REST API
Everything the console does, with the one route that does not exist.
The API lives at https://api.sallyport.cloud/v1 and takes a console session or a key you create in settings.
The shape
| Resource | What it holds |
|---|---|
| /agents | Identities, tokens, bindings, limits, pause |
| /credentials | Names, versions, rotation, where each one is used |
| /bindings | Hosts, methods, classes, mode, approvers, pins |
| /approvals | The inbox, the decisions, the transfers |
| /grants | Time-boxed permissions and their revocation |
| /calls/{id} | One call, its decision, its result |
| /audit/export | A segment of your journal as a file |
| /audit/checkpoint | The signed Merkle root over your chain |
The route that does not exist
There is no endpoint that returns a credential value. A test walks every serializer and the generated OpenAPI document. It fails the build if a sealed field, a wrapped key, a token hash or a private value appears in any response.
Webhooks
Approval requested, decided, expired. Access request created and provisioned. Call result. Credential rotated. Catalogue drift. Grant expiring, an hour before it does. Signed with a shared secret, retried with backoff for an hour, and sent through the same egress guard as everything else.