Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
API reference
Reference for the REST API operations of each product, generated from the platform API contract.
Compute 47 operations
| Operation | Endpoint |
|---|---|
| The active Category → Series → Flavor tree for one region | GET /catalog |
| List the active add-ons with their sellable periods | GET /catalog/addons |
| List the active software licenses with their sellable periods | GET /catalog/licenses |
| List the compute flavor (size) catalog in the active scope | GET /scopes/{scopeId}/compute/flavors |
| Live per-flavor placement availability in a region, for the size picker | GET /scopes/{scopeId}/compute/flavors/availability |
| List and query machine images in the active scope | GET /scopes/{scopeId}/compute/images |
| Create a machine image from an instance, snapshot, or import URL | POST /scopes/{scopeId}/compute/images |
| Get the machine image detail read model | GET /scopes/{scopeId}/compute/images/{imageId} |
| Delete a machine image | DELETE /scopes/{scopeId}/compute/images/{imageId} |
| Revoke a cross-account share of a machine image | POST /scopes/{scopeId}/compute/images/{imageId}/actions/revoke |
| Replace the tag set of a machine image | PUT /scopes/{scopeId}/compute/images/{imageId}/tags |
| List and query compute instances in the active scope | GET /scopes/{scopeId}/compute/instances |
| Create (provision) a new compute instance | POST /scopes/{scopeId}/compute/instances |
| Get one compute instance (detail read model) | GET /scopes/{scopeId}/compute/instances/{instanceId} |
| Update mutable instance configuration | PATCH /scopes/{scopeId}/compute/instances/{instanceId} |
| Delete a compute instance | DELETE /scopes/{scopeId}/compute/instances/{instanceId} |
| List an instance's add-on/license attachments | GET /scopes/{scopeId}/compute/instances/{instanceId}/catalog-items |
| Attach a data disk to the instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/attach |
| Detach a data disk from the instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/detach |
| Get connection descriptors for the instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/connect |
| Export the instance configuration as a deployment template | POST /scopes/{scopeId}/compute/instances/{instanceId}/exports |
| Start a stopped instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/start |
| Stop a running instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/stop |
| Restart (reboot) a running instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/restart |
| Pause a running instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/pause |
| Resume a paused or suspended instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/resume |
| Resize the instance to a different flavor | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/resize |
| Attach a network interface (NIC) to the instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/attach-interface |
| Detach a network interface (NIC) from the instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/detach-interface |
| Bind a security group to the instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/attach-security-group |
| Unbind a security group from the instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/actions/detach-security-group |
| Replace the instance's tag set | PUT /scopes/{scopeId}/compute/instances/{instanceId}/tags |
| Read VM metric time series for one instance (Monitoring tab) | GET /scopes/{scopeId}/compute/instances/{instanceId}/metrics |
| Establish (or re-establish) the web console connection for an instance | POST /scopes/{scopeId}/compute/instances/{instanceId}/console/actions/connect |
| Create an interactive console session for an instance (console route load) | POST /scopes/{scopeId}/compute/instances/{instanceId}/console/actions/connect-console |
| Download the instance serial console log as a plain-text file | GET /scopes/{scopeId}/compute/instances/{instanceId}/console/logs/export |
| List and query SSH key pairs in the active scope | GET /scopes/{scopeId}/compute/key-pairs |
| Create (generate) or import an SSH key pair in the active scope | POST /scopes/{scopeId}/compute/key-pairs |
| Retrieve a key pair detail read model | GET /scopes/{scopeId}/compute/key-pairs/{keyPairId} |
| Delete a key pair from the active scope | DELETE /scopes/{scopeId}/compute/key-pairs/{keyPairId} |
| Export key pair material as a downloadable PEM artifact | POST /scopes/{scopeId}/compute/key-pairs/{keyPairId}/exports |
| Download the OpenSSH public key file of a key pair | GET /scopes/{scopeId}/compute/key-pairs/{keyPairId}/public-key |
| List and query VM snapshots in the active scope | GET /scopes/{scopeId}/compute/snapshots |
| Create a crash-consistent snapshot of an instance or volume | POST /scopes/{scopeId}/compute/snapshots |
| Retrieve a VM snapshot with its detail panels | GET /scopes/{scopeId}/compute/snapshots/{snapshotId} |
| Delete a VM snapshot | DELETE /scopes/{scopeId}/compute/snapshots/{snapshotId} |
| Replace the tag set of a VM snapshot | PUT /scopes/{scopeId}/compute/snapshots/{snapshotId}/tags |
Storage 59 operations
| Operation | Endpoint |
|---|---|
