Skip to content

System

API

Probe the auth host read-only — the admin token never leaves the server.

Svenska

Local mode: no sign-in on this machine. Never expose it beyond localhost.

API explorer

Live GET

Velvet Guard calls the wired auth host server-side. Only allowlisted GET paths are accepted.

Endpoint map

PathVerbsWhat it doesActions
/healthGETServer health + device countProbe
/fleetGETAll devices: posture, liveness, complianceProbe
/devicesGET DELETEList / revoke devices (admin)Probe
/rolesGET PUTRoles per subjectProbe
/roles/jitGET POSTJIT elevations: list / grant—
/permissionsGET PUTFine-grained permission tableProbe
/permissions/checkGETWould this (role, origin, op) pass?—
/grantsGET PUTOrigin allowlists per subjectProbe
/tenantsGET PUTTenant directoryProbe
/tenants/{t}/membersGETMembers of a tenant—
/appsGET PUT DELETEApp registry (origins)Probe
/auditGETHash-chained audit tailProbe
/audit/searchGETFull-text audit search—
/audit/verifyGETVerify the chain—
/export/devices.csvGETCSV export of devicesProbe
/export/audit.csvGETCSV export of auditProbe
/webhooksGET PUT DELETEEvent webhooksProbe
/ssh/caGETSSH CA public keyProbe
/trustedGETConditional-access answerProbe
/pendingGETPending challengesProbe
/pending/{id}GETOne challenge—
/push/vapidGETWebPush public keyProbe
/stepupGETStep-up authorization pageProbe
/metricsGETPrometheus metricsProbe