Skip to main content
OpenCluster serves JSON over a versioned HTTP API. Every customer-owned route includes the Organization in its path and requires a Principal with membership and the stated role permission.

​
Authentication

Use the deployment’s browser session or an approved bearer credential:
Responses containing Organization data use Cache-Control: no-store. Unknown records and records belonging to another Organization both return 404.

​
Core resources

Listings return items, an opaque next cursor, and any documented partial fields. Pass the returned cursor unchanged.

​
Investigation result

GET /api/v1/organizations/{organization}/investigations/{investigation} returns the lifecycle status, conclusion status, summary, impact, cited findings, final hypotheses, action proposals, limitations, spend, and humanConfirmationRequired. Use these related endpoints:

​
Postmortems

Postmortem routes are under a resolved Incident: The full prefix is /api/v1/organizations/{organization}/incidents/{incident}. Generation accepts optional explicit impact, resolution, and retrospective notes. Missing human facts remain Needs human input.

​
Webhooks

Inbound integrations use /webhooks/v1, not the operator API. Alertmanager sends a bounded signed request to its Integration-specific URL. Treat webhook secrets as write-only credentials; OpenCluster shows a newly minted secret once. See Prometheus Alertmanager for the supported payload and delivery responses.