Stacklok workloads API
The workloads API from Stacklok — 13 operation(s) for workloads.
Stacklok workloads API is one of 13 APIs that Stacklok publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Workloads. The published artifact set on APIs.io includes an OpenAPI specification.
This API exposes 15 operations across 13 paths, and defines 71 schemas. It is described by OpenAPI 3.2.0, at version 0.1.
15 operations
13 paths
71 schemas
1 DELETE6 GET8 POST
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 1
Stacklok workloads API declares
1 security scheme
for authenticating requests.
An API key is passed in the header as Authorization (BearerAuth).
BearerAuth— OAuth 2.0 Bearer token authentication. Format: "Bearer {token}"
Paths & Operations 15
Across 13 paths, the API surfaces 15 operations — 1 DELETE, 6 GET, 8 POST. Each is listed below with its method, path, parameters, and response codes.
workloads 15
GET
/api/v1beta/workloads
List all workloads
POST
/api/v1beta/workloads
Create a new workload
DELETE
/api/v1beta/workloads/{name}
Delete a workload
GET
/api/v1beta/workloads/{name}
Get workload details
POST
/api/v1beta/workloads/{name}/edit
Update workload
GET
/api/v1beta/workloads/{name}/export
Export workload configuration
POST
/api/v1beta/workloads/{name}/restart
Restart a workload
GET
/api/v1beta/workloads/{name}/status
Get workload status
POST
/api/v1beta/workloads/{name}/stop
Stop a workload
POST
/api/v1beta/workloads/{name}/upgrade
Apply an available upgrade to a workload
GET
/api/v1beta/workloads/{name}/upgrade-check
Check a workload for an available upgrade
POST
/api/v1beta/workloads/delete
Delete workloads in bulk
POST
/api/v1beta/workloads/restart
Restart workloads in bulk
POST
/api/v1beta/workloads/stop
Stop workloads in bulk
GET
/api/v1beta/workloads/upgrade-check
Check workloads for available upgrades
Schemas 71
The contract defines 71 schemas that model the data the API accepts and returns. The most detailed are github_com_stacklok_toolhive_pkg_runner.RunConfig (59 properties), pkg_api_v1.createRequest (27 properties), github_com_stacklok_toolhive_pkg_auth_remote.Config (26 properties), pkg_api_v1.updateRequest (24 properties). Each schema is shown below with its type and property counts.
github_com_stacklok_toolhive_pkg_ratelimit_types.ToolRateLimitConfig
object
3 properties
github_com_stacklok_toolhive_pkg_authserver.SigningKeyRunConfig
object
SigningKeyConfig configures the signing key provider for JWT operations. If nil or empty, an ephemeral signing key will be auto-generated (development only).
3 properties
github_com_stacklok_toolhive_pkg_runner.HeaderForwardConfig
object
HeaderForward contains configuration for injecting headers into requests to remote servers.
2 properties
permissions.Profile
object
Permission profile to apply
5 properties
github_com_stacklok_toolhive_pkg_authserver.DCRUpstreamConfig
object
DCRConfig enables RFC 7591 Dynamic Client Registration against the upstream authorization server. When set, the client credentials are obtained at runtime rath…
6 properties
pkg_api_v1.bulkOperationRequest
object
2 properties
github_com_stacklok_toolhive_pkg_container_runtime.WorkloadStatus
string
Current status of the workload
github_com_stacklok_toolhive_pkg_workloads_upgrade.StringChange
object
PermissionProfile is set when the candidate's permission profile differs from the workload's current profile.
2 properties
github_com_stacklok_toolhive_pkg_authserver_storage.ACLUserRunConfig
object
ACLUserConfig contains ACL user authentication configuration.
2 properties
github_com_stacklok_toolhive_pkg_authserver.OAuth2UpstreamRunConfig
object
OAuth2Config contains OAuth 2.0-specific configuration. Required when Type is "oauth2", must be nil when Type is "oidc".
14 properties
pkg_api_v1.upgradeRequest
object
Request to apply an available upgrade to a workload. All fields are optional; an empty body applies the upgrade preserving the workload's existing configuratio…
2 properties
pkg_api_v1.updateRequest
object
Request to update an existing workload (name cannot be changed)
24 properties
registry.Header
object
6 properties
github_com_stacklok_toolhive_pkg_authserver.TokenLifespanRunConfig
object
TokenLifespans configures the duration that various tokens are valid. If nil, defaults are applied (access: 1h, refresh: 7d, authCode: 10m).
