Register a signed deployment
const url = 'https://example.com/v1/deployments';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"imageRef":"example","artifactVersion":"example","indexHash":"example","signerKeyId":"example","signerPublicKey":"example","signature":"example","publishedAt":"2026-04-15T12:00:00Z","projectId":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/v1/deployments \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "imageRef": "example", "artifactVersion": "example", "indexHash": "example", "signerKeyId": "example", "signerPublicKey": "example", "signature": "example", "publishedAt": "2026-04-15T12:00:00Z", "projectId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'Atomic transaction: check the signing key against the tenant’s trust list (the signingKeyRegistry binding), verify the Ed25519 signature over the canonical envelope, read the image’s /app/index.json and verify it hashes to the signed indexHash and names the signed artifactVersion (ImageRegistryBinding), validate every tool / guardrail / agent / flow it declares (the image’s index is what registers; the request carries none), upsert into the corresponding registries (in the body’s projectId, one project per client, else the tenant’s Default project), then record the deployment. Where each tool’s secrets are read is recorded on its version (RecordedSecretScope); one set nowhere yet is read where this deployment’s secrets sync writes (POST /v1/deployments/{deploymentId}/secrets), the scope this route needs admin on. All-or-nothing rollback on any failure. Idempotency: same imageDigest re-submitted returns 200 with the existing record (no new version bump). Idempotency-Key also applies at the HTTP layer.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Header Parameters
Section titled “Header Parameters”Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per docs/API-ROUTE-CONVENTIONS.md §3.1). A retry sent while the first request still runs is answered 409 idempotency-key-in-flight with Retry-After, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets 409 idempotency-key-replay-withheld, with the first request’s status and when it succeeded (from 0.1.5).
Request Bodyrequired
Section titled “Request Bodyrequired”object
Full digest-pinned OCI reference: <host>/<repo>@sha256:<hex>.
Issuer-generated YYYYMMDD.N — covered by the signature.
Sha256 of the image’s /app/index.json, byte for byte — covered by the signature. The server reads the file from the image, checks it hashes to this, and registers what it declares.
PEM-encoded Ed25519 public key (-----BEGIN PUBLIC KEY-----\n…). Parsed to raw bytes for verification.
Base64 of the Ed25519 signature over canonicalise({ imageDigest, artifactVersion, indexHash, tenantId, publishedAt }) with sorted keys, no whitespace, UTF-8.
Issuer-supplied ISO-8601 timestamp — covered by the signature.
The project to deploy into, one per client: its agents, flows, tools and guardrails are registered there, and its secret sync writes there. It takes admin on that project (a key limited to another project is refused). Absent: a tenant-wide deploy, into the tenant’s Default project. An id that already lives in another project is 409 (tool-project-mismatch and the like): each client gets its own pack, whose ids carry its own pack id. Not covered by the signature, which attests the image.
Examplegenerated
{ "imageRef": "example", "artifactVersion": "example", "indexHash": "example", "signerKeyId": "example", "signerPublicKey": "example", "signature": "example", "publishedAt": "2026-04-15T12:00:00Z", "projectId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"}Responses
Section titled “Responses”Digest replay — same imageDigest already recorded; returns existing record.
object
Full digest-pinned OCI reference: <host>/<repo>@sha256:<hex>.
Idempotency key. Extracted from imageRef after the @.
Issuer-supplied YYYYMMDD.N — matches what was signed.
Sha256 of the canonicalised /app/index.json inside the image.
Base64 of the raw Ed25519 public key bytes (32 bytes → 44 chars).
Base64 of the raw Ed25519 signature (64 bytes → 88 chars).
Issuer-supplied timestamp inside the signed envelope.
Server-side ledger timestamp — when the register call succeeded.
The project the deploy named, which its primitives were registered into. Absent for a tenant-wide deploy (the tenant’s Default project).
The names the pack service reads from its process environment, as the image’s index.json declares them (env), each list in name order. Names only, never a value. On a deployment: absent when it declares none, and from older servers.
object
Names the pack service needs, set and non-empty, to be ready.
Names the pack reads when present.
When this deployment was made by promoting another into the next environment of its order: the deployment it was promoted from. Absent for one deployed directly.
