How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

ControlUp Tenants API

The Tenants API from ControlUp — 23 operation(s) for tenants.

ControlUp Tenants API is one of 61 APIs that ControlUp publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Tenants. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 31 operations across 23 paths, and defines 42 schemas. It is described by OpenAPI 3.2.0, at version v1.

Requests are made against a single base URL, https://api.controlup.com/daas-iq/v1.

31 operations 23 paths 42 schemas 2 DELETE13 GET2 PATCH12 POST2 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
v1
Base URL
https://api.controlup.com/v1
Authentication
HTTP Bearer, API Key
Resource Areas
1

Authentication & Security 2

ControlUp Tenants API declares 2 security schemes for authenticating requests. It accepts HTTP bearer tokens (JWT) (BearerAuth). An API key is passed in the cookie as user_dex_token (CookieAuth).

  • BearerAuth — API Key Authentication (Recommended) [Learn how to create an API key](https://api.controlup.io/reference/how-to-create-api-keys).
  • CookieAuth — Cookie Authentication (Browser use) ⚠️ The 'Authorize' button cannot set cookies due to browser security. To authenticate in browser: 1. Login via DEX authenti…

Paths & Operations 31

Across 23 paths, the API surfaces 31 operations — 2 DELETE, 13 GET, 2 PATCH, 12 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.

Tenants 31
GET
/cloud/tenants/{tenantId}/credentials
Get tenant credentials
GetTenantCredentials 1 param → 200401402403404500503
POST
/cloud/tenants/{tenantId}/credentials
Add a credential
AddTenantCredential 1 param body → 201400401402403404500503
GET
/cloud/tenants/{tenantId}/credentials/{credentialId}
Get a credential by ID
GetTenantCredential 2 params → 200401402403404500503
PUT
/cloud/tenants/{tenantId}/credentials/{credentialId}
Update a credential
UpdateTenantCredential 2 params body → 200400401402403404500503
PATCH
/cloud/tenants/{tenantId}/credentials/{credentialId}
Patch a credential
PatchTenantCredential 2 params body → 200400401402403404500503
DELETE
/cloud/tenants/{tenantId}/credentials/{credentialId}
Delete a credential
DeleteTenantCredential 2 params → 204400401402403404500503
POST
/cloud/tenants/{tenantId}/credentials/{credentialId}/enable
Enable a credential
EnableTenantCredential 2 params → 200401402403404500503
POST
/cloud/tenants/{tenantId}/credentials/{credentialId}/disable
Disable a credential
DisableTenantCredential 2 params → 200400401402403404500503
GET
/cloud/tenants/{tenantId}/credentials/status
Get credentials status
GetTenantCredentialsPoolStatus 1 param → 200401402403404500503
GET
/cloud/tenants/{tenantId}/credentials/{credentialId}/status
Get credential status
GetTenantCredentialStatus 2 params → 200401402403404500503
POST
/cloud/tenants/{tenantId}/credentials/verify
Verify default credentials
VerifyTenantDefaultCredentials 1 param → 200400401402403404500503
POST
/cloud/tenants/{tenantId}/credentials/{credentialId}/verify
Verify a credential by ID
VerifyTenantCredential 2 params → 200400401402403404500503
POST
/cloud/tenants/{tenantId}/credentials/verify/transcript
Verify default credentials (transcript)
VerifyTenantDefaultCredentialsTranscript 1 param → 200400401402403404500503
POST
/cloud/tenants/{tenantId}/credentials/{credentialId}/verify/transcript
Verify a credential by ID (transcript)
VerifyTenantCredentialTranscript 2 params → 200400401402403404500503
GET
/cloud/tenants/{tenantId}/credentials/verify/streamdeprecated
Verify default credentials - streaming (Deprecated)
1 param → 101200400401402403404500
GET
/cloud/tenants/{tenantId}/credentials/{credentialId}/verify/streamdeprecated
Verify a credential by ID - streaming (Deprecated)
2 params → 101200400401402403404500
POST
/cloud/tenants/{tenantId}/credentials/verify/sse
Verify default credentials - streaming
1 param → 200400401402403404500503
POST
/cloud/tenants/{tenantId}/credentials/{credentialId}/verify/sse
Verify a credential by ID - streaming
2 params → 200400401402403404500503
GET
/cloud/tenants/{tenantId}/discover/subscriptions
Discover subscriptions accessible by tenant's default credentials
DiscoverTenantSubscriptions 4 params → 200400401402403404422500
GET
/cloud/tenants/{tenantId}/discover/resources
Discover resources across subscriptions in a tenant
DiscoverTenantResources 7 params → 200400401402403404422500
GET
/cloud/tenants/{tenantId}/discover/resources/hostpools
Discover host pools across all subscriptions in a tenant
DiscoverTenantHostPools 5 params → 200400401402403404422500
GET
/cloud/tenants/{tenantId}/discover/resources/imagesdeprecated
Discover images across all subscriptions in a tenant (Deprecated)
DiscoverTenantImages 4 params → 200400401402403404422500
POST
/cloud/tenants/{tenantId}/resources/import
Import cloud resources for a tenant
ImportTenantResources 1 param body → 201400401402403404500503
GET
/cloud/tenants
Get tenants
GetTenants 1 param → 200400401402403500503
POST
/cloud/tenants
Create a new tenant with default credential
CreateTenant body → 201400401402403409500503
GET
/cloud/tenants/{id}
Get a tenant by ID
GetTenant 1 param → 200400401402403404500503
PUT
/cloud/tenants/{id}
Update an existing tenant
UpdateTenant 1 param body → 200400401402403404500503
PATCH
/cloud/tenants/{id}
Partially update a tenant
PatchTenant 1 param body → 200400401402403404500503
DELETE
/cloud/tenants/{id}
Delete a tenant
DeleteTenant 1 param → 204401402403404500503
GET
/cloud/tenants/{id}/status
Get tenant status
GetTenantStatus 2 params → 200400401402403404500503
POST
/cloud/tenants/{id}/status/refresh
Refresh tenant status
RefreshTenantStatus 2 params → 200400401402403404500503

