Base: the Console host (console.<domain>). Auth is a Better Auth session cookie or bearer token; see Console overview.
Responses use { success, data } / { success, message }. Guards are cumulative: requireSession runs on everything below except the auth routes and login.
Authentication
| Method | Path | Guard | Purpose |
|---|---|---|---|
ALL | /api/auth/* | rate-limited, enforcePasswordRotation | Better Auth (sign-in, sign-out, 2FA verify, session) |
POST | /api/platform/login | rate-limited | Login adapter: relays Better Auth cookies, reports twoFactor and mustChangePassword |
Platform
Source: apps/server/console/routes/platform.routes.ts.
| Method | Path | Guard | Purpose |
|---|---|---|---|
GET | /api/platform/me | session | Current identity, role, capabilities, projects |
GET | /api/platform/info | session | Platform info (mode, domain suffix, features) |
GET | /api/platform/version | session | Running version |
GET | /api/platform/audit | audit.read | Audit events |
GET | /api/platform/logs | role owner/admin | Console log buffer |
GET | /api/platform/dns | role owner/admin | Console + wildcard DNS diagnostics |
GET | /api/platform/update/plan | role owner/admin | Available update and its plan |
GET | /api/platform/metrics | session | Per-project resource usage |
GET | /api/platform/settings | role owner | Console settings |
PUT | /api/platform/settings | role owner | Update Console settings |
GET | /api/platform/project-defaults | role owner | Defaults for new projects |
PUT | /api/platform/project-defaults | role owner | Update those defaults |
GET | /api/platform/proxy-metrics | session | Per-project proxy request counts |
POST | /api/platform/account/password | session | Change own password (allowed while mustChangePassword) |
Projects
| Method | Path | Guard | Purpose |
|---|---|---|---|
GET | /api/platform/projects | session (scoped) | List projects visible to the caller |
POST | /api/platform/projects | project.create | Create; 409 when the name exists |
DELETE | /api/platform/projects/:id | project.delete | Destroy the stack and its directory |
POST | /api/platform/projects/:id/start | runtime.manage | |
POST | /api/platform/projects/:id/stop | runtime.manage | |
POST | /api/platform/projects/:id/restart | runtime.manage | |
POST | /api/platform/projects/:id/update | runtime.manage | pull + up |
POST | /api/platform/projects/:id/rebuild | runtime.manage | |
GET | /api/platform/projects/:id/ready | project.read | Whether the stack answers its health probe yet |
GET | /api/platform/projects/:id/logs | project.read | Compose logs |
GET | /api/platform/projects/:id/dns | project.read | Domain + storage DNS and TCP checks |
GET | /api/platform/projects/:id/shell | runtime.manage | The docker compose exec command to run |
GET | /api/platform/projects/:id/config | project.read | Domains, CORS, image, cert resolver |
PATCH | /api/platform/projects/:id/config | settings.write | Patch the above |
GET | /api/platform/projects/:id/limits | project.read | CPU/memory quotas |
PATCH | /api/platform/projects/:id/limits | settings.write | Patch the quotas |
Unknown project ids return 404 project not found.
Users
Source: console/routes/users.routes.ts. Managing users requires the users.manage capability — owner only.
| Method | Path | Purpose |
|---|---|---|
GET | /api/platform/users | List operators |
POST | /api/platform/users | Create one |
PATCH | /api/platform/users/:id | Update role, projects, disabled, password |
DELETE | /api/platform/users/:id/sessions | Revoke all sessions |
DELETE | /api/platform/users/:id | Delete |
Organizations
Source: console/routes/orgs.routes.ts. Routes on a specific org require membership (requireOrgMember).
| Method | Path | Purpose |
|---|---|---|
GET | /api/platform/orgs | Orgs the caller belongs to, with role and project count |
POST | /api/platform/orgs | Create an org |
GET | /api/platform/orgs/:id | Read one |
PATCH | /api/platform/orgs/:id | Rename |
DELETE | /api/platform/orgs/:id | Delete |
GET | /api/platform/orgs/:id/members | List members |
POST | /api/platform/orgs/:id/members | Add a member |
DELETE | /api/platform/orgs/:id/members/:userId | Remove a member |
Project proxy
Source: console/routes/proxy.routes.ts. See Project proxy for capability mapping and upstream behaviour.
| Method | Path | Forwards to |
|---|---|---|
ALL | /api/projects/:id/admin/* | /api/admin/* |
ALL | /api/projects/:id/rest/* | /rest/* |
ALL | /api/projects/:id/edge/* | /api/edge/* |
Orchestration daemon
Not reachable from the browser — it is an internal service with its own bearer secret. See Orchestration daemon.