API Authentication

The public API is a tRPC endpoint at /api/v1/trpc authenticated with a zs_ token. The in-dashboard API Documentation page (API Documentation → the generated reference) is the full, always-current procedure list — this page covers the shape of the API so scripts and integrations can be written against it.

Authentication#

Every request sends the token in an Authorization header:

curl https://paas.example.com/api/v1/trpc \
  -H "Authorization: Bearer zs_..."

Tokens are issued per user under Settings → Security, bind to the owner's organization permissions, and can expire — see API Tokens and SSH Keys.

Payload syntax#

Requests carry a json parameter — encoded JSON for mutations, plain JSON for queries:

# Mutation (POST) — the procedure is named in the path
curl -X POST "https://paas.example.com/api/v1/trpc/service.deploy?json=%7B%22id%22%3A%22svc_123%22%7D" \
  -H "Authorization: Bearer zs_..."

# Query (GET)
curl "https://paas.example.com/api/v1/trpc/service.list?json=%7B%7D" \
  -H "Authorization: Bearer zs_..."

Procedures mirror the CLI and MCP tool namespaces: service.*, project.*, env.*, org.*, node.*, backup.*, network.*, system.*, with the same permissions applied server-side.

Compose env expansion#

The API honors compose variable expansion exactly like the dashboard and the CLI — ${ZENSAILOR_DATA_PATH} and friends resolve to the service's resolved values before the API consumes a compose payload.

OpenAPI#

An OpenAPI 3.0 JSON document describes the endpoint surface at /api/v1/openapi.json on your instance, so clients can generate typed bindings against it.