Enterprise Manager API reference
The Enterprise Manager API covers users, groups, connectors, managed secrets, virtual API keys, budgets, and signed Stacklok CLI configuration.
The running service also self-serves this reference at /api/doc, which is
generated from the same source and therefore always matches the version you have
deployed.
The generated specification omits the SCIM provisioning and budget webhook
routes. Use /api/doc on the running service for its complete API reference.
Base URL
The REST API uses the Service's HTTP port (service.port, default 80). The
same Service also exposes gRPC and webhook ports for other integrations. For an
externally exposed deployment, use the Enterprise Manager URL configured as
resourceURL, including any path prefix your ingress requires.
With the default Service name and port, the in-cluster base URL is:
http://<RELEASE_NAME>-enterprise-manager.<NAMESPACE>.svc:80
<RELEASE_NAME> is your platform Helm release name. Helm name overrides can
change the Service name, and values overrides can change the port. Check your
installed Services:
kubectl get svc -n <NAMESPACE>
For a local connection, forward the Service's HTTP port:
kubectl port-forward -n <NAMESPACE> svc/<SERVICE_NAME> 8080:80
Replace <SERVICE_NAME> with the installed Service name. Keep the command
running in a separate terminal. Your local base URL is http://localhost:8080.
Append each endpoint path to the base URL once; for example,
http://localhost:8080/v1/me/connections. API authentication still applies when
using a port-forward.
For external access, ask your platform administrator for the URL routed to the Service above. See Expose the platform endpoints for the routing setup.
The interactive reference uses http://localhost:8080, which matches the
port-forward above. For calls from inside the cluster or through an external
endpoint, replace that address with your deployment's base URL.
Authenticate
Send an access token from your corporate identity provider in an
Authorization: Bearer <TOKEN> header. The Enterprise Manager accepts a signed
JWT from the issuer it trusts that carries:
- The audience set in
idpConfig.audience. - The scope set in
idpConfig.requiredScope, such astoolhive:config:read.
Administration routes, such as budgets, pricing, and directory changes, also
require a user with the platform admin grant. Routes under /v1/me return the
caller's own data and need no grant.
Request the token for an administrator's account with the authorization code flow and PKCE, the same flow the Stacklok CLI uses, asking for the Enterprise Manager's audience and required scope. Before you use it, check its issuer, audience, and scope as described in Verify a token. See Configure platform identity for how these values are set up in your identity provider.