3 properties
github_com_stacklok_toolhive_pkg_ignore.Config
object
IgnoreConfig contains configuration for ignore processing
2 properties
github_com_stacklok_toolhive_pkg_workloads_upgrade.EnvVarInfo
object
5 properties
github_com_stacklok_toolhive_pkg_authserver_storage.RedisTLSRunConfig
object
SentinelTLS configures TLS for Sentinel connections. Only applies when SentinelConfig is set.
2 properties
github_com_stacklok_toolhive_pkg_authserver.UpstreamProviderType
string
Type specifies the provider type: "oidc" or "oauth2".
github_com_stacklok_toolhive_pkg_oauthproto_tokenexchange.Config
object
TokenExchangeConfig contains token exchange configuration for external authentication
8 properties
github_com_stacklok_toolhive_pkg_webhook.FailurePolicy
string
FailurePolicy determines behavior when the webhook call fails.
pkg_api_v1.oidcOptions
object
OIDC configuration options
7 properties
github_com_stacklok_toolhive_pkg_authserver.TokenResponseMappingRunConfig
object
TokenResponseMapping configures custom field extraction from non-standard token responses. When set, the token exchange bypasses golang.org/x/oauth2 and extrac…
4 properties
pkg_api_v1.headerForwardConfig
object
HeaderForward configures headers to inject into requests to remote MCP servers. Use this to add custom headers like X-Tenant-ID or correlation IDs.
2 properties
permissions.InboundNetworkPermissions
object
Inbound defines inbound network permissions
1 property
github_com_stacklok_toolhive_pkg_transport_types.MiddlewareConfig
object
2 properties
github_com_stacklok_toolhive_pkg_auth_awssts.RoleMapping
object
4 properties
github_com_stacklok_toolhive_pkg_workloads_upgrade.ConfigDrift
object
ConfigDrift describes posture differences (transport, permission profile) between the workload and the candidate registry entry.
2 properties
github_com_stacklok_toolhive_pkg_authserver.UpstreamRunConfig
object
4 properties
github_com_stacklok_toolhive_pkg_authserver.UserInfoFieldMappingRunConfig
object
FieldMapping contains custom field mapping configuration for non-standard providers. If nil, standard OIDC field names are used ("sub", "name", "email").
3 properties
github_com_stacklok_toolhive_pkg_telemetry.Config
object
DEPRECATED: Middleware configuration. TelemetryConfig contains the OpenTelemetry configuration
13 properties
github_com_stacklok_toolhive_pkg_auth_remote.Config
object
RemoteAuthConfig contains OAuth configuration for remote MCP servers
26 properties
pkg_api_v1.upgradeCheckBulkResponse
object
Results of checking multiple workloads for available upgrades
1 property
github_com_stacklok_toolhive_pkg_auth_upstreamswap.Config
object
UpstreamSwapConfig contains configuration for upstream token swap middleware. When set along with EmbeddedAuthServerConfig, this middleware exchanges ToolHive…
3 properties
github_com_stacklok_toolhive_pkg_runner.RunConfig
object
59 properties
pkg_api_v1.remoteOAuthConfig
object
OAuth configuration for remote server authentication
12 properties
pkg_api_v1.toolOverride
object
Tool override
2 properties
pkg_api_v1.upgradeCheckResponse
object
Result of checking a single workload for an available upgrade
1 property
github_com_stacklok_toolhive_pkg_authserver.RunConfig
object
EmbeddedAuthServerConfig contains configuration for the embedded OAuth2/OIDC authorization server. When set, the proxy runner will start an embedded auth serve…
15 properties
github_com_stacklok_toolhive_pkg_audit.Config
object
DEPRECATED: Middleware configuration. AuditConfig contains the audit logging configuration
9 properties
github_com_stacklok_toolhive_pkg_webhook.TLSConfig
object
TLSConfig holds optional TLS configuration (CA bundles, client certs).
4 properties
v1.Duration
object
RefillPeriod is the duration to fully refill the bucket from zero to maxTokens. The effective refill rate is maxTokens / refillPeriod tokens per second. Format…
github_com_stacklok_toolhive_pkg_runner.SessionRedisConfig
object
SessionRedis holds non-sensitive Redis connection parameters for distributed session storage. Populated only when MCPServer.spec.sessionStorage.provider == "re…
3 properties
github_com_stacklok_toolhive_pkg_authserver_storage.RedisRunConfig
object
RedisConfig is the Redis-specific configuration when Type is "redis".
11 properties
pkg_api_v1.createWorkloadResponse
object
Response after successfully creating a workload
2 properties
github_com_stacklok_toolhive_pkg_workloads_upgrade.CheckResult
object
Result is the upgrade-check outcome for the workload. It carries only metadata (status, image references, drift) and never secret values.