| List backup plans in the active scope | GET /scopes/{scopeId}/storage/backup-plans |
| Create a backup plan, optionally assigning volumes to it | POST /scopes/{scopeId}/storage/backup-plans |
| Get a backup plan with its assignments and recent runs | GET /scopes/{scopeId}/storage/backup-plans/{planId} |
| Update a backup plan's policy | PATCH /scopes/{scopeId}/storage/backup-plans/{planId} |
| Delete a backup plan | DELETE /scopes/{scopeId}/storage/backup-plans/{planId} |
| Pause a backup plan | POST /scopes/{scopeId}/storage/backup-plans/{planId}/actions/pause |
| Resume a paused backup plan | POST /scopes/{scopeId}/storage/backup-plans/{planId}/actions/resume |
| Run a backup plan now | POST /scopes/{scopeId}/storage/backup-plans/{planId}/actions/run |
| List the volumes assigned to a backup plan | GET /scopes/{scopeId}/storage/backup-plans/{planId}/assignments |
| Assign volumes to a backup plan | POST /scopes/{scopeId}/storage/backup-plans/{planId}/assignments |
| Remove volumes from a backup plan | POST /scopes/{scopeId}/storage/backup-plans/{planId}/actions/unassign-volumes |
| List a backup plan's runs | GET /scopes/{scopeId}/storage/backup-plans/{planId}/runs |
| Get one run of a backup plan | GET /scopes/{scopeId}/storage/backup-plans/{planId}/runs/{runId} |
| List one run's per-volume results | GET /scopes/{scopeId}/storage/backup-plans/{planId}/runs/{runId}/volume-results |
| Retry only the volumes that did not succeed in a run | POST /scopes/{scopeId}/storage/backup-plans/{planId}/runs/{runId}/actions/retry-failed |
| List one volume's recovery points under a backup plan | GET /scopes/{scopeId}/storage/backup-plans/{planId}/volumes/{volumeId}/restore-points |
| Restore one volume from one recovery point | POST /scopes/{scopeId}/storage/backup-plans/{planId}/volumes/{volumeId}/restore-points/{restorePointId}/actions/restore |
| Temp-URL key rotation advice for the project's object storage | GET /scopes/{scopeId}/storage/temp-url-key |
| Rotate the project's Swift Temp-URL key | POST /scopes/{scopeId}/storage/temp-url-key/actions/rotate |
| List and query object storage buckets | GET /scopes/{scopeId}/storage/buckets |
| Create an object storage bucket | POST /scopes/{scopeId}/storage/buckets |
| Retrieve the bucket detail read model | GET /scopes/{scopeId}/storage/buckets/{bucketId} |
| Delete a bucket | DELETE /scopes/{scopeId}/storage/buckets/{bucketId} |
| Download an object from the bucket | POST /scopes/{scopeId}/storage/buckets/{bucketId}/exports |
| Delete one object from the bucket | DELETE /scopes/{scopeId}/storage/buckets/{bucketId}/objects |
| Delete several objects from the bucket | POST /scopes/{scopeId}/storage/buckets/{bucketId}/objects/actions/delete |
| Refresh the bucket object listing and counters | POST /scopes/{scopeId}/storage/buckets/{bucketId}/actions/refresh |
| Initiate an object upload into the bucket | POST /scopes/{scopeId}/storage/buckets/{bucketId}/uploads |
| Update the bucket visibility and public-access guardrails (policy statements are refused) | PATCH /scopes/{scopeId}/storage/buckets/{bucketId}/policies |
| Add a CORS rule to the bucket (lifecycle and replication are refused) | POST /scopes/{scopeId}/storage/buckets/{bucketId}/configuration-rules |
| Remove a CORS, lifecycle or replication rule from the bucket | DELETE /scopes/{scopeId}/storage/buckets/{bucketId}/configuration-rules/{configurationRuleId} |
| List and query NFS/SMB file shares in the active scope | GET /scopes/{scopeId}/storage/file-shares |
| Create a managed NFS or SMB file share | POST /scopes/{scopeId}/storage/file-shares |
| Get one file share with all detail panels | GET /scopes/{scopeId}/storage/file-shares/{fileShareId} |
| Delete a file share | DELETE /scopes/{scopeId}/storage/file-shares/{fileShareId} |
| Resize a file share's provisioned capacity | POST /scopes/{scopeId}/storage/file-shares/{fileShareId}/actions/resize |
| Add an access (security) rule to a file share | POST /scopes/{scopeId}/storage/file-shares/{fileShareId}/security-rules |
| List and query block-volume snapshots in the active scope | GET /scopes/{scopeId}/storage/snapshots |
| Create a point-in-time snapshot of a block volume | POST /scopes/{scopeId}/storage/snapshots |
| Get one block-volume snapshot with all detail panels | GET /scopes/{scopeId}/storage/snapshots/{snapshotId} |
| Delete a block-volume snapshot | DELETE /scopes/{scopeId}/storage/snapshots/{snapshotId} |
| Restore a block-volume snapshot into a new volume | POST /scopes/{scopeId}/storage/snapshots/{snapshotId}/actions/restore |
| List block volumes in the active scope | GET /scopes/{scopeId}/storage/volumes |
| Create a block volume | POST /scopes/{scopeId}/storage/volumes |
| Retrieve a block volume detail read model | GET /scopes/{scopeId}/storage/volumes/{volumeId} |
| Rename a block volume (mutable metadata) | PATCH /scopes/{scopeId}/storage/volumes/{volumeId} |
| Delete a block volume | DELETE /scopes/{scopeId}/storage/volumes/{volumeId} |
| Replace the volume's tag set | PUT /scopes/{scopeId}/storage/volumes/{volumeId}/tags |
| Attach a volume to an instance | POST /scopes/{scopeId}/storage/volumes/{volumeId}/actions/attach |
| Detach a volume from its instance | POST /scopes/{scopeId}/storage/volumes/{volumeId}/actions/detach |
