v1/sets/{set}/audit-321Audit a set against the 3-2-1 copy rule./api/v1/sets/{set}/restoreRestore a set from a snapshot./api/v1/dr/ladderRead the recovery-ladder freshness across tiers./api/v1/drills/{id}/sign-offSign off a completed DR drill with evidence.Relational, document, vector and analytics data — one governed database plane.
/api/v1/claimsProvision a database claim from the engine catalog./api/v1/claims/{name}/cdcRead the change-data-capture stream for a claim./api/v1/claims/{name}/queryRun a governed query against a claim./api/v1/claims/{name}/restorePoint-in-time restore a claim./api/v1/claims/{name}/rotateRotate a claim's credentials via Vault./api/v1/vector-claimsProvision a vector database claim for embeddings./api/v1/contractsRegister an event contract (schema) for validation./api/v1/eventsIngest a product event validated against its contract./api/v1/metricsDefine a metric over ingested events./api/v1/queryQuery a time-series metric window./api/v1/cdrIngest a usage record (deduplicated, spooled when the sink is down)./api/v1/rating/rateRate a record against the active rate deck with a deterministic breakdown./api/v1/rating/rerateRe-rate stored records in a window against the current deck./api/v1/reconcile/casesList open reconciliation cases./api/v1/suspense/{id}/repairRepair a quarantined suspense record.VPCs, a sovereign mesh, authoritative DNS, edge compute and a PoP fabric you run.
/api/v1/vpcsCreate a VPC./api/v1/meshCreate a zero-knowledge WireGuard mesh overlay (SDP control plane)./api/v1/sase/ztna/policiesAuthor a default-deny ZTNA access policy./api/v1/upo/compileCompile the unified policy to ZTNA / SD-WAN / firewall rulesets./api/v1/residency/{class}Set a data-residency class constraint./api/v1/zonesCreate an authoritative DNS zone./api/v1/zones/{zone}/rrsetsUpsert resource record sets./api/v1/zones/{zone}/dnssec/initInitialise DNSSEC signing for a zone./api/v1/zones/{zone}/answerResolve a health-checked answer for a name./api/v1/functionsCreate an edge function./api/v1/functions/{name}/deployDeploy an immutable edge-function version./api/v1/functions/{name}/placementPlace a function across all or a subset of PoPs./api/v1/purgePurge cached content across the edge./api/v1/waf/classes/{class}Configure a WAF ruleset class./api/v1/popsRegister a point-of-presence./api/v1/bgp/sessionsCreate a BGP session./api/v1/anycast/policies/{id}/failover-drillRun an anycast failover drill with evidence./api/v1/gitops/changes/{id}/applyApply a GitOps change to the fabric.Identity, fine-grained authz, secret custody, detection & response, and compliance evidence.
/api/v1/auth/tokenMint access + refresh tokens (password or client_credentials)./api/v1/auth/introspectIntrospect a bearer token./api/v1/tenantsBootstrap a tenant./api/v1/usersCreate a user in a tenant./api/v1/sessions/end-othersEnd all other sessions for the caller./api/v1/secrets/{path}Write a KV secret./api/v1/creds/{role}Issue dynamic credentials for a role (leased)./api/v1/transit/{key}/signSign a payload with a Transit key (audit-chain signing)./api/v1/transit/{key}/rotateRotate a Transit key to a new version./api/v1/checkCheck whether a subject may act on an object./api/v1/tuplesWrite relationship tuples./api/v1/expandExpand the relationship graph for an object./api/v1/decisions/{id}/replayReplay a recorded authorization decision./api/v1/eventsIngest a security event for correlation./api/v1/rulesRegister a detection rule./api/v1/cases/{id}/containmentsPropose a containment action on a case./api/v1/containments/{id}/executeExecute an approved containment./api/v1/zeek/noticesIngest a Zeek network notice, raising a finding./api/v1/controlsDefine a compliance control./api/v1/controls/{id}/evidenceAttach evidence to a control./api/v1/findingsRaise a compliance finding./api/v1/rollupRead the control-posture rollup for the audit room./api/v1/casesOpen a KYC verification case./api/v1/cases/{id}/checksRun verification checks against a case./api/v1/cases/{id}/adjudicateAdjudicate a case to a decision./api/v1/monitoring/rescreenRe-screen a subject against updated watchlists./api/v1/consentCapture a consent decision./api/v1/can-processCheck whether processing is permitted for a purpose./api/v1/dsarOpen a data-subject access request./api/v1/dsar/{id}/execute-erasureExecute a verified erasure across the platform.Metrics, logs, traces, SLOs, incidents, a live CMDB and release gating.
