Control plane API

Authentication

Mint tokens in Settings. Secret is shown once. Scope them (services:read, services:write, dns:write, waf:write, purge, watchtower:read, audit:read).

Cookie sessions from the dashboard also work for GET /api/v1/audit?format=csv.

Authorization: Bearer tz_live_…
Idempotency-Key: 8–128 URL-safe characters
X-Request-Id: optional; echoed back

Errors

JSON: { success, error, request_id, message? }. 401 unauthenticated, 403 role/scope, 402 plan_limit or plan_required, 409 preview_court or service_paused, 429 rate_limited.

Endpoints

All paths below are on https://tinyzipper.com. Writes that create a resource enforce the plan quota.

• ▸GET /api/v1/whoami — plan + entitlements
• ▸GET|PATCH /api/v1/services/:key — policy
• ▸GET|POST /api/v1/herald/records
• ▸GET /dns-query?name=&type= — application/dns-json (not port 53)
• ▸PUT /api/v1/gallery/objects — original images (not transcode)
• ▸GET|POST /api/v1/keep/rules
• ▸GET /api/v1/guard POST /api/v1/guard/scan PATCH|DELETE /api/v1/guard/:id
• ▸GET|POST /api/v1/drawbridge/origins
• ▸GET|POST /api/v1/scepter/policies
• ▸POST /api/v1/archives/purge
• ▸GET /api/v1/watchtower/events
• ▸GET /api/v1/audit (+ ?format=csv on Business+)
• ▸GET|POST /api/v1/functions /hosting /jobs /video /waiting
• ▸GET|POST /api/v1/cellar POST /query /wire /rest/:table /rpc/:name GET /live /agent /setup /import /export /openapi DATABASE_URL postgres://…@db.tinyzipper.com:5432
• ▸GET|POST /api/v1/email/mailboxes /email/routes GET /email/messages POST /email/inbound
• ▸GET|POST /api/v1/connect POST /connect/heartbeat
• ▸POST /api/portcullis/v1/siteverify
• ▸POST /api/v1/scim/v2/Users (Scale+, tz_scim_ token)

Example: list then create

List Keep rules, then add one. Repeat for any resource table.

curl -sS https://tinyzipper.com/api/v1/keep/rules -H "Authorization: Bearer tz_live_YOUR_TOKEN"

curl -sS -X POST https://tinyzipper.com/api/v1/keep/rules \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"Block scanners","expression":"http.request.uri.path contains \"/wp-admin\"","action":"block"}'