{ "info": { "name": "zrok-orchestration", "description": "Local zrok-orchestration API (default port 8030). Covers every route in main.go, including the deprecated aliases: /stacks (= /frontend, and what the myzrok Node app calls) and /frontdoor-tcp-share (= /tcp-share).", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "variable": [ { "key": "baseUrl", "value": "http://localhost:8030" }, { "key": "awsAccountId", "value": "000000000000" }, { "key": "zone", "value": "us-east-1" }, { "key": "frontendId", "value": "my-frontend" }, { "key": "domainName", "value": "example.com" }, { "key": "shareId", "value": "my-tcp-share" }, { "key": "ipsecId", "value": "my-ipsec-frontend" }, { "key": "stackId", "value": "00000000-0000-0000-0000-000000000000" } ], "item": [ { "name": "Health", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/health", "host": [ "{{baseUrl}}" ], "path": [ "health" ] }, "description": "" } }, { "name": "Frontend (custom domains)", "item": [ { "name": "List frontends", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/frontend", "host": [ "{{baseUrl}}" ], "path": [ "frontend" ] }, "description": "No query params \u2192 lists all stacks." } }, { "name": "Get frontend", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/frontend?id={{frontendId}}&domainName={{domainName}}&zone={{zone}}", "host": [ "{{baseUrl}}" ], "path": [ "frontend" ], "query": [ { "key": "id", "value": "{{frontendId}}" }, { "key": "domainName", "value": "{{domainName}}" }, { "key": "zone", "value": "{{zone}}" } ] }, "description": "" } }, { "name": "Create frontend (v2)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/frontend", "host": [ "{{baseUrl}}" ], "path": [ "frontend" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi. frontendToken is required when version=2; version defaults to 1.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{frontendId}}\",\n \"domainNames\": [\n \"{{domainName}}\"\n ],\n \"authProviders\": [],\n \"frontendToken\": \"\",\n \"version\": 2,\n \"zone\": \"{{zone}}\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Update frontend", "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/frontend", "host": [ "{{baseUrl}}" ], "path": [ "frontend" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{frontendId}}\",\n \"domainNames\": [\n \"{{domainName}}\"\n ],\n \"authProviders\": [],\n \"frontendToken\": \"\",\n \"zone\": \"{{zone}}\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Reissue certificate", "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/frontend", "host": [ "{{baseUrl}}" ], "path": [ "frontend" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{frontendId}}\",\n \"domainNames\": [\n \"{{domainName}}\"\n ],\n \"reissueCert\": true,\n \"zone\": \"{{zone}}\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Delete frontend", "request": { "method": "DELETE", "header": [], "url": { "raw": "{{baseUrl}}/frontend?id={{frontendId}}&domainName={{domainName}}&zone={{zone}}", "host": [ "{{baseUrl}}" ], "path": [ "frontend" ], "query": [ { "key": "id", "value": "{{frontendId}}" }, { "key": "domainName", "value": "{{domainName}}" }, { "key": "zone", "value": "{{zone}}" } ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi." } }, { "name": "Frontend progress", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/frontend/progress?id={{frontendId}}&domainName={{domainName}}", "host": [ "{{baseUrl}}" ], "path": [ "frontend", "progress" ], "query": [ { "key": "id", "value": "{{frontendId}}" }, { "key": "domainName", "value": "{{domainName}}" } ] }, "description": "Needs REDIS_ADDR; otherwise always 404." } } ] }, { "name": "Stacks (deprecated /stacks, as called by myzrok Node)", "description": "The exact calls the myzrok Node app makes (`zrok-orchestration-rest-client.js`), with the same request shapes: singular `domainName`, no `version` (so a v1 stack). `/stacks` is a deprecated alias of `/frontend` and runs the same handlers. The stack is named `-`.", "item": [ { "name": "Create stack (myzrok create)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/stacks", "host": [ "{{baseUrl}}" ], "path": [ "stacks" ] }, "description": "\u26a0\ufe0f Runs Pulumi against real AWS. Called by POST /api/domains. Returns CERTIFICATE_VALIDATION_PENDING and the validation CNAMEs.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{stackId}}\",\n \"domainName\": \"{{domainName}}\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Get stack (myzrok polling)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/stacks/?id={{stackId}}&domainName={{domainName}}", "host": [ "{{baseUrl}}" ], "path": [ "stacks" ], "query": [ { "key": "id", "value": "{{stackId}}" }, { "key": "domainName", "value": "{{domainName}}" } ] }, "description": "Called every 45 s while the page is open (embedStack=true). Refreshes the certificate and listener rule." } }, { "name": "Update stack with identity (myzrok Update)", "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/stacks", "host": [ "{{baseUrl}}" ], "path": [ "stacks" ] }, "description": "\u26a0\ufe0f Runs Pulumi against real AWS. Called by PUT /api/domains/:id/stack once the certificate is ISSUED. Deploys the frontend container.