API Conventions

URL and methods

All public endpoints use https://dokki.one/api/v1.

• GET: read.

• POST: create or trigger an operation.

• PATCH: partial update.

• PUT: replace a relationship or configuration.

• DELETE: revoke, archive, or remove.

Use JSON request and response bodies unless an endpoint says otherwise.

IDs and timestamps

IDs are UUIDs. Timestamps are ISO 8601 strings in UTC. Treat unknown response fields as forward-compatible additions.

Capability discovery

GET /api/v1/capabilities is the source of truth for the currently exposed endpoint catalog. GET /api/v1/me is the source of truth for the caller's effective scopes.

Safe client behavior

• Set an explicit timeout.

• Preserve request_id.

• Bound retries.

• Treat 404 as non-disclosure in permission-sensitive reads.

• Do not log Authorization headers or response secrets.