Skip to main content

API · INVENTORY

Resources and consumers

A resource identifies an external object. Consumer bindings identify the systems that use it and record desired versus observed versions.

Read organization resources

GET /api/v1/resources requires organization_id. Workload callers need change:resource:read and the matching organization. Replace these placeholders using your configured environment:

curl --fail --silent --show-error \
  --header "Authorization: Bearer $WORKLOAD_TOKEN" \
  "$APPSCERT_ORIGIN/api/v1/resources?organization_id=$ORGANIZATION_ID"

The response is an object with a resources array. Each resource includes its ID, external account/ID, class, region, metadata and visible consumers. A consumer includes its reference, desired version, observed version and observation time. This request is read-only.

Register metadata

POST /api/v1/resources registers or updates metadata and consumer bindings; it does not issue a certificate at the provider. It requires organization write permission, or change:resource:write for a workload.

  • Identify the resource with organization_id, external_account, external_id and class; include the correct region when applicable.
  • Current classes are payment_processing, merchant_identity and domain_binding.
  • Provide consumer kind, ref and optional desired_version. Workload callers must supply an allowed GitHub consumer matching their repository/environment.
  • Metadata is restricted to non-secret fields. Do not upload keys, tokens or certificate material through metadata.

Automation ownership is a separate human-approved opt-in. Workload registration cannot grant that ownership. Use the OpenAPI schema for allowed fields and bounds rather than guessing a payload.

Understand consumer visibility

Human reads follow organization permissions. Workload reads are filtered to resources bound to their repository/environment and matching GitHub consumer references. An empty list may reflect binding visibility, not an empty organization.

Registration records desired state; it does not prove deployment. A consumer receipt records what a registered consumer actually observed.

c3209c7