Developer tools overview

You can manage your projects from code in two ways. The REST API is the platform's own HTTP API, the same API that the console uses, and you call it with an API token or a service account key. The OpenStack APIs serve OpenStack tools, such as the openstack CLI, Terraform, and Kubernetes cloud integrations, which sign in with an application credential.

Key featuresCopy Anchor Link

• The console's own API. The console sends its requests to the REST API, and you can send the same requests from your code. See REST API overview.
• Scoped credentials. API tokens carry scopes, an optional expiry date, and an optional IP allowlist. Service account keys act with the roles of a service account. See Authenticate with API tokens.
• Requests to copy. The REST equivalent on the last step of the instance creation wizard shows the request as a curl command. An admin password is read from the ADMIN_PASSWORD environment variable instead of being printed. See Create a virtual machine.
• Asynchronous work that you can follow. Long-running requests return an operation that you can read until it finishes. See Synchronous and asynchronous requests.
• Safe retries. An idempotency key makes a retried write return the first result instead of repeating the change. See Idempotent requests.
• API reference. The operations of each product, with their parameters and responses. See API reference.
• OpenStack-compatible tools. The openstack CLI, Terraform, and OCCM and Cinder CSI for Kubernetes work with your projects. See OpenStack-compatible tools.

How it worksCopy Anchor Link

Both kinds of APIs act on the same resources. An instance that you create with Terraform appears in the console and is billed like an instance that you create in the console. Resources that you create through either API count against the same quotas.

The REST API is served under /api/v1 on the API host, which isn't the console's host. Most paths start with the ID of a project, and every request carries a bearer credential that the API gateway checks before the request reaches a service. Writes that the platform carries out in the cloud, such as creating an instance, return 202 Accepted and continue in the background; you follow them through an operation or the resource's status. Operations that you start through the REST API, such as creating or deleting a resource, appear in the Activity Log with the user or service account that started them. See Audit and activity records.

The REST API has no command-line tool or Terraform provider of its own: you call it over HTTP, for example with curl. For infrastructure as code, use Terraform's OpenStack provider with an application credential.

An application credential belongs to one project and acts with the OpenStack roles that your role in the project gives you. You create it in the console, and you can download configuration files for each tool when you create it. API tokens don't work with OpenStack tools, and application credentials don't work with the REST API.

Use casesCopy Anchor Link

• CI/CD pipelines. Create and delete test environments from a pipeline with a service account key that doesn't depend on a person's account.
• Infrastructure as code. Describe networks, instances, and volumes in Terraform and apply them with an application credential.
• Kubernetes on your instances. Connect a cluster that you run on your instances to the cloud with OCCM and Cinder CSI.
• Reporting. Read cost data and activity records into your own tools.

BillingCopy Anchor Link

The APIs don't change how resources are billed: a resource that you create through an API is billed by the same dimensions as one that you create in the console. For the dimensions of each product, see How billing works.

LimitsCopy Anchor Link

• The API gateway limits how fast each credential can send requests, and answers 429 Too Many Requests when you exceed the limit. See Rate limiting.
• Most lists return at most 200 items per page. See Pagination.
• The platform keeps an idempotency key for at least 24 hours. See Idempotent requests.
• Some operations are refused to an API token or a service account key even when the scope is right, for example the ones that need a console session. See What an API token can't call.
• Application credentials have their own limits. See OpenStack API limits.

Related servicesCopy Anchor Link

• Identity & Access Management: service accounts, API tokens, and roles.
• OpenStack API Access: application credentials for OpenStack tools.
• Activity Log: the record of operations in your projects.

Next stepsCopy Anchor Link