Management API

Base URL and transport

The current developer-token collection is https://beta.thora.cloud/api/management/. Browser sessions use a separate authenticated /v1/management/ path and must not be imitated by forwarding cookies or organization headers.

• Use HTTPS and reject redirects.
• Send Accept: application/json and Content-Type: application/json for JSON mutations.
• Send the developer credential only as an Authorization bearer header.
• Do not send organization, session, delegation, provider, or approval headers.
• Expect bounded JSON or problem JSON responses and no browser HTML.

Resource patterns

• GET inventory, profile, organization, resources, usage, and service collections are bounded reads.
• Compute, DNS, Git, and Sites use service-specific collections and exact schemas.
• Unknown query parameters, duplicate query parameters, extra body fields, and caller-selected tenant or provider values fail closed.
• A 2xx proposal response is not an approval or completed provider action.

curl --fail-with-body --silent --show-error \
  -H "Accept: application/json" \
  -H "Authorization: Bearer $THORA_CLOUD_TOKEN" \
  https://beta.thora.cloud/api/management/compute

Build a conservative client

• Use a 15-second request timeout and a response-size ceiling.
• Do not cache management responses containing organization state.
• Bound retries with exponential backoff and jitter.
• Never automatically retry provider-affecting requests with a new idempotency key.
• Refresh the exact resource after conflicts, approvals, and terminal state changes.