Schemas 42

The contract defines 42 schemas that model the data the API accepts and returns. The most detailed are DiscoveredImageDto (25 properties), CredentialStatusDto (13 properties), TenantSubscriptionStatusDto (13 properties), CloudTenantDto (12 properties). Each schema is shown below with its type and property counts.

VerificationStepResponse
object
Response DTO representing a single verification step result. Each step contains information about a specific check performed during credential verification.
5 properties 4 required
UpdateCloudCredentialRequest
object
Request model for updating a cloud credential.
2 properties 2 required
DiscoveredManagedCloudResourceDtoPagedResultDto
object
Generic paginated response wrapper for API endpoints. Supports traditional page-based navigation with forward/backward capability.
6 properties 5 required
PatchCloudCredentialRequest
object
Request model for patching (partial update) a cloud credential. All fields are optional - only provided fields will be updated.
2 properties
DiscoveredImageDtoPagedResultDto
object
Generic paginated response wrapper for API endpoints. Supports traditional page-based navigation with forward/backward capability.
6 properties 5 required
CloudCredentialDto
object
Response DTO representing a cloud credential (Service Principal, IAM User/Role, etc.).
10 properties 8 required
TenantHealthStatus
string
Aggregated health status for a cloud tenant. Computed from subscription health statuses and credential verification results.
TenantSubscriptionImportDto
object
Represents a subscription and its resources to import.
2 properties 2 required
ImageSourceType
string
Represents the source type of a virtual machine image.
JobCreatedDto
object
Lightweight response returned when a job is created. Contains only essential information needed to track the job. Use the statusUrl to poll for updates and job…
7 properties 7 required
VerificationStatus
string
Represents the status of a verification check (credentials, inventory sync, etc.).
DiscoveredSubscriptionDto
object
Represents a subscription discovered from a cloud tenant.
8 properties 8 required
CreateCloudCredentialRequest
object
Request model for creating a new cloud credential.
2 properties 2 required
VerificationStepStatus
string
Discrete states a verification step can finish in.
JobType
string
Defines the types of background jobs supported by the system. Each job type is processed by a specific worker and has its own parameter structure.
ErrorResponse
object
Standard error body the API returns when a request fails validation or cannot be completed. Follows RFC 7807 Problem Details with additional errors and traceId…
7 properties 3 required
DiscoveredManagedCloudResourceDto
object
Represents a discovered cloud resource with managed status. Used by the generic multi-type discover endpoint where resources may be already imported.
9 properties 9 required
DiscoveredHostPoolDtoPagedResultDto
object
Generic paginated response wrapper for API endpoints. Supports traditional page-based navigation with forward/backward capability.
6 properties 5 required
SubscriptionHealthStatus
string
Operational health status of an active cloud subscription. Only meaningful when SubscriptionLifecycleState = Active. Derived from last verification and invento…
ResourceImportMode
string
Defines how a resource import treats managed resources omitted from the import request.
ImportTenantResourcesRequest
object
Request model for importing cloud resources at the tenant level. Supports two modes: 1. Import ALL resources from ALL subscriptions under the tenant (importAll…
3 properties
DiscoveredSubscriptionDtoPagedResultDto
object
Generic paginated response wrapper for API endpoints. Supports traditional page-based navigation with forward/backward capability.
