v1 API

The Runway control plane exposes a small, org-scoped v1 API. The fr CLI and MCP server are thin clients over these two endpoints; the console uses the same governed actions through server actions.

Authentication and tenancy

Every request is authenticated (a Databricks Apps user session in production, or a dev token locally) and the resolved principal's tenant must equal the :org in the path — a mismatch is a 403. Actions must be on the allowlist, and the caller must hold the required permission.

POST /api/v1/orgs/:org/actions/:actionId

Invokes a governed action through the full mutation pipeline.

POST /api/v1/orgs/org-acme/actions/runway.deploy_request
Authorization: Bearer <token>
Idempotency-Key: fr:runway.deploy_request:<stable-command-digest>
Content-Type: application/json

{ "params": { "appId": "app_123", "environment": "dev", "artifactId": "art_0123456789abcdef01234567" } }

Responses:

Every mutation requires a stable Idempotency-Key header (or the identical key in the JSON body). Retries with the same logical command key resolve to the same durable Platform invocation.

The allowlist excludes runway.gate_record, runway.promotion_finalize, runway.promotion_execute, runway.rollback_execute, runway.reconciliation_dispatch, runway.deployment_reconcile, runway.analytics_rollup, runway.tenant_bootstrap, runway.tenant_provision_complete, runway.tenant_retire_apply, and runway.tenant_retire_complete — recording verdicts, declaring an approval threshold satisfied, executing production, and completing trusted recovery or tenant lifecycle work are server/worker-only. Public promotion_reopen and tenant_retire requests still pass through the same permission, schema, policy, idempotency, and event pipeline. In production, gate_evaluate returns after durable submission. The trusted worker requests/polls Fabric Experiments and records the verified exact-run verdict. Only the local demo completes this flow inline.

GET /api/v1/orgs/:org/projections

Returns the org's read model, folded from the event log. Requires the runway:read permission.

{
  "organizationId": "org-acme",
  "catalog": [ … ],
  "artifacts": [ … ],
  "deployments": [ … ],
  "secrets": [ … ],
  "audit": [ … ],
  "analytics": [ … ],
  "reconciliations": [ … ]
}

• catalog — registered apps.
• artifacts — digest-verified Harness builds and component provenance.
• deployments — every deployment with its current state, environment, artifact digest, gate evidence, and prod URL.
• secrets — scope, environment, and key names per app (never values).
• audit — the actor-stamped event stream, filterable by actor kind (human / agent / system).
• analytics — immutable completed-day event rollups.
• reconciliations — failed-invocation recovery requests and replacement invocation ids.

Org scoping is enforced by the runtime: projections are folded per organization, so a response can only ever contain the caller's own tenant's rows.