---
title: "API reference"
description: "The Depot REST API and the Agent gRPC contract, generated from the route tables themselves rather than written by hand."
url: "https://support.outpostplatform.com/api/"
product: "platform"
type: "reference"
status: "stub"
ai_summary: "Entry point for the Outpost API reference. Covers the Depot REST API and the Agent to Depot gRPC contract. Explains that the reference is generated from the Depot route table, what the badges on each operation mean, and where authentication is documented."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/api/index.md"
license: "CC BY 4.0"
---

# API reference

Depot is the server an organisation runs, and its REST API is the one an
operator, a script or an agent calls. Everything a console does, it does
through these routes.

This section is generated. On every build the site reads the OpenAPI document
Depot serves at `/openapi/v1.json`, which Depot builds from its own route
table. What is documented is therefore what is mounted, and a route that is
renamed in the product is renamed here on the next release.

## What is here

| Reference | What it covers |
| --- | --- |
| [Depot REST API](/api/generated/depot/) | Endpoints, alerts, scripts, profiles, tickets, documents, projects and billing |
| [Agent gRPC API](/api/generated/grpc/) | The contract between an Agent and its Depot |
| [Authentication](/api/authentication/) | How to get a credential for each of them |

The Agent does not use the REST API. It talks to its Depot over gRPC with
mutual TLS, and that contract is generated from the protocol buffers.

## Reading an operation

Every operation carries a row of badges. They come from the route table, not
from a person's judgement about what the route is for.

| Badge | What it means |
| --- | --- |
| A permission such as `alert:ack` | The caller needs this permission. No badge and no public marker means the route is behind a session alone |
| A face such as `tenant face` | Which interface the route is mounted on: tenant, MSP, shared or public |
| A mode such as `msp` | Which licensed modes have this route. A Depot in a mode that is not listed does not serve it |
| `Idempotent` | Sending the same request twice has the same effect as sending it once |
| `WebSocket` or `Server sent events` | The response is a stream. The sample shows the handshake |
| `Token in the path` | The URL itself is the credential. Treat the whole URL as a secret |
| `Not fully resolved` | Part of the route could not be read from the source. The operation says which part |

An MSP console reaches one client's data by prefixing the path. Where that
applies, the operation says so under its badges.

## Stability

The reference tracks the released version of Depot, which is named on the
service overview page. There is no API version negotiation beyond the
`/api/v1/` prefix in the paths.

Anchors are stable. Every operation heading has an id equal to its operation
id, such as `depot.alerts.acknowledge`, so a deep link keeps working when the
heading is reworded.

## Machine readable

Everything here is also available in a form a program can read:

- The OpenAPI document itself, served by a running Depot at
  `/openapi/v1.json`.
- A plain Markdown twin of every page on this site, at the page URL plus
  `index.md`.
- The page manifest at `/api/pages.json`.

## To do

This page is an outline. It still needs:

- A worked first request, end to end.
- Rate limit and pagination conventions in one place, rather than per
  operation.
- The error catalogue: which problem types a caller should handle.
- A short note on which routes an AI agent should never call unattended.