6 properties 5 required
UpdateCloudTenantRequest
object
Request model for updating a cloud tenant. Allows updating tenant name and optionally replacing the default credential.
2 properties 1 required
DiscoveredHostPoolDto
object
Represents a discovered Azure Virtual Desktop host pool. Extends the base CloudResourceDto with host pool-specific properties.
9 properties 9 required
CreateCloudTenantRequest
object
Request model for creating a new cloud tenant with its default credential. The default credential is created as a separate entity linked to the tenant.
4 properties 4 required
CloudResourceIdsByTypeDto
object
Represents a collection of resource IDs for a specific resource type.
2 properties 2 required
CloudTenantDto
object
Response DTO representing a cloud tenant (Azure AD Tenant, AWS Organization, GCP Organization).
12 properties 10 required
VmSecurityType
string
Security profile for Azure VMs.
CloudProviderAuthType
string
Specifies the supported authentication types for connecting to various cloud providers and services.
TenantSubscriptionStatusDto
object
Subscription status details within a tenant status response. Includes subscription identity and full status information.
13 properties 5 required
DiscoverableResourceType
string
Public API enum for resource types that users can discover/import. Only includes high-level resource types exposed to end users.
HostPoolType
string
Represents the type of Azure Virtual Desktop host pool.
VerificationTranscriptResponse
object
Generic response for operations that produce formatted line-by-line output. Can be used for validations, diagnostics, migrations, deployments, or any operation…
2 properties 2 required
CredentialStatus
string
Status of an individual credential. Used for rate limiting, health tracking, and administrative state.
VerificationResponse
object
Response containing detailed results of a credential verification operation. Includes overall success status, individual step results, and timing information.
5 properties 4 required
CloudTenantStatusDto
object
Status information for a cloud tenant. Used when querying tenant status directly (e.g., GET /tenants/{id}/status). Provides aggregated health status computed f…
5 properties 1 required
DiscoveredImageDto
object
Represents a discovered virtual machine image. Extends the base CloudResourceDto with image-specific properties.
25 properties 10 required
TenantDefaultCredentialDto
object
Simplified response DTO for a tenant's default credential (nested within CloudTenantDto). Contains only authentication type and masked credentials. For full cr…
2 properties 2 required
TenantLifecycleState
string
Lifecycle state of a cloud tenant. Represents the tenant's position in the management workflow.
CredentialStatusDto
object
Response DTO representing the pool status of a credential. Includes health status, cooldown state, and usage metrics from Redis.
13 properties 9 required
PatchCloudTenantRequest
object
Request model for patching (partial update) a cloud tenant. All fields are optional - only provided fields will be updated.
2 properties
CloudProvider
string
Enumeration of supported cloud provider identifiers.

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

controlup-tenants-api-openapi.yml Raw ↑

Other APIs ControlUp publishes across the network.

ControlUp MCP Server
ControlUp Alerts API
ControlUp Alerts - Devices API
ControlUp Applications API
ControlUp Audit Log API
ControlUp Cloud providers API
ControlUp Dal API
ControlUp Data API
ControlUp Devices API
ControlUp Dynamic Query API API
ControlUp Events API
ControlUp Features API
Where this information came from

This is an independent, third-party profile of ControlUp Tenants API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.