Developers
Every operation grouped by capability, with the real method + path. Auth is the platform-standard SS-01 bearer token plus X-Tenant-Id on tenant routes; money/usage writes carry an Idempotency-Key (ADR-0039). The S3 wire gateway instead authenticates with AWS Signature V4 and resolves the tenant from the access key.
Auth model
Base URLs
Snippets below use $BASE = https://api.dbaas.nexocloud.io/api/v1 · S3 gateway https://s3.dbaas.nexocloud.io/s3 (illustrative hosts).
Quickstart
# 1. Create a Postgres claim.
curl -X POST "$BASE/claims" -H "Authorization: Bearer $TOKEN" \
-H "X-Tenant-Id: acme" -H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"name":"orders","engine":"yugabyte","size_gb":50}'
# 2. Read the binding (DSN + secret_ref, NO inline password) …
curl "$BASE/claims/orders/binding" \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: acme"
# 3. … draw a ≤1h lease, resolve the secret from Vault, then:
psql "postgresql://orders.acme.ss-02.svc:5433/orders"
# the password comes from the Vault lease — never the DSN.# Issue an access key (secret shown once), then point any S3 client
# at /s3. The tenant is resolved from the key — no X-Tenant-Id.
export AWS_ACCESS_KEY_ID=... # POST /api/v1/object/access-keys
export AWS_SECRET_ACCESS_KEY=... # returned once, at creation
aws --endpoint-url https://s3.dbaas.nexocloud.io/s3 s3 mb s3://site-assets
aws --endpoint-url https://s3.dbaas.nexocloud.io/s3 s3 cp app.js s3://site-assets/
aws --endpoint-url https://s3.dbaas.nexocloud.io/s3 s3 ls s3://site-assets/
# real S3 XML; multipart, versioning & presign all supported.# Vector collection (Qdrant).
curl -X POST "$BASE/vector-claims" -H "Authorization: Bearer $TOKEN" \
-H "X-Tenant-Id: acme" -H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"name":"embeddings","dimension":1536}'
# Document write with optimistic concurrency.
curl -X PUT "$BASE/claims/orders/docs/order-1001" \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: acme" \
-H "Content-Type: application/json" \
-d '{"value":{"status":"paid"},"if_version":2}'
# Time-series query, 5-minute average buckets.
curl -X POST "$BASE/claims/metrics/query" \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: acme" \
-H "Content-Type: application/json" \
-d '{"series":"cpu","downsample_seconds":300}'Endpoint catalog
The catalog below mirrors the SS-02 OpenAPI spec (58 operations total, incl. ops probes). Each group links to its deep-dive with the worked example and architecture context.
Postgres · MySQL · TiDB HTAP · 9 endpoints
/api/v1/claimsbearertenantidempotency-keyDeclare an OLTP SQL claim (engine yugabyte or tidb); provisions the resource, pins a version, mints a Vault credential.
/api/v1/claimsbearertenantList every engine claim owned by the tenant (never the raw credential).
/api/v1/claims/{name}bearertenantFetch one claim by name, tenant-scoped.
/api/v1/claims/{name}/bindingbearertenantDSN + endpoint + Vault secret_ref — the credential-free connect info.
/api/v1/claims/{name}/rotatebearertenantidempotency-keyRotate the credential (new Vault version); DSN unchanged.
/api/v1/claims/{name}/placementbearertenantDeclare placement requirement (dialect + topology); decides target + isolation, enters migrating when moving to TiDB.
/api/v1/claims/{name}/placementbearertenantRead the placement block; ?tables=… serves the Postgres RLS DDL / MySQL discriminator DDL.
/api/v1/claims/{name}/placement/completebearertenantOperator seam: re-bind onto TiDB and revoke every outstanding lease.
/api/v1/claims/{name}bearertenantDeprovision the resource and remove the claim.
Document/KV · Vector · Time-series · 8 endpoints
/api/v1/enginesbearerSupported engines (name→workload class) and per-engine approved versions with EOL dates.
/api/v1/engines/catalogbearerFull ADR-0069 admission catalogue: tier, license class, boundary, tenancy/backup/restore/residency, guidance.
/api/v1/vector-claimsbearertenantidempotency-keyProvision a per-tenant Qdrant collection (name + dimension required).