/api/v1/metricsRecord a metric sample./api/v1/logsIngest a structured log record./api/v1/slosDefine an SLO with an error budget./api/v1/slos/{name}/burnRead an SLO's burn rate./api/v1/slos/{name}/evaluate-and-routeEvaluate an SLO and route a breach to alerting./api/v1/incidentsOpen an incident./api/v1/incidents/{id}/pagePage the on-call for an incident./api/v1/incidents/{id}/escalateEscalate an incident up the ladder./api/v1/incidents/{id}/postmortemFile a postmortem for review./api/v1/cisRegister a configuration item./api/v1/cis/{id}/blast-radiusCompute the blast radius of a CI./api/v1/cis/{id}/dependenciesList a CI's dependencies./api/v1/graph/diffDiff the dependency graph over time./api/v1/candidatesRegister a release candidate./api/v1/candidates/{id}/checksRun gating checks against a candidate./api/v1/candidates/{id}/gateJudge the candidate and record a gate verdict./api/v1/candidates/{id}/verdictsRead a candidate's verdict history.Durable workflows, an event bus, connectors, realtime channels, rules and schedules.
/api/v1/workflowsStart a durable workflow./api/v1/workflows/{id}/signalsSend a signal to a running workflow./api/v1/workflows/{id}/resetReset a workflow to an earlier event./api/v1/workflows/stuckList workflows that are stuck./api/v1/topicsCreate a topic./api/v1/topics/{name}/messagesPublish a message to a topic./api/v1/topics/{name}/schemasRegister a schema for a topic./api/v1/topics/{name}/groups/{group}/commitCommit a consumer-group offset./api/v1/endpointsRegister a delivery endpoint./api/v1/emitEmit a canonical event into the hub./api/v1/dlq/{id}/replayReplay a dead-lettered delivery./api/v1/endpoints/{id}/breaker/resetReset a tripped circuit breaker./api/v1/channels/{name}/publishPublish a message to a channel./api/v1/channels/{name}/subscribeSubscribe to a channel./api/v1/channels/{name}/presenceRead channel presence./api/v1/channels/{name}/resumeResume a dropped connection from a cursor./api/v1/rulesets/{name}/evaluateEvaluate a ruleset against input./api/v1/rulesets/{name}/evaluate-as-ofEvaluate as of a historical ruleset version./api/v1/rulesets/{name}/versions/{n}/simulateSimulate a ruleset version before activation./api/v1/receipts/{id}/re-deriveRe-derive a decision from its receipt./api/v1/schedulesCreate a schedule./api/v1/schedules/{id}/previewPreview upcoming fire times./api/v1/schedules/{id}/run-nowFire a schedule immediately./api/v1/fires/{key}/ackAcknowledge a fire for exactly-once semantics.Model serving, RAG, guardrails, an MLOps feature store and a federated MCP tool gateway.
/api/v1/broker/{name}/inferRun inference through the model broker./api/v1/embeddingsGenerate embeddings./api/v1/kb/{name}/retrieveRetrieve from a knowledge base (RAG)./api/v1/guardrailsApply input/output guardrails./api/v1/models/{name}/{version}/canary/advanceAdvance a model canary rollout./api/v1/feature-setsDefine a feature set./api/v1/features/{name}/point-in-timePoint-in-time feature lookup for training/serving parity./api/v1/features/{name}/skew-checkCheck training/serving skew./api/v1/driftReport a drift observation./api/v1/models/{name}/{version}/serve-guardCheck whether a model version is safe to serve./api/v1/nodesRegister an MCP node./api/v1/catalogGet the full federated tool catalog snapshot./api/v1/catalog/refreshRe-sync tools across all federated nodes./api/v1/tools/{name}Get a tool's schema and owning node.A double-entry payments core, metered billing, wallets and a provider marketplace.
