Cloud API

The cloud holds what is shared between installations and apps: accounts, organisations, the venue and installation registry. It never controls a dome. Apps reach a dome through the SDK on the local network.

The operations are listed in the cloud reference.

Surfaces

Surface	Path
REST	/api/v1/*
GraphQL	/api/graphql
socket.io	/api/socket.io/, namespace /v1
JWKS	/api/v1/.well-known/jwks.json

Sign in

curl -X POST "$BASE/api/v1/auth/sign-in" \
  -H 'content-type: application/json' \
  -d '{"email":"[email protected]","password":"…","client":"native"}'

The answer holds accessToken (a 15 minute JWT) and, for native clients, a rotating refreshToken. Web clients get the refresh token as an httpOnly cookie. Reusing a rotated refresh token revokes the whole token family.

Errors

Errors are RFC 9457 application/problem+json, and code is the stable key. The codes are in Ids and errors.

Delete an account

DELETE /api/v1/me starts a 7-day grace period, then personal data is deleted. POST /api/v1/me/deletion/cancel stops it. The call answers 409 while the account owns an organisation. People without an app can use the web page.

State

The server ran internally in containers: its smoke checks and generated contract tests pass there. Whether the public address answers depends on the deployment.