API

The control-plane API manages instances, team and billing. It is not the API inside your running instance — that is documented separately in the product.

Base URL and authentication

https://app.thalamusaicloud.com/v1

Requests authenticate with the session cookie set at sign-in. The cookie is host-only and HttpOnly, so it is not readable from script and is never sent to your instance's subdomain.

Machine access

Long-lived API tokens are not available yet. If you need automated access, tell us what you are automating — it shapes what the tokens should be scoped to.

Instances

Method	Path	Does
`GET`	`/v1/tenants`	List your instances
`POST`	`/v1/tenants`	Create one and queue provisioning
`GET`	`/v1/tenants/:id`	One instance, with recent jobs
`DELETE`	`/v1/tenants/:id`	Queue destruction
`GET`	`/v1/jobs/:id`	Provisioning steps and events

Creating an instance

POST /v1/tenants
Content-Type: application/json
Idempotency-Key: your-unique-key

{
  "name": "Production",
  "subdomain": "acme-prod",
  "region": "us-east-1",
  "planId": "team"
}

Send an idempotency key

Provisioning takes minutes, so a client timeout is normal rather than exceptional. With a key, retrying returns 200 and the original job. Without one we fall back to your organisation plus the subdomain, which protects the common case but not a retry with different parameters.

Team

Method	Path	Does
`GET`	`/v1/members`	Members and pending invitations
`POST`	`/v1/members/invite`	Invite someone
`DELETE`	`/v1/members/invite/:id`	Revoke an invitation

Billing

Method	Path	Does
`GET`	`/v1/billing`	Subscription state and invoices
`GET`	`/v1/billing/usage`	Peak usage and expected true-up

Errors

Errors are JSON, and every response carries a request id.

{
  "error": "subdomain_taken",
  "message": "That subdomain is already in use. Choose another.",
  "requestId": "5f3c1e2a-..."
}

Quote the requestId when contacting support — it identifies the exact request in our logs.

Status	Meaning
`400`	The request is malformed or a value is invalid
`401`	Not signed in, or the session expired
`403`	Signed in, but your role does not allow it
`404`	Does not exist, or is not yours
`409`	Conflicts with something that already exists

A resource belonging to another organisation returns 404 rather than 403, so the API does not confirm that it exists.