Reference

Everything documented here belongs to memnox-runtime, the open-source gate that runs on your own machines. It is Apache-2.0, so every route, flag and command below sits in a repository you can read.

What is not here

The hosted control plane's HTTP API is not published. The console is its interface, and the screens in Operate are how you drive it. Where a page needs you to do something there, it names the screen rather than a route.

Two reasons, and neither is that the routes are secret:

1. It is a private, versioned surface that moves with the product. Publishing it invites integrations against endpoints that will change, and then breaking them.
2. Everything an outside system genuinely needs is already exposed deliberately: outbound webhooks for events, audit sinks for the decision stream, and the runtime API for anything that decides. Those are the supported seams, and they are documented.

If you need programmatic access to the control plane, talk to us about it rather than reverse-engineering the console. An integration we know about is one we can avoid breaking.

Versioning and stability

• Routes are versioned in the path (/v1/…). Adding a field is additive; removing or renaming one is a breaking change.
• Webhook event names follow the same rule, which is why the list is short and grows slowly.
• Policy YAML carries version: 1 at the top of the file.
• The security baseline is stamped with SECURITY_BASELINE_VERSION, so a briefing produced today can be reproduced later.
• Policy sets are identified by content hash, recorded on every audit event as policyVersion.

Conventions used throughout