Nebula API reference

Versioned HTTP and WebSocket contracts used by Nebula clients. Device authorization uses browser approval; tokens must be sent only in the Authorization header.

/api/client/v1/auth/device

Start browser/headless device authorization.

/api/client/v1/auth/token

Poll for approval, rotate refresh tokens, and obtain scoped access tokens.

/api/client/v1/projects

List and synchronize Cloud projects.

/api/client/v1/storage

Read and write Nebula Storage with scoped authorization.

/api/client/v1/systems

List owner systems, metrics, incidents, shares, and commands.

/api/agent/v1/enroll

Exchange a one-use owner grant for a machine identity.

/api/billing/v1

Provider-neutral checkout and subscription state.

/api/office/v2

Documents, snapshots, collaboration, and export jobs.

Client behavior

Clients must handle pending authorization, rate limits, token rotation, revocation, idempotency, and structured error codes.