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{stackId}}\",\n \"domainName\": \"{{domainName}}\",\n \"zitiIdentityJson\": \"\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Reissue certificate (myzrok)", "request": { "method": "POST", "header": [], "url": { "raw": "{{baseUrl}}/stacks/reissue-cert?id={{stackId}}&domainName={{domainName}}", "host": [ "{{baseUrl}}" ], "path": [ "stacks", "reissue-cert" ], "query": [ { "key": "id", "value": "{{stackId}}" }, { "key": "domainName", "value": "{{domainName}}" } ] }, "description": "\u26a0\ufe0f Runs Pulumi against real AWS. Called by POST /api/domains/:id/reissue-cert." } }, { "name": "Delete stack (myzrok delete)", "request": { "method": "DELETE", "header": [], "url": { "raw": "{{baseUrl}}/stacks?id={{stackId}}&domainName={{domainName}}", "host": [ "{{baseUrl}}" ], "path": [ "stacks" ], "query": [ { "key": "id", "value": "{{stackId}}" }, { "key": "domainName", "value": "{{domainName}}" } ] }, "description": "\u26a0\ufe0f Runs Pulumi against real AWS. Called by DELETE /api/domains/:id. pulumi destroy." } }, { "name": "List stacks", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/stacks", "host": [ "{{baseUrl}}" ], "path": [ "stacks" ] }, "description": "No query params: lists all stacks in the project." } }, { "name": "Stack progress", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/stacks/progress?id={{stackId}}&domainName={{domainName}}", "host": [ "{{baseUrl}}" ], "path": [ "stacks", "progress" ], "query": [ { "key": "id", "value": "{{stackId}}" }, { "key": "domainName", "value": "{{domainName}}" } ] }, "description": "Deprecated alias of /frontend/progress. Needs REDIS_ADDR; otherwise always 404." } } ] }, { "name": "TCP share", "item": [ { "name": "List TCP shares", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "tcp-share" ] }, "description": "No query params \u2192 lists all stacks." } }, { "name": "Get TCP share", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/tcp-share?id={{shareId}}", "host": [ "{{baseUrl}}" ], "path": [ "tcp-share" ], "query": [ { "key": "id", "value": "{{shareId}}" } ] }, "description": "" } }, { "name": "Create TCP share (zrok)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "tcp-share" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi. Zrok shape: share_token (+ account_token). Mutually exclusive with service_name.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{shareId}}\",\n \"ingress_port\": 10000,\n \"share_token\": \"\",\n \"account_token\": \"\",\n \"share_name\": \"my-share\",\n \"customer_label\": \"acme\",\n \"naming_scheme\": \"v2\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Create TCP share (ziti)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "tcp-share" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi. Ziti shape: service_name + ziti_identity_arn; credentials are ARNs, never material.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{shareId}}\",\n \"ingress_port\": 10000,\n \"service_name\": \"my-ziti-service\",\n \"ziti_identity_arn\": \"arn:aws:secretsmanager:us-east-1:{{awsAccountId}}:secret:my-identity\",\n \"server_cert_arn\": \"arn:aws:ssm:us-east-1:{{awsAccountId}}:parameter/my-share/server-cert\",\n \"server_key_arn\": \"arn:aws:ssm:us-east-1:{{awsAccountId}}:parameter/my-share/server-key\",\n \"client_ca_arn\": \"arn:aws:ssm:us-east-1:{{awsAccountId}}:parameter/my-share/client-ca\",\n \"client_cert_revision\": \"1\",\n \"required_organizational_unit\": \"\",\n \"allowed_subjects\": \"\",\n \"allowed_common_name_prefixes\": \"\",\n \"share_name\": \"my-share\",\n \"customer_label\": \"acme\",\n \"naming_scheme\": \"v2\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Update TCP share (rotate client cert)", "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "tcp-share" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi. Omitted fields keep current values; \"\" clears a field (not allowed for service_name, ziti_identity_arn, server_cert_arn, server_key_arn).", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{shareId}}\",\n \"client_cert_revision\": \"2\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Update TCP share (revoke allow-list)", "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "tcp-share" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{shareId}}\",\n \"allowed_subjects\": \"\",\n \"allowed_common_name_prefixes\": \"\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Delete TCP share", "request": { "method": "DELETE", "header": [], "url": { "raw": "{{baseUrl}}/tcp-share?id={{shareId}}", "host": [ "{{baseUrl}}" ], "path": [ "tcp-share" ], "query": [ { "key": "id", "value": "{{shareId}}" } ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi." } }, { "name": "TCP share progress", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/tcp-share/progress?id={{shareId}}", "host": [ "{{baseUrl}}" ], "path": [ "tcp-share", "progress" ], "query": [ { "key": "id", "value": "{{shareId}}" } ] }, "description": "Needs REDIS_ADDR; otherwise always 404." } } ] }, { "name": "TCP share (deprecated /frontdoor-tcp-share)", "item": [ { "name": "List TCP shares (deprecated)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/frontdoor-tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "frontdoor-tcp-share" ] }, "description": "No query params \u2192 lists all stacks." } }, { "name": "Get TCP share (deprecated)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/frontdoor-tcp-share?id={{shareId}}", "host": [ "{{baseUrl}}" ], "path": [ "frontdoor-tcp-share" ], "query": [ { "key": "id", "value": "{{shareId}}" } ] }, "description": "" } }, { "name": "Create TCP share (zrok) (deprecated)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/frontdoor-tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "frontdoor-tcp-share" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi. Zrok shape: share_token (+ account_token). Mutually exclusive with service_name.