API reference

Depot is the server an organisation runs, and its REST API is the one an operator, a script or an agent calls. Everything a console does, it does through these routes.

This section is generated. On every build the site reads the OpenAPI document Depot serves at /openapi/v1.json, which Depot builds from its own route table. What is documented is therefore what is mounted, and a route that is renamed in the product is renamed here on the next release.

What is here

Reference	What it covers
Depot REST API	Endpoints, alerts, scripts, profiles, tickets, documents, projects and billing
Agent gRPC API	The contract between an Agent and its Depot
Authentication	How to get a credential for each of them

The Agent does not use the REST API. It talks to its Depot over gRPC with mutual TLS, and that contract is generated from the protocol buffers.

Reading an operation

Every operation carries a row of badges. They come from the route table, not from a person’s judgement about what the route is for.

Badge	What it means
A permission such as alert:ack	The caller needs this permission. No badge and no public marker means the route is behind a session alone
A face such as tenant face	Which interface the route is mounted on: tenant, MSP, shared or public
A mode such as msp	Which licensed modes have this route. A Depot in a mode that is not listed does not serve it
Idempotent	Sending the same request twice has the same effect as sending it once
WebSocket or Server sent events	The response is a stream. The sample shows the handshake
Token in the path	The URL itself is the credential. Treat the whole URL as a secret
Not fully resolved	Part of the route could not be read from the source. The operation says which part

An MSP console reaches one client’s data by prefixing the path. Where that applies, the operation says so under its badges.

Stability

The reference tracks the released version of Depot, which is named on the service overview page. There is no API version negotiation beyond the /api/v1/ prefix in the paths.

Anchors are stable. Every operation heading has an id equal to its operation id, such as depot.alerts.acknowledge, so a deep link keeps working when the heading is reworded.

Machine readable

Everything here is also available in a form a program can read:

• The OpenAPI document itself, served by a running Depot at /openapi/v1.json.
• A plain Markdown twin of every page on this site, at the page URL plus index.md.
• The page manifest at /api/pages.json.

To do

This page is an outline. It still needs:

• A worked first request, end to end.
• Rate limit and pagination conventions in one place, rather than per operation.
• The error catalogue: which problem types a caller should handle.
• A short note on which routes an AI agent should never call unattended.