All Endpoints
Every public endpoint of the Nautilus platform on one page. All of them are served from a single host:
https://api.vernesoft.com
Use this page as a map: each row links to the reference section that documents the request body, the response schema, and the SDK equivalents. If you are integrating for the first time, start with Installation instead — the SDKs cover most of this surface without hand-written HTTP calls.
Authentication at a Glance
Every engine has its own API key prefix, and a key is only ever accepted by its own engine — a vrn_relay_ key on a Clockwork route is rejected with 403 Forbidden. Keys are created on the Dashboard → Keys page and are scoped to a single tenant, so the tenant is always derived from the key rather than from the request.
| Surface | Auth | Header |
|---|---|---|
/v1/relay/* | Relay API key | Authorization: Bearer vrn_relay_... |
/v1/gate/* | Gate API key | Authorization: Bearer vrn_gate_... |
/v1/clockwork/* | Clockwork API key | Authorization: Bearer vrn_clockwork_... |
/v1/passepartout/* | Passepartout API key | Authorization: Bearer vrn_passepartout_... |
/auth/* | none — end-user self-service flows | — |
/public/* | none | — |
Server-side only. API keys carry full engine access. Never ship one to a browser, a mobile app, or a WASM bundle.
Some Gate endpoints additionally require an end-user credential alongside the API key — the Kratos session token in an X-Session-Token header. Those rows are marked below.
Relay — Webhooks
Full reference: Relay API Reference.
| Method | Endpoint | Description |
|---|---|---|
POST | /v1/relay/messages | Publish an event to every endpoint subscribed to its event_type |
GET | /v1/relay/messages | List events sent by your application, newest first |
GET | /v1/relay/messages/{msg_id} | Fetch a single event and its delivery state |
Subscriber endpoints — the URLs Relay delivers to — are managed in the Console under Dashboard → Relay, or through the App Portal link it offers, rather than through the API key surface.
Gate Identity — Auth
Full reference: Gate API Reference.
Identity Management
| Method | Endpoint | Description |
|---|---|---|
POST | /v1/gate/identities | Create an end-user identity |
GET | /v1/gate/identities/{id} | Fetch one identity |
PATCH | /v1/gate/identities/{id} | Update an identity's traits |
DELETE | /v1/gate/identities/{id} | Delete an identity permanently |
PATCH | /v1/gate/identities/{id}/state | Activate or deactivate an identity |
POST | /v1/gate/identities/{id}/resend-verification | Re-send the email verification message |
GET | /v1/gate/identities/{id}/metadata | Read your custom metadata for an identity |
PATCH | /v1/gate/identities/{id}/metadata | Merge custom metadata into an identity |
Listing all identities is a Console operation, not an API-key one — the key surface addresses identities by id.
Sessions
Full reference: Session Management.
| Method | Endpoint | Description |
|---|---|---|
GET | /v1/gate/identities/{id}/sessions | List an identity's active sessions |
DELETE | /v1/gate/identities/{id}/sessions | Revoke every session of one identity |
DELETE | /v1/gate/sessions/{session_id} | Revoke a single session |
Auth Flows
Self-service flows for your end-users. Each returns a Kratos flow object whose UI nodes your frontend renders. See Settings Flow for the full lifecycle.
| Method | Endpoint | Description |
|---|---|---|
GET | /v1/gate/auth/login | Start a login flow (honours X-Return-To) |
GET | /v1/gate/auth/registration | Start a registration flow (honours X-Return-To) |
GET | /v1/gate/auth/recovery | Start an account recovery flow |
POST | /v1/gate/auth/recovery/submit | Submit a recovery code |
GET | /v1/gate/auth/verification | Start an email verification flow |
POST | /v1/gate/auth/verification/submit | Submit a verification code |
GET | /v1/gate/auth/settings | Start a settings flow — requires X-Session-Token |
POST | /v1/gate/auth/settings/submit | Submit a settings change — requires X-Session-Token |
Login and registration are completed against the flow's own ui.action URL, which points back at the Kratos public routes under /auth/*. The successful response carries session.token — that is the X-Session-Token value for the flows above. Social login and TOTP MFA both run through these same two flows.