| Clone a volume | POST /scopes/{scopeId}/storage/volumes/{volumeId}/actions/clone |
| Resize a volume | POST /scopes/{scopeId}/storage/volumes/{volumeId}/actions/resize |
| Create a snapshot of a volume | POST /scopes/{scopeId}/storage/volumes/{volumeId}/snapshots |
| Offer a volume to another project in the same tenant | POST /scopes/{scopeId}/storage/volumes/{volumeId}/actions/transfer |
| List the volume transfer offers this project has open | GET /scopes/{scopeId}/storage/volume-transfers |
| Read one open transfer offer | GET /scopes/{scopeId}/storage/volume-transfers/{transferId} |
| Withdraw a transfer offer | DELETE /scopes/{scopeId}/storage/volume-transfers/{transferId} |
| Accept a volume transfer offer into this project | POST /scopes/{scopeId}/storage/volume-transfers/actions/accept |
| Change a volume's category (tier) | POST /scopes/{scopeId}/storage/volumes/{volumeId}/actions/retype |
Networking 89 operations
| Operation | Endpoint |
|---|---|
| List the external networks the scope may allocate floating IPs from (or attach to) | GET /scopes/{scopeId}/network/floating-ip-pools |
| List floating IPs in the active scope | GET /scopes/{scopeId}/network/floating-ips |
| Allocate a new floating IP | POST /scopes/{scopeId}/network/floating-ips |
| Retrieve floating IP detail | GET /scopes/{scopeId}/network/floating-ips/{floatingIpId} |
| Associate the floating IP with a target resource | POST /scopes/{scopeId}/network/floating-ips/{floatingIpId}/actions/associate |
| Disassociate the floating IP from its current target | POST /scopes/{scopeId}/network/floating-ips/{floatingIpId}/actions/disassociate |
| Release the floating IP back to its pool | POST /scopes/{scopeId}/network/floating-ips/{floatingIpId}/actions/release |
| List network interfaces (ports) in the active scope | GET /scopes/{scopeId}/network/network-interfaces |
| Create a network interface (port) | POST /scopes/{scopeId}/network/network-interfaces |
| Get network interface detail | GET /scopes/{scopeId}/network/network-interfaces/{networkInterfaceId} |
| Update network interface configuration | PATCH /scopes/{scopeId}/network/network-interfaces/{networkInterfaceId} |
| Delete a network interface (port) | DELETE /scopes/{scopeId}/network/network-interfaces/{networkInterfaceId} |
| Allocate a new floating IP for the port | POST /scopes/{scopeId}/network/network-interfaces/{networkInterfaceId}/actions/allocate |
| Attach an association to the port (security group or floating IP) | POST /scopes/{scopeId}/network/network-interfaces/{networkInterfaceId}/actions/attach |
| Remove an association from the port | POST /scopes/{scopeId}/network/network-interfaces/{networkInterfaceId}/actions/detach |
| List load balancers | GET /scopes/{scopeId}/network/load-balancers |
| Create load balancer | POST /scopes/{scopeId}/network/load-balancers |
| Get load balancer detail | GET /scopes/{scopeId}/network/load-balancers/{loadBalancerId} |
| Update load balancer settings | PATCH /scopes/{scopeId}/network/load-balancers/{loadBalancerId} |
| Delete load balancer | DELETE /scopes/{scopeId}/network/load-balancers/{loadBalancerId} |
| Remove backend member | DELETE /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/backend-members/{backendMemberId} |
| Add listener | POST /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/listeners |
| Update listener | PATCH /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/listeners/{listenerId} |
| Delete listener | DELETE /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/listeners/{listenerId} |
| Add backend pool | POST /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/pools |
| Update backend pool | PATCH /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/pools/{poolId} |
| Delete backend pool | DELETE /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/pools/{poolId} |
| Attach health monitor to a backend pool | POST /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/pools/{poolId}/monitor |
| Update a pool's health monitor | PATCH /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/pools/{poolId}/monitor |
| Delete a pool's health monitor | DELETE /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/pools/{poolId}/monitor |
| Add target to pool | POST /scopes/{scopeId}/network/load-balancers/{loadBalancerId}/targets |
| List virtual networks in the active scope | GET /scopes/{scopeId}/network/networks |
| Create a virtual network | POST /scopes/{scopeId}/network/networks |
| Get virtual network detail | GET /scopes/{scopeId}/network/networks/{networkId} |
| Update virtual network configuration | PATCH /scopes/{scopeId}/network/networks/{networkId} |
| Delete a virtual network | DELETE /scopes/{scopeId}/network/networks/{networkId} |
| Add a subnet to a virtual network | POST /scopes/{scopeId}/network/networks/{networkId}/subnets |
| Update a subnet | PATCH /scopes/{scopeId}/network/networks/{networkId}/subnets/{subnetId} |
| Delete a subnet | DELETE /scopes/{scopeId}/network/networks/{networkId}/subnets/{subnetId} |
| List routers | GET /scopes/{scopeId}/network/routers |
| Create router | POST /scopes/{scopeId}/network/routers |
