Skip to main content
Everything the zwrm CLI and the dashboard do goes through the REST API under /v1. This reference maps the full endpoint surface; the guides explain the concepts behind each resource.

​
Base URL

For ZWRM cloud this is your platform URL.

​
Authentication

All endpoints (except GET /v1/health and trigger ingest) require authentication with an API token:
  • Authorization: Bearer <token> — the standard form. The X-API-Key: <token> header is accepted as an alternative.
  • Get a token with zwrm auth token, or mint one via POST /v1/auth/tokens.

​
Organization scoping

Every resource is scoped to an organization. Requests run against your default org; pass X-Org-ID: <org-id> to target another org you’re a member of.

​
Rate limits

Requests are rate-limited per token. Expensive operations (deploys, run dispatch, session creation, sandbox creation, backups) have stricter limits than plain reads.

​
Errors

Errors return JSON with a message:
The OpenAI-compatible endpoints are the exception — they render errors in the OpenAI wire shape.

​
Streaming conventions

​
Health

​
Sections

Apps & machines

Apps, deploys, machines, routes, logs, metrics.

Secrets

App-scoped and org-wide secrets.

Volumes

Volumes, snapshots, restore.

PostgreSQL

Databases, backups, restores, app links.

Sandboxes

Ephemeral and persistent microVM sandboxes.

Agents

Agent config, workspaces, channels, connectors.

Runs & sessions

Autonomous runs, live sessions, the event timeline, the inbox.

Skills & MCP

Skill library, MCP gateway management and data plane.

Automations

Inbound triggers, schedules, outbound webhooks.

Platform & org

Auth, orgs, domains, audit logs, templates, hosts.