Skip to main content

​
Qumo Deploy REST API

The Qumo Deploy REST API provides programmatic control over edge relay discovery, organizations and projects, signing keys, machine identities, and billing.

​
Base URL

https://api.qumo-deploy.com. It takes Bearer tokens only: it ignores cookies, so a console browser session does not authenticate there, and it serves no web pages or sign-in flows.

​
Authentication

Every operation in the reference lists the credentials it accepts:
  • Tokens (Authorization: Bearer qumo_pat_...): personal access tokens (POST /v1/auth/tokens) and machine identity tokens (POST /v1/projects/{project_id}/identities/{identity_id}/tokens). A token’s scopes cap what it can do; see Scopes and permissions.
  • CLI session (Authorization: Bearer <session token>): what qumod login obtains through the device flow. It acts as the signed-in user.
  • Console session: the browser cookie on console.qumo-deploy.com, with an X-CSRF-Token header on requests that change state. Not accepted on the API host.
A personal token names no organization: on routes that do not name a project or organization in the path, such as GET /v1/projects, add ?organization_id=<organization id>. Per-user account routes, such as GET /v1/auth/session, take a session and refuse tokens.
Errors are JSON objects with one error field; what each status code means is in Error codes.

​
Relay credentials

Relay credentials are not issued by the API: your app signs them with its own signing keys.

​
What the reference covers

The reference covers every route a customer can call. CI fails when a route is added without an operation in openapi.yaml, or the spec names a route that does not exist. Left out on purpose: the routes the managed relays call over their private network, the Stripe webhook, health probes and metrics, browser sign-in redirects, the website’s contact form and demo, and operator-only routes. The TypeScript SDK wraps the same routes.