ReferenceAPIs
APIs
Every HTTP and RPC surface in Ionize
This sub-section catalogs every API surface in Ionize. Most pages are generated; this overview is hand-written.
What's documented and how
| Service | Surface | Generation |
|---|---|---|
| Ory Kratos (CIAM + IAM) | Public + Admin REST | Phase 3, generated from upstream Ory OpenAPI spec, plus a hand-written deltas page documenting Ionize-specific defaults |
| Ory Hydra (CIAM + IAM) | Public + Admin REST | Phase 3, generated from dashboard/openapi.json, plus deltas |
| Dashboard | REST API under /api/* | Phase 3, generated from dashboard/src/app/api/**/route.ts AST |
| SDK | TypeScript exports | Phase 3, generated via TypeDoc from sdk/src/index.ts |
| Site | OAuth2 playground routes | Phase 3, small surface, hand-written |
| Deploy MCP | JSON-RPC 2.0 tools | Phase 3, generated from deploy/src-tauri/src/mcp/tools.rs |
Authentication summary
| Surface | Auth |
|---|---|
| Kratos Public | Session cookie or token (per flow type) |
| Kratos Admin | Network ACL only, must be firewalled to localhost/intranet |
| Hydra Public | OAuth2 token (per endpoint) or unauthenticated (discovery, JWKS) |
| Hydra Admin | Network ACL only, must be firewalled |
| Dashboard | dashboard-session HMAC cookie, role check on admin routes |
| SDK | Library, not network, no auth boundary |
| MCP | Localhost only, no network exposure |
See Dashboard API Authentication for the Dashboard auth chain in full detail.
Already available
While the generated pages land in Phase 3, the hand-written Dashboard reference is complete: