Skip to content

API Documentation

What this screen is for

This screen is a developer reference, read before an application makes its first call. It is compiled into the console: it fetches nothing, it changes nothing, and it shows the same content to every tenant on every install.

The API Reference tab explains the model (an application names a Key ID and policy resolves the algorithm), how an application obtains a token, the scopes, the endpoints of the two planes, the key types, the error statuses and the base URL of the environment you are signed in to. The SDK & Client Libraries tab gives the Maven and Gradle coordinates of the Java SDK, a minimal Java example, a comparison with the crypto CLI, the algorithm families, and links to the SDK guides.

Every route, verb and scope on the reference tab was taken from the controller that serves it, but the tables are a summary, not the specification. The OpenAPI specifications are linked below.

What must exist first

Only a signed-in session. The entry sits in the Developers group of the sidebar for every role — platform administrator, tenant administrator and key manager — and no permission gates it. Because nothing on the screen calls the platform, no server permission applies either.

On a customer-operated install, two things differ from an ANKA-hosted environment:

  • The Environments table has one row, built from the address you are signed in to: its scheme and host name, marked "Current environment". A port, if your console is served on one, is not included. The named rows (Development, Staging, Demo, Production) appear only when the console runs on one of ANKA's own hosts.
  • The buttons that open the full API documentation and the SDK guides open ANKA's published sites in a new tab. They are plain links: the console sends nothing to those sites, not your token and not the page you came from. If your install cannot reach them, the new tab fails and this screen is unaffected. The setting that switches this in-product help off does not remove those links.

Decisions you make here

None that change the platform. The screen offers two conveniences:

  • Choosing a tab. The choice is kept in the address as ?tab=sdk, so a link can open the SDK tab directly. Any other value opens the API Reference tab.
  • Copying a snippet. The Maven, Gradle and Java blocks carry a copy button that writes the block to your clipboard. When the browser refuses clipboard access, the block says so and you select and copy it by hand.

Two things the reference states are worth reading exactly:

  • Which plane an operation belongs to. Encrypt, decrypt, sign, verify, re-encrypt and key discovery are on Core API, the data plane an application calls with its own token. Creating, rotating and revoking a key are control-plane operations on Admin API, with the tenant in the path. Core API's own create, rotate and revoke routes are internal and refuse an application token.
  • How a token is obtained. The authentication service's token endpoint takes a form-encoded body (grant_type=client_credentials, client_id, client_secret); that is the only encoding the endpoint accepts. client_id is the cryptographic actor's identifier and client_secret one of its shared-secret credentials; an actor with a registered key pair presents a signed assertion instead. The scopes the token carries come from the actor's roles and its active capability grants, never from anything on this screen.

How it relates to other screens

The identifier and the credential an application presents, and the roles that give its token scopes, are issued on the actor:

Which keys the application may use is decided by capability grants. The keys themselves are created, rotated and revoked from the key inventory, which drives the same Admin API routes this screen lists:

Where to read more