MSASE MeshSovereign Zero Trust & Mesh

Docs & API

The endpoint catalog, grouped.

Real method + path from each service's openapi.json. Auth is one bearer token plus a tenant header across all 5 groups. Below: the auth model, a curl quickstart, and 79 representative endpoints organised by capability group.

5 services186 operationsOIDC SS-01 bearer auth
Jump to:SS-26 SASE & private accessSS-25 DNS & steeringSS-28 SecOps & threatSS-07 Edge WAF & gatewaySS-06 Mesh observability

Auth model

One token, one tenant header, everywhere.

Every request is governed by an SS-01 OIDC bearer token and an X-Tenant-Id header; external traffic enters only through the SS-07 edge, which validates the JWT and strips inbound claim headers. Mutating money/usage writes carry an Idempotency-Key (ADR-0039); telemetry ingest is deliberately append-only.

auth — bearer + tenant
# Auth is the platform standard everywhere: an SS-01 OIDC bearer token
# plus your tenant header. Money/usage writes also carry an Idempotency-Key.
export TOKEN=...              # from signup / SS-05 API key
export TENANT=acme
H=(-H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: $TENANT" \
   -H "Content-Type: application/json")

# Base URLs — each group is one service; external calls go via the SS-07 edge:
#   SASE & mesh   https://gateway.<region>.nexocloud.io/network/api/v1
#   DNS           .../dns/api/v1     SecOps   .../secops/api/v1
#   Gateway       .../gateway/api/v1 Observ.  .../vrqgo/api/v1
quickstart — mesh → wg-config → UPO
# 1. Create a tenant mesh, enroll a peer by PUBLIC KEY ONLY
curl -sX POST "$BASE/mesh" "${H[@]}" -d '{ "name":"corp","mtu":1420 }'
curl -sX POST "$BASE/mesh/mesh-1/peers" "${H[@]}" \
  -d '{ "name":"laptop","public_key":"kA" }'     # private material → 400

# 2. Pull the zero-knowledge wg-config (no assignable PrivateKey line)
curl -s "$BASE/mesh/mesh-1/peers/peer-1/wg-config" "${H[@]}"

# 3. Author + compile a UPO policy to three enforcement targets
curl -sX POST "$BASE/upo/policy"  "${H[@]}" -d @policy.json
curl -sX POST "$BASE/upo/compile" "${H[@]}" -d '{ "targets":["ztna","sdwan","firewall"] }'
curl -sX POST "$BASE/upo/apply"   "${H[@]}" -d '{ "target":"firewall" }'   # → diff

SS-26 · Network Fabric & SASE · 82 operations

SASE & private access

ZTNA, the sovereign mesh, native WireGuard coordination, SD-WAN and the UPO policy compiler — one fabric. Open the deep-dive →

POST/api/v1/sase/ztna/policiesCreate a ZTNA access policy (default-deny)
GET/api/v1/sase/ztna/policiesList ZTNA access policies
POST/api/v1/sase/ztna/grantEvaluate a ZTNA request and record the session verdict
POST/api/v1/upo/policyAuthor (create/replace) the tenant's unified policy; bumps version
POST/api/v1/upo/policy/validateValidate the current unified policy (fail-closed)
POST/api/v1/upo/compileCompile the policy to target rulesets (ztna|sdwan|firewall)
POST/api/v1/upo/applyApply a compiled target; returns the diff vs the last-applied baseline
GET/api/v1/upo/applied/{target}Get the last-applied compiled config for a target
POST/api/v1/meshCreate a sovereign mesh overlay (SDP control plane)
POST/api/v1/mesh/{id}/peersZero-knowledge peer enrollment (public key only; private material rejected)
GET/api/v1/mesh/{id}/peers/{device}/netmapGenerate the peer's WireGuard netmap (datapath instruction set)
GET/api/v1/mesh/{id}/peers/{device}/wg-configExport a zero-knowledge wg-quick config (no private key)
GET/api/v1/mesh/{id}/peers/{device}/coordNative coordination poll (delta-driven Headscale map-poll replacement)
POST/api/v1/mesh/{id}/peers/{device}/rekeySeamless mesh-wide re-key: rotate a peer's WireGuard public key
POST/api/v1/mesh/{id}/peers/{device}/connectivityCompute a NAT-traversal plan (direct or DERP relay fallback)
GET/api/v1/mesh/{id}/deltasPull topology deltas since a cursor
POST/api/v1/sdwan/tunnelsCreate an SD-WAN overlay tunnel
POST/api/v1/sdwan/steerCompute an app-aware steering decision for a tunnel
POST/api/v1/tailnet/devicesEnroll a device into the tenant tailnet (approval required)
PUT/api/v1/tailnet/aclSet the tailnet ACL/policy (ACLs + posture rules)
POST/api/v1/sase/dlp/profilesSet a DLP inspection profile
POST/api/v1/emulation/labs/{lab}/validateValidate a proposed change against the emulated topology

SS-25 · Global DNS & Traffic Steering · 14 operations

DNS & traffic steering

Authoritative DNS, GeoDNS steering, health-checked answers and a DNSSEC ceremony — the resolution layer under the mesh. Open the deep-dive →