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{shareId}}\",\n \"ingress_port\": 10000,\n \"share_token\": \"\",\n \"account_token\": \"\",\n \"share_name\": \"my-share\",\n \"customer_label\": \"acme\",\n \"naming_scheme\": \"v2\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Create TCP share (ziti) (deprecated)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/frontdoor-tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "frontdoor-tcp-share" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi. Ziti shape: service_name + ziti_identity_arn; credentials are ARNs, never material.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{shareId}}\",\n \"ingress_port\": 10000,\n \"service_name\": \"my-ziti-service\",\n \"ziti_identity_arn\": \"arn:aws:secretsmanager:us-east-1:{{awsAccountId}}:secret:my-identity\",\n \"server_cert_arn\": \"arn:aws:ssm:us-east-1:{{awsAccountId}}:parameter/my-share/server-cert\",\n \"server_key_arn\": \"arn:aws:ssm:us-east-1:{{awsAccountId}}:parameter/my-share/server-key\",\n \"client_ca_arn\": \"arn:aws:ssm:us-east-1:{{awsAccountId}}:parameter/my-share/client-ca\",\n \"client_cert_revision\": \"1\",\n \"required_organizational_unit\": \"\",\n \"allowed_subjects\": \"\",\n \"allowed_common_name_prefixes\": \"\",\n \"share_name\": \"my-share\",\n \"customer_label\": \"acme\",\n \"naming_scheme\": \"v2\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Update TCP share (rotate client cert) (deprecated)", "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/frontdoor-tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "frontdoor-tcp-share" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi. Omitted fields keep current values; \"\" clears a field (not allowed for service_name, ziti_identity_arn, server_cert_arn, server_key_arn).", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{shareId}}\",\n \"client_cert_revision\": \"2\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Update TCP share (revoke allow-list) (deprecated)", "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/frontdoor-tcp-share", "host": [ "{{baseUrl}}" ], "path": [ "frontdoor-tcp-share" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{shareId}}\",\n \"allowed_subjects\": \"\",\n \"allowed_common_name_prefixes\": \"\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Delete TCP share (deprecated)", "request": { "method": "DELETE", "header": [], "url": { "raw": "{{baseUrl}}/frontdoor-tcp-share?id={{shareId}}", "host": [ "{{baseUrl}}" ], "path": [ "frontdoor-tcp-share" ], "query": [ { "key": "id", "value": "{{shareId}}" } ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi." } }, { "name": "TCP share progress (deprecated)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/frontdoor-tcp-share/progress?id={{shareId}}", "host": [ "{{baseUrl}}" ], "path": [ "frontdoor-tcp-share", "progress" ], "query": [ { "key": "id", "value": "{{shareId}}" } ] }, "description": "Needs REDIS_ADDR; otherwise always 404." } } ], "description": "Deprecated aliases of /tcp-share; same handlers and payloads." }, { "name": "IPSec frontend", "item": [ { "name": "List IPSec frontends", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/ipsec-frontend", "host": [ "{{baseUrl}}" ], "path": [ "ipsec-frontend" ] }, "description": "" } }, { "name": "Get IPSec frontend", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/ipsec-frontend?id={{ipsecId}}", "host": [ "{{baseUrl}}" ], "path": [ "ipsec-frontend" ], "query": [ { "key": "id", "value": "{{ipsecId}}" } ] }, "description": "" } }, { "name": "Create IPSec frontend", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/ipsec-frontend", "host": [ "{{baseUrl}}" ], "path": [ "ipsec-frontend" ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi. psk_secret_arn is optional.", "body": { "mode": "raw", "raw": "{\n \"id\": \"{{ipsecId}}\",\n \"peer_public_ip\": \"203.0.113.10\",\n \"peer_cidr\": \"10.20.0.0/16\",\n \"psk_secret_arn\": \"arn:aws:secretsmanager:us-east-1:{{awsAccountId}}:secret:my-psk\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Delete IPSec frontend", "request": { "method": "DELETE", "header": [], "url": { "raw": "{{baseUrl}}/ipsec-frontend?id={{ipsecId}}", "host": [ "{{baseUrl}}" ], "path": [ "ipsec-frontend" ], "query": [ { "key": "id", "value": "{{ipsecId}}" } ] }, "description": "\u26a0\ufe0f Creates/changes/destroys real AWS resources via Pulumi." } }, { "name": "IPSec frontend progress", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/ipsec-frontend/progress?id={{ipsecId}}", "host": [ "{{baseUrl}}" ], "path": [ "ipsec-frontend", "progress" ], "query": [ { "key": "id", "value": "{{ipsecId}}" } ] }, "description": "Needs REDIS_ADDR; otherwise always 404." } } ] } ] }