8 properties
pkg_api_v1.createRequest
object
Request to create a new workload
27 properties
github_com_stacklok_toolhive_pkg_container_templates.RuntimeConfig
object
RuntimeConfig allows overriding the default runtime configuration for this specific workload (base images and packages)
3 properties
github_com_stacklok_toolhive_cmd_thv-operator_api_v1beta1.RateLimitConfig
object
RateLimitConfig contains the CRD rate limiting configuration. When set, rate limiting middleware is added to the proxy middleware chain.
3 properties
github_com_stacklok_toolhive_pkg_authz.Config
object
DEPRECATED: Middleware configuration. AuthzConfig contains the authorization configuration
2 properties
github_com_stacklok_toolhive_pkg_runner.ToolOverride
object
2 properties
github_com_stacklok_toolhive_pkg_transport_types.TransportType
string
Transport is the transport mode (stdio, sse, or streamable-http)
github_com_stacklok_toolhive_pkg_authserver.UserInfoRunConfig
object
UserInfo contains configuration for fetching user information. Optional: when nil, the upstream OAuth2 provider derives a deterministic subject by SHA-256-hash…
4 properties
github_com_stacklok_toolhive_pkg_authserver.IdentityFromTokenRunConfig
object
IdentityFromToken extracts user identity (subject, name, email) directly from the OAuth2 token-endpoint response body using gjson dot-notation paths. When set,…
3 properties
github_com_stacklok_toolhive_pkg_secrets.SecretParameter
object
Bearer token for authentication (alternative to OAuth)
2 properties
github_com_stacklok_toolhive_pkg_core.Workload
object
14 properties
permissions.OutboundNetworkPermissions
object
Outbound defines outbound network permissions
3 properties
github_com_stacklok_toolhive_pkg_workloads_upgrade.EnvVarDrift
object
EnvVarDrift describes environment variables the candidate registry entry declares that differ from the workload's current configuration.
2 properties
github_com_stacklok_toolhive_pkg_authserver.CIMDRunConfig
object
CIMD controls clientid metadata document support. When enabled, the embedded authorization server accepts HTTPS URLs as clientid values and resolves them via t…
3 properties
permissions.NetworkPermissions
object
Network defines network permissions
3 properties
pkg_api_v1.workloadStatusResponse
object
Response containing workload status information
1 property
github_com_stacklok_toolhive_pkg_runner.ScalingConfig
object
ScalingConfig contains configuration for horizontal scaling of the proxy runner. Only applicable when running in Kubernetes with the ToolHive operator. When ni…
2 properties
github_com_stacklok_toolhive_pkg_workloads_upgrade.UpgradeStatus
string
Status is the upgrade status for the workload.
github_com_stacklok_toolhive_pkg_auth_awssts.Config
object
AWSStsConfig contains AWS STS token exchange configuration for accessing AWS services
8 properties
pkg_api_v1.workloadListResponse
object
Response containing a list of workloads
1 property
github_com_stacklok_toolhive_pkg_webhook.Config
object
6 properties
github_com_stacklok_toolhive_pkg_authserver_storage.SentinelRunConfig
object
SentinelConfig contains Sentinel-specific configuration. Mutually exclusive with Addr.
3 properties
github_com_stacklok_toolhive_pkg_authserver.OIDCUpstreamRunConfig
object
OIDCConfig contains OIDC-specific configuration. Required when Type is "oidc", must be nil when Type is "oauth2".
11 properties
github_com_stacklok_toolhive_pkg_authserver_storage.RunConfig
object
Storage configures the storage backend for the auth server. If nil, defaults to in-memory storage.
2 properties
github_com_stacklok_toolhive_pkg_ratelimit_types.RateLimitBucket
object
PerUser token bucket configuration for this tool. +optional
2 properties
github_com_stacklok_toolhive_pkg_transport_types.ProxyMode
string
ProxyMode is the effective HTTP protocol the proxy uses. For stdio transports, this is the configured mode (sse or streamable-http). For direct transports (sse…
github_com_stacklok_toolhive_pkg_auth.TokenValidatorConfig
object
DEPRECATED: Middleware configuration. OIDCConfig contains OIDC configuration
12 properties
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from Stacklok 12
Other APIs Stacklok publishes across the network.
Stacklok clients API
Stacklok discovery API
Stacklok groups API
Stacklok logs API
Stacklok registry API
Stacklok registry-servers API
Stacklok registry-skills API
Stacklok secrets API
Stacklok skills API
Stacklok system API
Stacklok v1 API
Stacklok version API
#Workloads
Where this information came from
This is an independent, third-party profile of Stacklok workloads API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.