Platform API
The identity and API key authority for Ciresk's products, at https://api.ciresk.com: API keys, organizations, team and sessions.
Base URL and authentication
Every endpoint is under https://api.ciresk.com/v1/platform; the probes GET /health and GET /ready and the OpenAPI 3.1 document at https://api.ciresk.com/openapi.json need no credential. Send Authorization: Bearer <credential> with either a csk_ key that carries platform:* scopes or the access token of a signed-in person. Each action needs a permission from the caller's organization role (platform:keys.create, platform:members.manage, ...; GET /v1/platform/catalog lists them), and a key never does more than its owner. A request without a credential is 401 unauthenticated.
export CIRESK_KEY=csk_live_eu_...
curl -s "https://api.ciresk.com/v1/platform/keys/whoami" -H "Authorization: Bearer $CIRESK_KEY"Keys
csk_ keys are minted, listed, rotated and revoked here and nowhere else; the plaintext is returned once and never kept, and a revoked key stops being accepted by every product within 60 s.
| Endpoint | What it does | Permission |
|---|---|---|
GET /v1/platform/keys | Every key of the caller's organization, newest first, never the secret: id, name, product, env, region, key_preview, scopes, status, created_by, last_used_at, expires_at, revoked_at. ?product= filters; ?include_inactive=true adds revoked and expired keys. | platform:keys.read |
POST /v1/platform/keys | Mint a key: name, scopes (one product only), optional env (live by default) and expires_at. Answers the key once with its id, key_preview, region and scopes. | platform:keys.create |
POST /v1/platform/keys/{key_id}/rotate | Mint a replacement and keep the old key valid for grace_seconds (24 hours by default, at most 30 days, 0 revokes it at once); answers the new key and previous_expires_at. Only the key's owner rotates it. | platform:keys.create for your own keys |
POST /v1/platform/keys/{key_id}/revoke | Revoke a key; 204. | platform:keys.create for your own keys, platform:keys.manage for anyone's |
GET /v1/platform/keys/whoami | Who the credential is: org_id, org_name, org_slug, jurisdiction, subject, key_name, scopes, roles, groups. | Any signed-in person or key |
POST /v1/platform/keys/introspect | What a product's own authentication layer calls to resolve a key fingerprint into a principal. Takes a product service token, not a key or a person's token; 401 otherwise. | Product service token |
Organizations
| Endpoint | What it does |
|---|---|
GET /v1/platform/orgs | Every organization the caller is an active member of, with their roles there and the organization's enabled products. |
GET /v1/platform/orgs/me | The caller's current organization: jurisdiction, enabled products and provisioning state. |
POST /v1/platform/orgs/me/provision | Run the provisioning of the organization's enabled products again; safe to retry. |
Enabling a product for an organization is an operation Ciresk performs, not something an organization does to itself.
Team
Members, invitations and groups of the caller's organization; every write is audited.
| Endpoint | What it does |
|---|---|
GET /v1/platform/team/members, PATCH /v1/platform/team/members/{user_id}, DELETE /v1/platform/team/members/{user_id} | List members, change a member's roles, remove a member. |
PUT /v1/platform/team/members/{user_id}/group | Put a member in a group. |
GET /v1/platform/team/invitations, POST /v1/platform/team/invitations, DELETE /v1/platform/team/invitations/{invitation_id} | List, send and revoke invitations. |
GET /v1/platform/team/groups, POST /v1/platform/team/groups, PATCH /v1/platform/team/groups/{group_id}, DELETE /v1/platform/team/groups/{group_id} | List, create, rename and delete groups. |
Sessions and audit
| Endpoint | What it does |
|---|---|
GET /v1/platform/session/orgs | The organizations a signed-in person can switch to, before any product gate. |
POST /v1/platform/session/switched | Record that the person switched organization. |
POST /v1/platform/session/revoke-all | Sign the person out everywhere. |
GET /v1/platform/catalog | Every permission a role can hold, per product. |
Audit
Every record of the organization's audit log you may read: an Owner or Admin (platform:audit.read) reads every record, any other member the records they or their agents acted in and the use history of each connection they manage. Rows are typed (AuditRecord in the OpenAPI document): identifiers in clear, people by name, content never, and beside each record a display object naming its actors, an agent with the harness it runs in ("Claude Code") and a person the organization no longer names as "Former member". Every search and every export step is itself an audit record.
| Endpoint | What it does |
|---|---|
GET /v1/platform/audit/events | Search, newest first: q (words in the action, a target or the refusal code, never in content), principal, agent, connection, credential, action, allowed, code, session, correlation_id, resource_type, resource_id, crn, since, until. The first page carries total, counted to 10,000 records read, with estimate: true past that. |
GET /v1/platform/audit/events/actions | Every action your records hold, agent tools included, for an action filter. |
GET /v1/platform/audit/connections/{connection_id} | One connection's use history, with its connection header (connector, account, kind) when you may read the connection. |
POST /v1/platform/audit/exports | Queue an export job of every record the filters match, as jsonl or formula-safe csv; needs platform:audit.export. The job is bound to you, your organization and the filters. |
GET /v1/platform/audit/exports/{export_id} | The job's status: ready with its download_url, expired (after 15 minutes) or cancelled. |
GET /v1/platform/audit/exports/{export_id}/download | The records, streamed. It answers only the job's requester, and your rights are checked again before every chunk: a right lost cancels the job and stops the download. At most 100,000 records; a cut download ends with the next_cursor to queue the rest from. |
GET /v1/platform/audit, GET /v1/platform/audit/export and GET /v1/platform/audit/actions are deprecated since 2026-10-23: they still answer, with a Deprecation header and a Link to their successors (/audit/events, /audit/exports, /audit/events/actions), and are removed in a later release after the deprecation window.
Reference coming
A generated reference with every field, example and error, built from https://api.ciresk.com/openapi.json the way the Ciresk CI API reference is, is coming. Until then the document itself is the full description of the access, activity, budgets, integrations and connections endpoints not listed here.