| Get router detail | GET /scopes/{scopeId}/network/routers/{routerId} |
| Update router | PATCH /scopes/{scopeId}/network/routers/{routerId} |
| Delete router | DELETE /scopes/{scopeId}/network/routers/{routerId} |
| Refresh router state | POST /scopes/{scopeId}/network/routers/{routerId}/actions/refresh |
| Set external gateway | POST /scopes/{scopeId}/network/routers/{routerId}/gateways/{gatewayId}/actions/set-gateway |
| Clear external gateway | POST /scopes/{scopeId}/network/routers/{routerId}/gateways/actions/clear-gateway |
| Set external gateway (server-picked external network) | POST /scopes/{scopeId}/network/routers/{routerId}/gateways/actions/set-gateway |
| Attach router interface | POST /scopes/{scopeId}/network/routers/{routerId}/network-interfaces |
| Detach router interface | DELETE /scopes/{scopeId}/network/routers/{routerId}/network-interfaces/{networkInterfaceId} |
| Add static route | POST /scopes/{scopeId}/network/routers/{routerId}/routes |
| Remove static route | DELETE /scopes/{scopeId}/network/routers/{routerId}/routes/{routeId} |
| List security groups | GET /scopes/{scopeId}/network/security-groups |
| Create a security group | POST /scopes/{scopeId}/network/security-groups |
| Get security group detail | GET /scopes/{scopeId}/network/security-groups/{securityGroupId} |
| Update a security group | PATCH /scopes/{scopeId}/network/security-groups/{securityGroupId} |
| Delete a security group | DELETE /scopes/{scopeId}/network/security-groups/{securityGroupId} |
| Add a security rule to a group | POST /scopes/{scopeId}/network/security-groups/{securityGroupId}/security-rules |
| Edit (replace) a security rule | PUT /scopes/{scopeId}/network/security-groups/{securityGroupId}/security-rules/{securityRuleId} |
| Delete a security rule from a group | DELETE /scopes/{scopeId}/network/security-groups/{securityGroupId}/security-rules/{securityRuleId} |
| List IKE (Phase 1) policies in the active scope | GET /scopes/{scopeId}/network/vpn/ike-policies |
| Create a reusable IKE (Phase 1) policy | POST /scopes/{scopeId}/network/vpn/ike-policies |
| Get one IKE (Phase 1) policy | GET /scopes/{scopeId}/network/vpn/ike-policies/{vpnIkePolicyId} |
| Update an IKE (Phase 1) policy | PATCH /scopes/{scopeId}/network/vpn/ike-policies/{vpnIkePolicyId} |
| Delete an IKE (Phase 1) policy | DELETE /scopes/{scopeId}/network/vpn/ike-policies/{vpnIkePolicyId} |
| List IPsec (Phase 2) policies in the active scope | GET /scopes/{scopeId}/network/vpn/ipsec-policies |
| Create a reusable IPsec (Phase 2) policy | POST /scopes/{scopeId}/network/vpn/ipsec-policies |
| Get one IPsec (Phase 2) policy | GET /scopes/{scopeId}/network/vpn/ipsec-policies/{vpnIpsecPolicyId} |
| Update an IPsec (Phase 2) policy | PATCH /scopes/{scopeId}/network/vpn/ipsec-policies/{vpnIpsecPolicyId} |
| Delete an IPsec (Phase 2) policy | DELETE /scopes/{scopeId}/network/vpn/ipsec-policies/{vpnIpsecPolicyId} |
| List VPN services in the active scope | GET /scopes/{scopeId}/network/vpn/services |
| Create a VPN service on a router | POST /scopes/{scopeId}/network/vpn/services |
| Get one VPN service | GET /scopes/{scopeId}/network/vpn/services/{vpnServiceId} |
| Update a VPN service | PATCH /scopes/{scopeId}/network/vpn/services/{vpnServiceId} |
| Delete a VPN service | DELETE /scopes/{scopeId}/network/vpn/services/{vpnServiceId} |
| List VPN endpoint groups in the active scope | GET /scopes/{scopeId}/network/vpn/endpoint-groups |
| Create a VPN endpoint group (exactly one endpoint) | POST /scopes/{scopeId}/network/vpn/endpoint-groups |
| Get one VPN endpoint group | GET /scopes/{scopeId}/network/vpn/endpoint-groups/{vpnEndpointGroupId} |
| Rename a VPN endpoint group | PATCH /scopes/{scopeId}/network/vpn/endpoint-groups/{vpnEndpointGroupId} |
| Delete a VPN endpoint group | DELETE /scopes/{scopeId}/network/vpn/endpoint-groups/{vpnEndpointGroupId} |
| List IPsec site connections in the active scope | GET /scopes/{scopeId}/network/vpn/site-connections |
| Create an IPsec site connection from existing objects | POST /scopes/{scopeId}/network/vpn/site-connections |
| Get IPsec site connection detail | GET /scopes/{scopeId}/network/vpn/site-connections/{vpnSiteConnectionId} |
| Update an IPsec site connection | PATCH /scopes/{scopeId}/network/vpn/site-connections/{vpnSiteConnectionId} |
| Delete an IPsec site connection | DELETE /scopes/{scopeId}/network/vpn/site-connections/{vpnSiteConnectionId} |
| Administratively disable an IPsec site connection | POST /scopes/{scopeId}/network/vpn/site-connections/{vpnSiteConnectionId}/actions/disable |
| Re-enable a disabled IPsec site connection | POST /scopes/{scopeId}/network/vpn/site-connections/{vpnSiteConnectionId}/actions/enable |
| Renegotiate an IPsec site connection's security associations | POST /scopes/{scopeId}/network/vpn/site-connections/{vpnSiteConnectionId}/actions/restart |
| Re-read an IPsec site connection from the provider | POST /scopes/{scopeId}/network/vpn/site-connections/{vpnSiteConnectionId}/actions/refresh |
Identity & Access Management 84 operations
| Operation | Endpoint |
|---|---|
| List and query Access Analyzer findings | GET /scopes/{scopeId}/iam/access-findings |
| Get an Access Analyzer finding | GET /scopes/{scopeId}/iam/access-findings/{accessFindingId} |
