Base URL
Authentication
Every request takes a bearer token in theAuthorization header. Two token types are accepted:
Generate API keys from the API Keys page in the dashboard. The full key value is shown exactly once at creation, store it in a secret manager immediately.
Organization context
Every billable resource (runs, VMs, deployments, balance, history) belongs to an organization. The server resolves the org for each request in this order:- API key org, Keys created under
/orgs/{slug}/api-keyscarry the org. No header needed. X-Org-Slugheader, On JWT requests, pin the org by slug. The server verifies your membership.- Default org, If neither is present, the request falls back to the membership flagged as your default (auto-created at signup).
Login (JWT flow)
access_token and refresh_token. Pass the access token as Authorization: Bearer <access_token>. When it expires, call POST /auth/refresh with the refresh token to get a new pair.
Validation errors
Endpoints return HTTP422 with a structured HTTPValidationError body when the request payload is malformed or missing required fields. Other failures return standard HTTP status codes (400, 401, 403, 404, 5xx) with a detail field describing the error.
Endpoint groups
The full endpoint list is in the sidebar under Endpoints, grouped by tag. Highlights:
For end-to-end worked examples, submit a run, poll status, fetch logs and metrics, see End-to-End API Workflow.

