Skip to main content

Control-plane API

This is the alphaswarm_controller surface at manage.alpha-swarm.ai. It is deliberately separate from the public AlphaSwarm API; it owns workload lifecycle, the TerraformRuntime, provider adapters, and the workload_runs audit ledger.

The spec lives at alphaswarm_docs/openapi/control-plane.json, auto-dumped by the existing openapi-export job in .github/workflows/ci.yml.

Surface​

  • /manage/workloads/* — start / stop / scale / restart / exec / tail-logs / apply_config / rotate-secret.
  • /manage/topology/* — service URL resolution (AGENTS rule 47).
  • /manage/terraform/* — Terraform plan / apply / destroy through TerraformRuntime (AGENTS rules 42, 43).
  • /manage/cloudflare/* — tunnel + DNS + Access app CRUD.
  • /manage/auth/* — IdP wiring (Auth0, Entra).
  • /manage/tenancy/* — EntraTenantLink lifecycle (AGENTS rule 44).
  • /manage/agents/health — agent stall watchdog snapshot.
  • /manage/workflows/halt — kill-switch fan-out.

Audit ledger​

Every workload action writes a workload_runs row BEFORE executing through the provider. See Concept: management engine for the full audit contract.

Authentication​

Same Auth0 / Entra IdP chain as the public API; access is restricted to the admin:cluster scope (engineering org) and the per-org admin:org scope (customer orgs). Cloudflare Access policies in front of manage.alpha-swarm.ai enforce the perimeter at the edge.