| Archive an access finding as intended access | POST /scopes/{scopeId}/iam/access-findings/{accessFindingId}/actions/archive |
| Mark an access finding as resolved | POST /scopes/{scopeId}/iam/access-findings/{accessFindingId}/actions/resolve |
| List and query IAM activity (audit) events | GET /scopes/{scopeId}/iam/activities |
| List and query API tokens | GET /scopes/{scopeId}/iam/api-tokens |
| Create an API token (secret revealed once) | POST /scopes/{scopeId}/iam/api-tokens |
| Get an API token's detail and usage read model | GET /scopes/{scopeId}/iam/api-tokens/{apiTokenId} |
| Delete an API token | DELETE /scopes/{scopeId}/iam/api-tokens/{apiTokenId} |
| Revoke an API token immediately | POST /scopes/{scopeId}/iam/api-tokens/{apiTokenId}/actions/revoke |
| Rotate an API token's secret (new secret revealed once) | POST /scopes/{scopeId}/iam/api-tokens/{apiTokenId}/actions/rotate |
| Read the tenant's sign-in policy (enforce 2FA) | GET /scopes/{scopeId}/iam/auth-policy |
| Set the tenant's sign-in policy (enforce 2FA) | PUT /scopes/{scopeId}/iam/auth-policy |
| Read the organisation's direct OpenStack API access switch | GET /scopes/{scopeId}/iam/openstack-api-access |
| Switch direct OpenStack API access on or off for the organisation | PUT /scopes/{scopeId}/iam/openstack-api-access |
| List OpenStack API credentials in the project | GET /scopes/{scopeId}/iam/openstack-credentials |
| Create an OpenStack API credential (secret revealed once) | POST /scopes/{scopeId}/iam/openstack-credentials |
| Get one OpenStack API credential (no secret) | GET /scopes/{scopeId}/iam/openstack-credentials/{credentialId} |
| Revoke an OpenStack API credential | DELETE /scopes/{scopeId}/iam/openstack-credentials/{credentialId} |
| Rotate an OpenStack API credential (new secret revealed once) | POST /scopes/{scopeId}/iam/openstack-credentials/{credentialId}/actions/rotate |
| Read the IAM vocabularies the console renders (permission resources + policy services) | GET /scopes/{scopeId}/iam/catalog |
| List the subscription's quota limit and its per-project native quota allocation | GET /scopes/{scopeId}/iam/quota-allocations |
| Set the path project's native quota allocation for one quota id | PUT /scopes/{scopeId}/iam/quota-allocations/{quotaId} |
| List the organisation's requests for OS images the catalog does not offer | GET /scopes/{scopeId}/iam/image-requests |
| Request an OS image the catalog does not offer | POST /scopes/{scopeId}/iam/image-requests |
| Preview the live resources a project's cascade delete would destroy | GET /scopes/{scopeId}/iam/projects/{projectId}/live-resources |
| List the tenant's quota-increase requests | GET /scopes/{scopeId}/iam/quota-requests |
| File a quota-increase request | POST /scopes/{scopeId}/iam/quota-requests |
| List roles in the active scope | GET /scopes/{scopeId}/iam/roles |
| Create a custom role | POST /scopes/{scopeId}/iam/roles |
| Get role detail | GET /scopes/{scopeId}/iam/roles/{roleId} |
| Edit a custom role | PATCH /scopes/{scopeId}/iam/roles/{roleId} |
| Delete a custom role | DELETE /scopes/{scopeId}/iam/roles/{roleId} |
| Clone a role into a new custom role | POST /scopes/{scopeId}/iam/roles/{roleId}/actions/clone |
| List the principals holding a role in the active scope | GET /scopes/{scopeId}/iam/roles/{roleId}/assignments |
| Assign the role to a principal at a scope | POST /scopes/{scopeId}/iam/roles/{roleId}/assignments |
| List and query service accounts in the active scope | GET /scopes/{scopeId}/iam/service-accounts |
| Create a service account (optionally minting an initial key) | POST /scopes/{scopeId}/iam/service-accounts |
| Get service account detail with keys, bindings and auth activity | GET /scopes/{scopeId}/iam/service-accounts/{serviceAccountId} |
| Delete a service account | DELETE /scopes/{scopeId}/iam/service-accounts/{serviceAccountId} |
| Disable a service account (stop token issuance) | POST /scopes/{scopeId}/iam/service-accounts/{serviceAccountId}/actions/disable |
| Enable a previously disabled service account | POST /scopes/{scopeId}/iam/service-accounts/{serviceAccountId}/actions/enable |
| Replace the tag set on a service account | PUT /scopes/{scopeId}/iam/service-accounts/{serviceAccountId}/tags |
| Create a long-lived key and reveal its credential once | POST /scopes/{scopeId}/iam/service-accounts/{serviceAccountId}/keys |
| Revoke a key immediately | POST /scopes/{scopeId}/iam/service-accounts/{serviceAccountId}/keys/{keyId}/actions/revoke |
| List a service account's role bindings | GET /scopes/{scopeId}/iam/service-accounts/{serviceAccountId}/bindings |
| Grant a role binding to a service account | POST /scopes/{scopeId}/iam/service-accounts/{serviceAccountId}/bindings |
| Revoke a role binding from a service account | DELETE /scopes/{scopeId}/iam/service-accounts/{serviceAccountId}/bindings/{bindingId} |
| List SSO configurations for the tenant | GET /scopes/{scopeId}/iam/sso |
| Save the SSO configuration | PATCH /scopes/{scopeId}/iam/sso |
| Re-sync federation metadata from the IdP | POST /scopes/{scopeId}/iam/sso/actions/refresh |
| Test the SSO connection to the IdP | POST /scopes/{scopeId}/iam/sso/actions/test |