/api/v1/instructionsCreate a payment instruction./api/v1/instructions/{id}/captureCapture an authorized instruction./api/v1/settlementsSettle a batch./api/v1/payouts/runRun a payout batch./api/v1/sca/evaluateEvaluate strong-customer-authentication requirements./api/v1/ledgerRead the double-entry ledger./api/v1/usageIngest a usage event./api/v1/invoices/finalizeFinalize draft invoices./api/v1/dunning/{invoice}/startStart a dunning cycle on an overdue invoice./api/v1/entitlements/{item}Read an entitlement's current state./api/v1/subscribeSubscribe an account to a plan./api/v1/walletsCreate a wallet./api/v1/wallets/{id}/debitDebit a wallet./api/v1/wallets/{id}/holdsPlace a hold on a wallet./api/v1/wallets/{id}/holds/{hold}/captureCapture a hold./api/v1/providersOnboard a provider./api/v1/reservationsReserve marketplace capacity./api/v1/settlements/{id}/finalizeFinalize a provider settlement./api/v1/reconciliations/{id}/disputeDispute a reconciliation.Carrier-grade voice routing, messaging, notifications, fraud control and media.
/api/v1/routes/selectSelect a least-cost route for a call./api/v1/sbc/inviteHandle an SBC INVITE./api/v1/stir/pki/signSign a call with a STIR/SHAKEN credential./api/v1/webrtc/sessionsCreate a WebRTC call session./api/v1/plans/{id}/promotePromote a canaried routing plan./api/v1/voice/appsRegister a programmable-voice application./api/v1/voice/sessionsCreate a programmable-voice call session./api/v1/acd/queuesProvision an ACD call queue./api/v1/ussd/flowsDefine a USSD flow./api/v1/sendSend a notification across channels./api/v1/smsc/submitSubmit a message to the SMSC./api/v1/ott/sendSend an OTT (WhatsApp-style) message./api/v1/messages/{id}/failoverFail a message over to a fallback channel./api/v1/scoreScore an event for fraud risk./api/v1/acm/callsIngest a call event through anti-call-mask./api/v1/voxguard/screenScreen an A2P message through VoxGuard./api/v1/telecom/leakageRead the revenue-assurance leakage summary./api/v1/assets/{id}/transcodeTranscode an asset to renditions./api/v1/assets/{id}/packagePackage an asset for adaptive streaming./api/v1/playback/sessionsStart a DRM-gated playback session./api/v1/assets/{id}/manifest.m3u8Fetch the HLS manifest for an asset.An internal developer portal, the API gateway, docs, value-ops and FinOps.
/api/v1/golden-paths/{id}/adoptAdopt a golden path for a new service./api/v1/blueprints/{id}/scaffoldsScaffold a service from a blueprint./api/v1/scorecards/{component}/evaluateEvaluate a component scorecard./api/v1/catalog/componentsBrowse the service catalog./api/v1/admitAdmit an external request against policy./api/v1/routesRegister an external route./api/v1/routes/weightsSet weighted traffic split across route versions./api/v1/entitlementsCheck a caller's entitlements./api/v1/docsAuthor a documentation page./api/v1/docs/{id}/approveApprove a doc for publish./api/v1/docs/{id}/driftCheck a doc for drift against its source./api/v1/searchSearch the docs corpus./api/v1/betsCreate a product bet./api/v1/okrs/{id}/checkinRecord an OKR check-in as immutable evidence./api/v1/prioritization/scoreScore an item with RICE or WSJF./api/v1/roi/calculateCalculate platform ROI (net benefit, payback)./api/v1/budgetsCreate a budget./api/v1/anomaliesRaise a cost anomaly./api/v1/allocation/simulateSimulate a cost-allocation rule./api/v1/unit-economics/calculateCalculate unit economics for a segment.