Tenant Settings
| Method | Endpoint | Description |
|---|---|---|
GET | /v1/gate/settings/oidc-providers | Read the social login providers enabled for your tenant |
PUT | /v1/gate/settings/oidc-providers | Replace the enabled provider list |
GET | /v1/gate/settings/security | Read passwordless_enabled and mfa_enabled |
PUT | /v1/gate/settings/security | Update those security flags |
GET | /v1/gate/settings/webhooks | List your Gate webhooks |
POST | /v1/gate/settings/webhooks | Register a webhook |
PATCH | /v1/gate/settings/webhooks/{id} | Update a webhook |
DELETE | /v1/gate/settings/webhooks/{id} | Delete a webhook |
Tokens & Authorization
Full reference: Access Control.
| Method | Endpoint | Description |
|---|---|---|
POST | /v1/gate/tokens | Mint a scoped access token for an identity |
POST | /v1/gate/tokens/introspect | Validate a token and read its claims |
POST | /v1/gate/authorize | Ask whether a subject may perform an action on a resource |
Clockwork — Cron
Full reference: Clockwork API Reference.
| Method | Endpoint | Description |
|---|---|---|
GET | /v1/clockwork/jobs | List cron jobs |
POST | /v1/clockwork/jobs | Create a cron job |
PATCH | /v1/clockwork/jobs/{job_id} | Update a cron job — schedule, target, or paused state |
DELETE | /v1/clockwork/jobs/{job_id} | Delete a cron job |
GET | /v1/clockwork/jobs/{job_id}/executions | Execution history for a cron job |
GET | /v1/clockwork/delayed | List one-shot delayed jobs |
POST | /v1/clockwork/delayed | Schedule a one-shot delayed job |
DELETE | /v1/clockwork/delayed/{job_id} | Cancel a delayed job before it fires |
GET | /v1/clockwork/delayed/{job_id}/executions | Execution history for a delayed job |
Clockwork is the one engine with a 1:1 session-cookie mirror at /dashboard/clockwork/* — same bodies, same responses, different auth. The route mapping table has the pairs.
Passepartout — Telegram Login
Full reference: Passepartout API Reference.
| Method | Endpoint | Description |
|---|---|---|
POST | /v1/passepartout/login/start | Begin a login attempt; returns a nonce and a Telegram deep_link |
GET | /v1/passepartout/login/status | Poll a nonce until the end-user finishes in Telegram |
POST | /v1/passepartout/tokens/introspect | Validate a ppt_ end-user access token and read its claims |
Unauthenticated Endpoints
No key, no session — safe to call from a browser.
| Method | Endpoint | Description |
|---|---|---|
GET | /health | Edge gateway liveness; returns {"status":"healthy","service":"edge_gw"} |
GET | /public/status | Live component status behind the status page |
GET | /public/gate/providers/{tenant_id} | The social providers a tenant has enabled — for rendering login buttons before any flow starts |
* | /auth/* | Ory Kratos self-service routes; this is where a flow's ui.action submits |
What Is Not on This Page
Three route families exist on the gateway but are not part of the public contract, and may change without notice:
/dashboard/*— the tenant Console API, authenticated by theory_kratos_sessioncookie rather than an API key. Everything it does for Relay, Gate, and Passepartout is also reachable through the keyed routes above; the exception is Clockwork, whose mirror is documented./admin/*— the operator panel behindjules.vernesoft.com./internal/*— service-to-service callbacks (Kratos webhooks, billing events). They authenticate with shared secrets and are not callable by tenants.
Next Steps
- Pick up an SDK on the Installation page — it wraps most of the surface above.
- Send your first event with Relay.
- Sign your first end-user in with Gate Identity or Passepartout.