burstdocsControl API reference
These routes are generated from the registered Go control routes. Bodies and lifecycle constraints are documented in the connected lifecycle guide.
Sessions and request protection
Human operations use a real OIDC login and a host-only server-side session. Browser mutations require the current session, an exact matching Origin and an X-CSRF-Token header. Most mutations also require an Idempotency-Key of 8–128 characters. Reuse a key only for an identical retry; successful requests have persisted outcomes. Policy and automation simulations are read-only POSTs and do not require mutation idempotency.
Node enrollment consumption, renewal and attestation use their separately documented bootstrap and mTLS identity checks. They do not accept browser sessions as substitutes for node identity.
Catalog pagination
The nodes, audit, objects, groups, grants and policies catalogs accept a limit of 1–100 (default 25) and an optional cursor. A response contains items and, if another page exists, next_cursor. Supply that cursor unchanged to retrieve the next page. Cursors do not grant authority. Each page is independently authorized against current state.
Node and audit catalogs require a network operator. Group catalogs require scoped grant-management authority. Grant catalogs show managers the space records and ordinary actors only their own, group-targeted or issued grants. Object metadata browsing requires space visibility; fetching bytes still requires the current object grant and contract. Policies expose descriptors and obligations, never private keys.
Registered routes
| Method | Route | Handler |
|---|---|---|
| GET | /auth/login | startLogin |
| GET | /auth/callback | finishLogin |
| POST | /auth/logout | logout |
| POST | /v1/networks/{network}/spaces/{space}/groups | createGroup |
| POST | /v1/networks/{network}/spaces/{space}/groups/{group}/members | groupMember |
| POST | /v1/networks/{network}/spaces/{space}/grants | createGrant |
| POST | /v1/networks/{network}/spaces/{space}/grants/{grant}/revoke | revokeGrant |
| POST | /v1/networks/{network}/keys | registerSigningKey |
| POST | /v1/networks/{network}/spaces/{space}/policies | publishPolicy |
| POST | /v1/networks/{network}/nodes/{node}/directory | registerNode |
| POST | /v1/networks/{network}/spaces/{space}/objects | upload |
| GET | /v1/networks/{network}/spaces/{space}/objects/{object} | readObject |
| POST | /v1/networks/{network}/spaces/{space}/objects/{object}/delete | deleteObject |
| POST | /v1/networks/{network}/reconcile | maintenanceAPI |
| POST | /v1/networks/{network}/node/renew | renew |
| POST | /v1/networks/{network}/enrollments/{enrollment}/attest | attestEnrollment |
| POST | /v1/networks/{network}/node/attest | refreshAttestation |
| GET | /v1/networks/{network}/status | status |
| POST | /v1/networks/{network}/spaces/{space}/context | updatePolicyContext |
| POST | /v1/networks/{network}/spaces/{space}/policies/simulate | simulatePolicy |
| POST | /v1/networks/{network}/spaces/{space}/automation/simulate | simulateAutomation |
| GET | /v1/me | me |
| GET | /v1/networks/{network}/access | networkAccess |
| GET | /v1/networks/{network}/nodes | listNodes |
| GET | /v1/networks/{network}/audit | listAudit |
| GET | /v1/networks/{network}/spaces/{space}/access | spaceAccess |
| GET | /v1/networks/{network}/spaces/{space}/objects | listObjects |
| GET | /v1/networks/{network}/spaces/{space}/groups | listGroups |
| GET | /v1/networks/{network}/spaces/{space}/grants | listGrants |
| GET | /v1/networks/{network}/spaces/{space}/policies | listPolicies |
| GET | /v1/networks | networks |
| GET | /v1/networks/{network}/spaces | spaces |
| POST | /v1/networks/{network}/spaces | createSpace |
| GET | /v1/networks/{network}/spaces/{space} | getSpace |
| POST | /v1/networks/{network}/enrollments | createEnrollment |
| POST | /v1/networks/{network}/enrollments/{enrollment}/approve | approveEnrollment |
| POST | /v1/networks/{network}/enrollments/{enrollment}/consume | consumeEnrollment |
| POST | /v1/networks/{network}/nodes/{node}/quarantine | quarantine |
| GET | /v1/networks/{network}/node | node |
Errors and authority
API errors contain a machine-readable error code. The response X-Request-ID is a correlation identifier; include it when troubleshooting, never session tokens or payloads. Expired objects deny reads before maintenance. Network operators can administer entitlements but do not implicitly bypass object-read grants or signed policy.
A 401 requires sign-in. A 403 indicates denied authority or request protection. A 409 indicates a conflicting mutation or revision. A 410 indicates expiry. A 503 may indicate unavailable authority, policy execution, key custody or verified replicas.