| The billing countries a subscription of this tenant may be set to | GET /tenants/{tenantId}/billing-countries |
| List every member of the tenant with an access summary | GET /tenants/{tenantId}/iam/users |
| Invite a member into the tenant with an access matrix | POST /tenants/{tenantId}/iam/users |
| A member's access matrix | GET /tenants/{tenantId}/iam/users/{userId}/access |
| Grant the member one access row | POST /tenants/{tenantId}/iam/users/{userId}/access |
| Replace the member's editable access rows | PUT /tenants/{tenantId}/iam/users/{userId}/access |
| Remove one access row | DELETE /tenants/{tenantId}/iam/users/{userId}/access/{assignmentId} |
| Dry run -- OpenStack credentials an access change would revoke | POST /tenants/{tenantId}/iam/users/{userId}/access/actions/preview-openstack-credential-impact |
| The tenant tree the caller may grant access on | GET /tenants/{tenantId}/iam/access-targets |
| Open a new subscription (with its default project) under the tenant | POST /tenants/{tenantId}/subscriptions |
| Rename a subscription and/or change its billing country | PATCH /tenants/{tenantId}/subscriptions/{subscriptionId} |
| Delete a subscription and every project beneath it | DELETE /tenants/{tenantId}/subscriptions/{subscriptionId} |
| Whether the caller may open projects under the subscription | GET /tenants/{tenantId}/subscriptions/{subscriptionId}/project-creation |
| The principals holding the project-creator grant on the subscription | GET /tenants/{tenantId}/subscriptions/{subscriptionId}/project-creators |
| Name a principal a project creator on the subscription | PUT /tenants/{tenantId}/subscriptions/{subscriptionId}/project-creators/{principalId} |
| Revoke a principal's project-creator grant on the subscription | DELETE /tenants/{tenantId}/subscriptions/{subscriptionId}/project-creators/{principalId} |
| Open a new project under the subscription | POST /tenants/{tenantId}/subscriptions/{subscriptionId}/projects |
| Rename a project | PATCH /tenants/{tenantId}/subscriptions/{subscriptionId}/projects/{projectId} |
| Delete a project | DELETE /tenants/{tenantId}/subscriptions/{subscriptionId}/projects/{projectId} |
| Move a project to another subscription of the same tenant | POST /tenants/{tenantId}/subscriptions/{subscriptionId}/projects/{projectId}/actions/move |
| List and query IAM users in the active scope | GET /scopes/{scopeId}/iam/users |
| Retrieve an IAM user's full detail record | GET /scopes/{scopeId}/iam/users/{userId} |
| Edit an IAM user's profile | PATCH /scopes/{scopeId}/iam/users/{userId} |
| Remove an IAM user from the organization | DELETE /scopes/{scopeId}/iam/users/{userId} |
| List an IAM user's live sessions | GET /scopes/{scopeId}/iam/users/{userId}/sessions |
| Disable an IAM user | POST /scopes/{scopeId}/iam/users/{userId}/actions/disable |
| Re-enable a disabled IAM user | POST /scopes/{scopeId}/iam/users/{userId}/actions/enable |
| Revoke a user's credential, session, or all sessions | POST /scopes/{scopeId}/iam/users/{userId}/actions/revoke |
| Send or resend an invitation to a user | POST /scopes/{scopeId}/iam/users/{userId}/invites |
| Send a password-reset link to a user | POST /scopes/{scopeId}/iam/users/{userId}/passwords/actions/reset |
| Dry run — OpenStack credentials a grant change would revoke | POST /scopes/{scopeId}/iam/users/{userId}/actions/preview-openstack-credential-impact |
| Add a governance tag to a user | POST /scopes/{scopeId}/iam/users/{userId}/tags |
Observability 17 operations
| Operation | Endpoint |
|---|---|
| List alert rules in the active project | GET /scopes/{scopeId}/observability/alert-rules |
| Create an alert rule | POST /scopes/{scopeId}/observability/alert-rules |
| Get an alert rule | GET /scopes/{scopeId}/observability/alert-rules/{alertRuleId} |
| Update an alert rule | PATCH /scopes/{scopeId}/observability/alert-rules/{alertRuleId} |
| Delete an alert rule | DELETE /scopes/{scopeId}/observability/alert-rules/{alertRuleId} |
| List an alert rule's state changes | GET /scopes/{scopeId}/observability/alert-rules/{alertRuleId}/events |
| List the notification channels of the project's budget alerts | GET /scopes/{scopeId}/observability/budget-notification-channels |
| Rotate the signing secret of a budget's webhook channel | POST /scopes/{scopeId}/observability/budget-notification-channels/{notificationChannelId}/actions/rotate-secret |
| Re-send the verification link of a budget's email channel | POST /scopes/{scopeId}/observability/budget-notification-channels/{notificationChannelId}/actions/resend-verification |
| List the alert rules derived from the project's budgets | GET /scopes/{scopeId}/observability/budget-alert-rules |
| List notification channels in the active project | GET /scopes/{scopeId}/observability/notification-channels |
| Create a notification channel | POST /scopes/{scopeId}/observability/notification-channels |
| Get a notification channel | GET /scopes/{scopeId}/observability/notification-channels/{notificationChannelId} |
| Delete a notification channel | DELETE /scopes/{scopeId}/observability/notification-channels/{notificationChannelId} |
| Rotate a webhook channel's signing secret | POST /scopes/{scopeId}/observability/notification-channels/{notificationChannelId}/actions/rotate-secret |
