Engineer’s entry point

One contract.
Every client.

Cix exposes the host through a REST API. cixctl, the web dashboard, and your automation all speak to the same daemon and the same resource model.

The boundary

Use the interface the product uses.

The daemon is the only process with direct access to runtime and host primitives. Clients send intent over HTTP/JSON; the OpenAPI document defines the operations, fields, and responses that are actually implemented.

Open the OpenAPI contract

cixctlREST client

DashboardREST client

{ }Your toolOpenAPI

HTTP / JSON

ONE AUTHORITY · ONE CONTRACTcixdvalidate · persist · reconcile

Read first

Reads are open and resource-shaped.

Start with the current state: health, boot identity, containers, networks, storage, devices, services, pipeline items, and logs. The API answers what exists, while the roadmap and guides explain how the platform got there.

GET /v1/healthGET /v1/system/bootGET /v1/containersGET /v1/system/logs

Change safely

Write intent, then read the effect back.

Mutations are ordinary REST requests: create or update a resource, then read the resulting state and its derived readiness. The CLI and dashboard do not have privileged side channels, so an integration can use the same evidence as the first-party clients.

curl -s http://cix-host/v1/health → {"status":"ok","auth_gating_active":false}

POSTPUTDELETEderived state

Authenticate writes

Authentication follows one rule.

Every POST, PUT, and DELETE—and the workload console—requires a bearer token once host-auth gating is active. Reads remain open. A fresh install stays usable until an admin group has a real member; the API reports whether gating is currently active.

POST /v1/login → {"token":"…","expires_in_seconds":900}

Bearer authGET remains openaudit recordsvisible gating

Integration boundaries

Automation gets the same truth.

Use the API for orchestration, but keep the product’s actual boundaries in view.

OpenAPI is authoritativeThis page is orientation only. The exact schemas, status codes, and route names live in the versioned contract.
cixd owns side effectsClients express intent; the daemon validates, persists, reconciles, and drives Linux primitives.
Managed LDAP listeners are explicitLDAP server listener selection and ports are API-owned. A client’s TLS choice points to an enabled server listener, while a requested server restart is sequenced one provider at a time.
Containers are not VMsWorkloads use namespaces and cgroups. Device grants do not create a hypervisor isolation boundary.
Authentication is not optional once enabledPlan for a session token, admin-group bootstrap, refusal auditing, and physical or hypervisor recovery if credentials are lost.

Canonical references

Integrate from the source.

Use the human guide for orientation and OpenAPI for implementation.

Read the API guide

Open OpenAPI