/api/v1/claims/{name}/docs/{key}bearertenantWrite a document with optimistic concurrency (if_version) and per-item ttl_seconds.
/api/v1/claims/{name}/docs/{key}bearertenantRead a document by key from a document/KV claim.
/api/v1/claims/{name}/docs/{key}bearertenantDelete a document by key with a conditional if_version guard.
/api/v1/claims/{name}/pointsbearertenantIngest a batch of time-series points (ILP lane); each needs series + ts.
/api/v1/claims/{name}/querybearertenantQuery a time-series claim; downsample_seconds>0 returns average buckets, else raw points.
RustFS · buckets · SigV4 wire gateway · 18 endpoints
/api/v1/bucketsbearertenantCreate a bucket (backed by a RustFS claim): versioning, visibility, region.
/api/v1/bucketsbearertenantList the tenant's buckets.
/api/v1/buckets/{bucket}/versioningbearertenantEnable or suspend bucket versioning.
/api/v1/buckets/{bucket}/lifecyclebearertenantSet per-bucket lifecycle rules (expire versions, abort stale uploads).
/api/v1/buckets/{bucket}/objectsbearertenantList objects with prefix + delimiter folder rollup and pagination.
/api/v1/buckets/{bucket}/objects/{key}bearertenantPut an object (control-plane metadata: size, content-type, user metadata).
/api/v1/buckets/{bucket}/versionsbearertenantList object versions (all versions incl. delete markers).
/api/v1/buckets/{bucket}/uploadsbearertenantInitiate a multipart upload; parts via PUT …/uploads/{upload}/parts/{part}.
/api/v1/buckets/{bucket}/uploads/{upload}/completebearertenantComplete a multipart upload (parts present + strictly ascending).
/api/v1/buckets/{bucket}/presignbearertenantPresign a GET or PUT for a key (HMAC over a canonical string, TTL-bounded).
/api/v1/object/access-keysbearertenantIssue an S3 access key (the R2 API token). Secret shown once.
/api/v1/object/access-keysbearertenantList access keys (never returns the secret).
/api/v1/object/presign/verifybearertenantVerify a presigned request (valid within TTL, signature + method match).
/api/v1/object/usagebearertenantTenant-wide usage summary (aggregate across buckets, zero-rated vs billable egress).
/s3/{bucket}aws sigv4S3 CreateBucket — SigV4, tenant from the access key.
/s3/{bucket}aws sigv4S3 ListObjectsV2 (GET Bucket) — real S3 XML.
/s3/{bucket}/{key}aws sigv4S3 PutObject / UploadPart.
/s3/{bucket}/{key}aws sigv4S3 GetObject.
Instant provisioning · PITR branches · CDC · 6 endpoints
/api/v1/claimsbearertenantidempotency-keyInstant provisioning: create + provision a claim and return a ready binding.
/api/v1/claims/{name}/restorebearertenantPITR/branch — restore the source claim as of at into a NEW claim new_name.
/api/v1/claims/{name}/cdcbearertenantCDC pull seam; read forward from ?cursor=, resume from the returned cursor.
/api/v1/claims/{name}/leasesbearertenantIssue a dynamic credential lease (TTL capped at the one-hour ceiling).
/api/v1/claims/{name}/leases/{id}bearertenantValidate a lease engine-side; expired/rotated/foreign leases fail.
/api/v1/claims/{name}/rotatebearertenantidempotency-keyRotate the credential with no downtime; DSN unchanged.
Only-data-plane · placement · Prism boundary · 5 endpoints
/api/v1/claims/{name}/placementbearertenantRead placement + serve the Postgres RLS DDL / MySQL discriminator DDL (?tables=…).
/api/v1/claims/{name}/placementbearertenantDeclare the placement requirement; the policy decides target + isolation.
/api/v1/engines/catalogbearerBoundary + license posture: which engines are operational claims vs Prism-reserved.
/api/v1/claims/{name}/leasesbearertenantVault-held, audit-chained credential lease — the platform's record of access.
/api/v1/object/usagebearertenantMetered usage the SS-60/SS-10 chargeback path reads (zero-rated vs billable).
This is a product lens on the SS-02 contract. The canonical machine-readable spec is services/dbaas/openapi.json; the full endpoint reference is the SS-02 API reference in the platform docs.