| Send a test notification through a channel | POST /scopes/{scopeId}/observability/notification-channels/{notificationChannelId}/actions/test |
| Resend the verification link of an email channel | POST /scopes/{scopeId}/observability/notification-channels/{notificationChannelId}/actions/resend-verification |
Billing & FinOps 53 operations
| Operation | Endpoint |
|---|---|
| List billing summary read models for the active scope | GET /scopes/{scopeId}/billing/summary |
| List budgets in the active scope | GET /scopes/{scopeId}/billing/budgets |
| Create a budget with thresholds and an alert channel | POST /scopes/{scopeId}/billing/budgets |
| Replace a budget definition | PUT /scopes/{scopeId}/billing/budgets/{budgetId} |
| Delete a budget definition | DELETE /scopes/{scopeId}/billing/budgets/{budgetId} |
| List the spend-threshold campaigns the active scope takes part in, with progress | GET /scopes/{scopeId}/billing/campaigns |
| List and query commitments in the active scope | GET /scopes/{scopeId}/billing/commitments |
| Create (configure) a new commitment purchase | POST /scopes/{scopeId}/billing/commitments |
| List the compute family classes a commitment can cover in this scope | GET /scopes/{scopeId}/billing/commitments/eligible-services |
| Preview (dry-run) a commitment purchase without creating it | POST /scopes/{scopeId}/billing/commitments/preview |
| Retrieve a commitment detail read model | GET /scopes/{scopeId}/billing/commitments/{commitmentId} |
| Purchase a configured or recommended commitment | POST /scopes/{scopeId}/billing/commitments/{commitmentId}/actions/purchase |
| Renew a commitment (queue a successor term) | POST /scopes/{scopeId}/billing/commitments/{commitmentId}/actions/renew |
| List the subscription's billing contracts (read-only history) | GET /scopes/{scopeId}/billing/contracts |
| List cost report datasets for Cost Explorer | GET /scopes/{scopeId}/billing/cost-reports |
| Export a cost report as CSV (legacy compat) | POST /scopes/{scopeId}/billing/cost-reports/{costReportId}/exports |
| Download the cost report as a CSV export | GET /scopes/{scopeId}/billing/cost-reports/{costReportId}/exports/download |
| List and query credit grants in the active scope | GET /scopes/{scopeId}/billing/credits |
| List credit consumption events in the active scope | GET /scopes/{scopeId}/billing/credits/events |
| Export the credit consumption history as CSV (legacy compat) | POST /scopes/{scopeId}/billing/credits/{creditId}/actions/exports |
| Download the credit grant's consumption history as CSV | GET /scopes/{scopeId}/billing/credits/{creditId}/exports/download |
| Redeem a coupon code into an active credit grant | POST /scopes/{scopeId}/billing/credits/actions/redeem |
| List the subscription's add-on / licence entitlements | GET /scopes/{scopeId}/billing/entitlements |
| Buy a subscription-scoped add-on / licence entitlement | POST /scopes/{scopeId}/billing/entitlements |
| Read one entitlement | GET /scopes/{scopeId}/billing/entitlements/{entitlementId} |
| Stop an entitlement renewing (no refund) | POST /scopes/{scopeId}/billing/entitlements/{entitlementId}/actions/cancel |
| Assign one seat of an entitlement to a resource | POST /scopes/{scopeId}/billing/entitlements/{entitlementId}/actions/assign |
| Release one seat of an entitlement back to the pool | POST /scopes/{scopeId}/billing/entitlements/{entitlementId}/actions/release |
| Move one seat of an entitlement between two resources, atomically | POST /scopes/{scopeId}/billing/entitlements/{entitlementId}/actions/transfer |
| List and query invoices in the active scope | GET /scopes/{scopeId}/billing/invoices |
| Retrieve the invoice detail read model | GET /scopes/{scopeId}/billing/invoices/{invoiceId} |
| Download the invoice document (PDF) | GET /scopes/{scopeId}/billing/invoices/{invoiceId}/download |
| Export invoice data as CSV (legacy compat) | POST /scopes/{scopeId}/billing/invoices/{invoiceId}/exports |
| Download the invoice's line items as CSV | GET /scopes/{scopeId}/billing/invoices/{invoiceId}/exports/download |
| Pay an open invoice | POST /scopes/{scopeId}/billing/invoices/{invoiceId}/actions/pay |
| Get the bank-transfer payment instructions for the active scope | GET /scopes/{scopeId}/billing/payment-instructions |
| List payment methods on file in the active scope | GET /scopes/{scopeId}/billing/payment-methods |
| Remove a payment card from the scope | DELETE /scopes/{scopeId}/billing/payment-methods/{paymentMethodId} |
| List and query resource quotas in the active scope | GET /scopes/{scopeId}/billing/quotas |
| List billable resource subscriptions with search, filter, sort and pagination | GET /scopes/{scopeId}/billing/subscriptions |
| Retrieve the account-level billing subscription detail read model | GET /scopes/{scopeId}/billing/subscriptions/{billingSubscriptionId} |
| Download an invoice PDF from the subscription's Invoices tab | GET /scopes/{scopeId}/billing/subscriptions/{billingSubscriptionId}/download |
| Pause the billing subscription (halt new provisioning) | POST /scopes/{scopeId}/billing/subscriptions/{billingSubscriptionId}/actions/pause |
