REST API reference

Biztraak exposes REST controllers for common project, infrastructure, marketplace, team, Git, forum, database, and VM workflows. REST routes are versioned by route family rather than by one universal /v1/ prefix.

Base URL and authentication

Replace <api-host> with the API host for your environment:

https://<api-host>/api/...

Send the same bearer token used by GraphQL:

Authorization: Bearer <your-token>

All documented application controllers require authentication. Authorization is still evaluated for the team, project, component, or provider targeted by each request.

Route families

The following route families are implemented in the main web API:

Area	Route family	Examples
Projects and components	`/api/projects/v1`	Projects, components, environment variables, component access grants, hosted workload deployment
Teams and access	`/api/teams/v1`	Team roles, service-provider credentials, billing accounts, container registries
Marketplace	`/api/marketplace/v1`	Store items, components, payment plans
Git and Terraform	`/api/devops/v1`	Git repositories, branches, files, Terraform deployment operations
Virtual machines	`/api/virtual-machines`	Start, stop, status, shutdown timers, logs, and sessions
VM agent	`/api/virtual-machine-agent`	Agent registration and command lifecycle callbacks
Forum	`/api/forum/v1`	Threads, replies, comments, votes, and moderation
Client database	`/api/client-db/v1`	Connection metadata, schema inspection, and supported database operations
Compliance management	`/api/compliance` and `/api/compliance/v1`	Framework, framework-version, and control management

The route families above summarize the supported API surface. Use Swagger/OpenAPI for the generated request and response contract exposed by the main web application.

Example: list projects

curl "https://<api-host>/api/projects/v1/projects" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"

The endpoint returns 200 OK with a JSON collection of project payloads. When no projects exist, the collection is empty. Malformed request bodies return 400 Bad Request.

Example: get a project by ID

curl "https://<api-host>/api/projects/v1/projects/<project-id>" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"

If the project does not exist or is not visible in the caller’s authorized context, this request returns 404 Not Found.

Example: create a project

curl -X POST "https://<api-host>/api/projects/v1/projects" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "teamId": "<team-id>",
    "teamBillingAccountId": "<billing-account-id>",
    "storeItemPaymentPlanId": null,
    "name": "Example project",
    "description": "Created through the REST API",
    "category": "Application",
    "helpPage": "",
    "serviceProviders": []
  }'

Project creation is subject to the team’s authorization, billing, provider, and feature requirements. Treat identifiers in this example as placeholders and use IDs from the authenticated team.

Async operations

Several REST operations enqueue work instead of completing infrastructure changes during the HTTP request. For example, VM-hosted workload deployment returns an accepted result while the deployment proceeds through the platform workflow. Store the returned identifier, then monitor the associated deployment or workflow through the documented GraphQL queries/subscriptions or the relevant UI.

Do not assume that a 2xx response means that infrastructure is ready. Check the returned state and follow-up events before allowing dependent automation to continue.

For GraphQL, see GraphQL. For response and error handling, see API errors. For retry, asynchronous-operation, and compatibility guidance, see API operations.