Deploy-Control API

Last updated: 2026-06-19

This API controls OpenTofu/Terraform execution in Takosumi OSS. It runs existing providers as-is and does not expose compatibility gateway endpoints.

Public Surface

The OSS deploy-control surface is centered on:

Workspace
Project
Capsule
Source
ProviderConnection
ProviderBinding
Secret
Run
StateVersion
Output
AuditEvent

Current code may still expose legacy internal names while migration is underway, but new API docs and UI should project them to the names above.

A Capsule-driven plan Run is the caller contract: clients create or select a Capsule, bind providers through ProviderBindings, create a plan Run, review the saved plan result, then approve an apply or destroy Run against that saved plan/state context.

Minimal API Shape

POST   /projects
GET    /projects/:id

POST   /capsules
GET    /capsules/:id
PATCH  /capsules/:id

POST   /connections
GET    /connections
GET    /connections/:id
DELETE /connections/:id

POST   /runs
GET    /runs/:id
GET    /runs/:id/logs
POST   /runs/:id/approve
POST   /runs/:id/cancel

GET    /state/:capsule_id/versions
GET    /outputs/:capsule_id

POST   /secrets
GET    /audit

Provider Connections

ProviderConnection creation stores credential metadata and encrypted secret references. A Run resolves ProviderBindings to ProviderConnections, evaluates the CredentialRecipe, and injects only temporary env/file material into the runner.

Provider resolution statuses in OSS are:

resolved_provider_connection
blocked_missing_connection
blocked_policy

The response must not include raw secrets, secret references, internal resolver IDs, temporary credentials, or generated credential files.

Runs

A Run records:

source snapshot
tool version
provider lock digest
provider bindings
injected env metadata, not values
plan result
apply result
logs
outputs
state version
actor
timestamps
audit evidence

Secrets are redacted before logs or diagnostics are persisted.

Cloud-Only Exclusions

The OSS API must not expose:

/compat/cloudflare/client/v4
provider-compatible Gateway endpoint routes
official managed resource backend controls
managed edge/storage/container resource APIs
official billing/quota/usage endpoints

Those belong to closed Takosumi Cloud.