| Resume a paused billing subscription | POST /scopes/{scopeId}/billing/subscriptions/{billingSubscriptionId}/actions/resume |
| List and query the transaction ledger | GET /scopes/{scopeId}/billing/transactions |
| Get one transaction with its receipt and timeline context | GET /scopes/{scopeId}/billing/transactions/{transactionId} |
| Cancel a pending wire transfer | POST /scopes/{scopeId}/billing/transactions/{transactionId}/actions/cancel |
| Declare a bank transfer against an outstanding ledger entry | POST /scopes/{scopeId}/billing/transactions/{transactionId}/actions/pay |
| Retry a failed payment (retired — always CONFLICT) | POST /scopes/{scopeId}/billing/transactions/{transactionId}/actions/retry |
| Export a transaction ledger entry as CSV (legacy compat) | POST /scopes/{scopeId}/billing/transactions/{transactionId}/exports |
| Download the transaction ledger entry as CSV | GET /scopes/{scopeId}/billing/transactions/{transactionId}/exports/download |
| Download the transaction receipt PDF | GET /scopes/{scopeId}/billing/transactions/{transactionId}/receipts/download |
| Upload a wire-transfer receipt for manual approval | POST /scopes/{scopeId}/billing/transactions/{transactionId}/receipts/uploads |
Activity & Audit 2 operations
| Operation | Endpoint |
|---|---|
| List Activity Events over a real time range, with server-computed totals and histogram | GET /scopes/{scopeId}/activity/activity-events |
| Download the scope's 2-year audit trail as CSV or JSON | GET /scopes/{scopeId}/activity/audit-export |
Key & Certificate Management 4 operations
| Operation | Endpoint |
|---|---|
| List and query TLS certificates in the active scope | GET /scopes/{scopeId}/keys/certificates |
| Create (generate or import) a certificate | POST /scopes/{scopeId}/keys/certificates |
| Retrieve certificate detail | GET /scopes/{scopeId}/keys/certificates/{certificateId} |
| Delete a certificate | DELETE /scopes/{scopeId}/keys/certificates/{certificateId} |
Assistant 17 operations
| Operation | Endpoint |
|---|---|
| Start a console AI assistant conversation | POST /scopes/{scopeId}/assistant/conversations |
| Send a message to the console AI assistant | POST /scopes/{scopeId}/assistant/conversations/{conversationId}/messages |
| Confirm an assistant proposal (create the proposed instance) | POST /scopes/{scopeId}/assistant/proposals/{proposalId}/actions/confirm |
| Cancel an assistant proposal | POST /scopes/{scopeId}/assistant/proposals/{proposalId}/actions/cancel |
| List the resource kinds the caller can read (Cloud Shell) | GET /scopes/{scopeId}/assistant/resource-kinds |
| List instances through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/instance |
| Show one instance through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/instance/{resourceId} |
| List volumes through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/volume |
| Show one volume through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/volume/{resourceId} |
| List networks through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/network |
| Show one network through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/network/{resourceId} |
| List security groups through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/sg |
| Show one sg through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/sg/{resourceId} |
| List floating IPs through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/fip |
| Show one fip through the read-only resource layer | GET /scopes/{scopeId}/assistant/resources/fip/{resourceId} |
| Ask the documentation assistant (public, no session) | POST /public/docs-assistant/ask |
| The project's console AI assistant token usage and availability | GET /scopes/{scopeId}/assistant/usage |
Account Settings 2 operations
| Operation | Endpoint |
|---|---|
| Read the tenant's billing identity | GET /scopes/{scopeId}/settings/company |
| Update the tenant's billing identity | PATCH /scopes/{scopeId}/settings/company |
Console 9 operations
| Operation | Endpoint |
|---|---|
| List the signed-in user's in-app notifications | GET /notifications |
| Mark one notification read or unread | PATCH /notifications/{notificationId} |
| Mark all notifications read | POST /notifications/read-all |
| List the activated regions | GET /regions |
| Which product modules are available in a region | GET /regions/{region}/capabilities |
| The published images of a region (the image picker source) | GET /regions/{region}/images |
| Which block-storage tiers a region offers, and what each costs | GET /regions/{region}/volume-types |
| Which load-balancer sizes a region offers | GET /regions/{region}/load-balancer-sizes |
| The published, priced products of a region (the pricing preview) | GET /regions/{region}/products |
Platform 5 operations
| Operation | Endpoint |
|---|---|
| Resolve the current session to a user, the tenant catalog and a default scope | GET /account/whoami |
| List the caller's recent operations | GET /operations |
| Poll a long-running operation | GET /operations/{operationId} |
| Request cancellation of a long-running operation | POST /operations/{operationId}/actions/cancel |
| Server-Sent Events stream of realtime resource updates | GET /events |