GET/api/v1/zonesList the tenant's authoritative zone names
POST/api/v1/zonesCreate an authoritative zone
POST/api/v1/zones/{zone}/recordsAdd a record to a zone
PUT/api/v1/zones/{zone}/rrsetsUpsert an RRset
POST/api/v1/zones/{zone}/publishPublish the zone
GET/api/v1/zones/{zone}/answerCompute a steered, health-weighted answer
GET/api/v1/zones/{zone}/resolveResolve a name within the zone
POST/api/v1/zones/{zone}/dnssec/initInitialise DNSSEC for the zone
POST/api/v1/zones/{zone}/dnssec/ceremonyRun a DNSSEC signing ceremony
POST/api/v1/zones/{zone}/dnssec/rotate-zskRotate the zone-signing key
POST/api/v1/health/{target}Report a target health check for steering
POST/api/v1/distribution/haltHalt zone distribution (safety brake)
POST/api/v1/distribution/resumeResume zone distribution
GET/api/v1/sloRead the DNS service SLO

SS-28 · SecOps & Threat Detection · 56 operations

SecOps & threat detection

Detections-as-code, guard-railed containment, threat intel, and the Zeek mesh chaos-rig auditor. Open the deep-dive →

POST/api/v1/zeek/leak-auditAudit a mesh control-plane session for a zero-knowledge leak (HIGH finding)
GET/api/v1/zeek/leak-auditList mesh control-plane leak-audit results
POST/api/v1/zeek/mtu-profileProfile mesh transit MTU/fragmentation (MEDIUM finding outside the clamp)
GET/api/v1/zeek/coverageNetwork-monitoring coverage by segment
POST/api/v1/zeek/sensorsRegister a Zeek network sensor on a segment/tap
POST/api/v1/zeek/noticesIngest a Zeek notice (raises a network finding)
POST/api/v1/zeek/intel-matchMatch a Zeek Intel-framework observation against feeds
POST/api/v1/rulesPublish a detection rule (append-versioned)
POST/api/v1/rules/{id}/reenableRe-enable an auto-disabled rule
POST/api/v1/eventsIngest a detection event
GET/api/v1/findings/{id}Get a finding
GET/api/v1/cases/{id}Get a case with evidence + enrichment
POST/api/v1/cases/{id}/containmentsCreate a containment on a case
POST/api/v1/containments/{id}/approveApprove a containment (dual-control)
POST/api/v1/containments/{id}/executeExecute an approved containment
POST/api/v1/intel/screenScreen an observable against intel feeds
POST/api/v1/huntsStart a threat hunt
POST/api/v1/hunts/{id}/promotePromote a hunt to a standing rule
POST/api/v1/cde/assessmentRun a CDE segmentation assessment

SS-07 · API Gateway · 8 operations

Edge WAF & gateway

The Envoy edge in front of the whole fabric: TLS, JWT, WAF, rate-limits, routes and weighted canaries. Open the deep-dive →

POST/api/v1/admitProbe whether a path is admissible for the tenant (route + rate limit)
GET/api/v1/routesList edge routes
POST/api/v1/routesPublish an edge route
POST/api/v1/routes/weightsShift traffic weight across routes (canary/cutover)
POST/api/v1/entitlementsSet the per-tenant entitlement-driven rate limit
POST/api/v1/webhooks/providersRegister a webhook provider
GET/api/v1/edge/{rest...}Live data-plane proxy (verify JWT, strip claims, admit, proxy)
POST/api/v1/webhook/{provider}Live provider webhook ingress

SS-06 · VRQGO Observability & APM · 26 operations

Mesh observability & APM

Metrics, logs, traces, SLOs with burn-rate routing, synthetic probes and the signed audit index for the whole fabric. Open the deep-dive →

POST/api/v1/metricsIngest a metric sample (OTLP/agent write path)
POST/api/v1/logsIngest a log record
GET/api/v1/logsQuery the Quickwit log index
POST/api/v1/slosDefine an SLO
GET/api/v1/slos/{name}/burnRead an SLO's burn rate
PUT/api/v1/slos/{name}/alert-bindingBind an alert to an SLO
POST/api/v1/slos/{name}/evaluate-and-routeEvaluate an SLO and route the alert
POST/api/v1/probesRegister a synthetic probe
POST/api/v1/probes/{id}/resultsPost a synthetic probe result
POST/api/v1/channelsRegister an alert channel
GET/api/v1/incidentsList incidents
GET/api/v1/dispatchesList alert dispatches
POST/api/v1/audit-eventsAppend a signed audit event
GET/api/v1/audit-eventsQuery the signed audit index
GET/api/v1/audit-latencyRead audit-chain write latency
POST/api/v1/llm/tracesIngest an LLM trace

Beyond this catalog

The full contracts live in the platform reference.

This page is a curated, representative slice. The complete machine-readable contracts are each service's openapi.json, with granular method · path · parameters · request/response examples in the platform API reference (docs/product/api-reference/SS-26-network.md and its siblings). SDK and CLI clients (the wg-node-agentincluded) coordinate on the same governed routes.