Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Get the machine image detail read model
Returns the full detail read model for one machine image in the active scope, backing the
the image detail page tabs: core properties (OS, architecture, size, visibility, encryption/KMS
key, boot mode, min disk/RAM launch hints, source provenance), the account shares table,
the published version history, the "Used by" instances launched from this image, the
activity log (create/encrypt/share/copy/version events) and the governance tags panel.
Validation: scopeId must be an accessible scope (else 403 FORBIDDEN) and imageId
must reference an image that exists in that scope and is not soft-deleted — otherwise
404 NOT_FOUND. No request body is accepted.
Async & state: Synchronous read; no state change. The response carries the image's
current status (AVAILABLE/PENDING/DEPRECATED/ERROR); subsequent transitions are pushed
as resource.updated SSE frames patching status/updatedAt, so the detail view can
refresh without polling.
Errors: 401 unauthenticated; 403 caller lacks reader access to the scope; 404 unknown
or deleted imageId; 500 read-model failure.
Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The response
carries an ETag that clients echo via If-Match on subsequent mutations (tags update,
revoke) for optimistic concurrency.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
imageId*stringIdentifier of the machine image (e.g. img_golden_web).
Machine image detail read model including shares, versions, used-by, activity and tags.
application/json- response
Detail read model for one image — the core resource plus the derived panels (used-by, activity, tags) rendered by the image detail page.
id*stringImage identifier (e.g. img_golden_web).
name*stringUnique DNS-friendly image name (e.g. golden-web-prod).
description*stringos*ImageOs"ubuntu""debian""rhel""rocky""alma""windows""linux"osName*stringHuman-readable OS name (e.g. Red Hat Enterprise Linux).
osVersion*stringOS version label (e.g. 22.04 LTS).
visibility*MachineImageVisibility"Public""Private"sizeGb*numberarch*ImageArch"x86_64""arm64"source*Provenance of a machine image (what it was built from).
status*ImageStatusLifecycle status of a machine image. DELETING is the transitional state a
tenant-owned captured image enters once its asynchronous delete is accepted;
the row disappears from the catalog when the delete Operation succeeds, and
returns to its prior status if the delete fails.
"AVAILABLE""PENDING""DEPRECATED""DELETING""ERROR"statusReason*|Human-readable, customer-facing reason the last lifecycle command on this resource failed (e.g. "The request could not be completed after repeated attempts. Try again, or contact support if it persists."); never raw provider text. Null while healthy, once a later settle clears it, or when the failure carried no detail. Mirrors Instance.statusReason.
encrypted*booleanWhether the image is encrypted at rest, DERIVED from the provider's own view of the image — never from the create request. The image service (Glance) performs no encryption of its own; an image is genuinely ciphertext only when it was uploaded from an encrypted block volume, which stamps the encryption key id onto the image. False until the provider confirms that, so this field never asserts a security property the platform did not actually deliver.
kmsKeyId*|The key the image payload is actually encrypted under, as reported by the provider; null when the image is unencrypted (which is every image on a region that does not offer the image-encryption availability domain).
minDiskGb*numberMinimum root disk size hint for launch.
minRamMb*numberMinimum RAM hint for launch.
bootMode*MachineImageBootMode"UEFI""BIOS"createdAt*stringdate-timeupdatedAt*stringdate-timeshares*array<>Accounts this private image is shared with (Public images have an empty list).
versions*array<>usedBy*array<>Instances launched from this image.
activity*array<>Activity log, newest first.
tags*array<>Governance key/value tags.
curl -X GET "https://example.com/scopes/string/compute/images/string"{ "id": "string", "name": "string", "description": "string", "os": "ubuntu", "osName": "string", "osVersion": "string", "visibility": "Public", "sizeGb": 0, "arch": "x86_64", "source": { "kind": "instance", "ref": "string" }, "status": "AVAILABLE", "statusReason": "string", "encrypted": true, "kmsKeyId": "string", "minDiskGb": 0, "minRamMb": 0, "bootMode": "UEFI", "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z", "shares": [ { "accountId": "string", "accountName": "string", "sharedAt": "2019-08-24T14:15:22Z" } ], "versions": [ { "version": "string", "createdAt": "2019-08-24T14:15:22Z", "sizeGb": 0, "isLatest": true, "note": "string" } ], "usedBy": [ { "id": "string", "name": "string", "status": "ACTIVE", "flavor": "string", "launchedAt": "2019-08-24T14:15:22Z" } ], "activity": [ { "id": "string", "event": "string", "detail": "string", "actor": "string", "at": "2019-08-24T14:15:22Z" } ], "tags": [ { "key": "string", "value": "string" } ]}