The pack’s id, from the image’s index. Absent from a runtime that doesn’t keep it.
Its pack service’s status, when the server routes each pack call to the deployment that shipped the tool (KINDGI_PACK_ROUTING=per-deployment). Absent otherwise. pending: no pack service yet, and calls to its tools fail (pack-endpoint-pending) rather than go to another deployment. ready: calls go to its own pack service. cleared: its pack service was taken down, and calls fail (pack-endpoint-cleared); it carries waiting or retired to say whether it comes back. Carries no URL and no token.
object
When the status last changed.
While the deployment waits for a pack service (pending, or cleared and waiting): the last reason recorded while it waited. A ready endpoint has none, nor a retired one. A fixed code, never free text.
object
One of a fixed list; a later runtime may add codes, so treat an unknown one as a reason not yet named. The server refused the endpoint it was given: endpoint-url-invalid (not https, or with user info or a path), endpoint-host-not-allowed (the host isn’t on the operator’s allowlist), endpoint-name-mismatch (the host doesn’t name this deployment’s service), endpoint-unreachable (the pack service didn’t answer), endpoint-info-mismatch (it answered as another pack or version), image-not-allowed (the image is outside the tenant’s repository). The pack service couldn’t be created: tenant-not-provisioned (the tenant has nowhere to run pack services yet), capacity-unavailable (no room for another pack service just now), service-start-failed (the image was deployed but didn’t start). It can’t be given its declared environment (GET /v1/deployments/{deploymentId}/pack-env names the names): pack-env-ambiguous, pack-env-secret-not-yet, pack-env-missing, pack-env-secret-unreadable (a name’s secret can’t be read for a reason the platform fixes, not the owner; it’s tried again). It can’t be given its secrets: pack-env-secrets-unaudited (the runtime has nowhere to audit a secret it gives out; the platform fixes it, and it’s tried again), pack-env-secret-too-large (a secret’s value is over 32768 bytes, the most a pack service can be given), pack-env-secret-capacity (a name is set only as a secret, and there’s no room just now for a pack service that can be given one, apart from other projects’; it’s tried again).
When it was recorded.
cleared only: a pack service is wanted for it again, as once a suspension that took its service down is lifted, and it lists as needing one; problem says why it isn’t back yet. A cleared endpoint carries this or retired, never both. Absent from older servers, which send neither.
cleared only: why no pack service is wanted for it now. superseded is for good: newer deployments ship every tool version and check it does, so no new call reaches it; a tool call a step made on it still goes back to it when the step runs again, and fails closed (pack-endpoint-cleared). tenant-closing, tenant-suspended, project-suspended and pack-suspended last until the tenant, project or pack is restored. A later runtime may add reasons, so treat an unknown one as a reason not yet named. A cleared endpoint carries this or waiting, never both. Absent from older servers, which send neither.
ready only: the pack service runs on the values it was last given, because the newest can’t be given to it (a required one was removed, say, or a secret can’t be given), or didn’t start (pack-env-update-failed). Gone once they can, or do. For a name that can’t be given, GET /v1/deployments/{deploymentId}/pack-env names it. Absent from older servers.
object
Why a ready pack service runs on the values it was last given: a PackEnvProblemCode, so the newest can’t be given to it; pack-env-update-failed: they were given, and its new revision with them didn’t start, so the last ready one serves. That revision is tried again for an hour after it’s first recorded; setting the values again is a new revision, tried again too. The orchestrator couldn’t give it its secrets: pack-env-secrets-unaudited (the runtime has nowhere to audit a secret it gives out, so it gives none; the platform fixes it), pack-env-secret-too-large (a secret’s value is over 32768 bytes, the most a pack service can be given), pack-env-secret-redeploy (a name is now set only as a secret, and this pack service was made where no secret can be given to it; a new deployment’s can be, from a new build of the pack). A service held as pack-env-secret-unreadable or pack-env-secrets-unaudited is listed by GET /v1/system/pack-env every time, with its held, as the revision doesn’t move when the platform fixes it. A later runtime may add codes, so treat an unknown one as a reason not yet named.
When it was recorded.
object
object
object
Absent for guardrails, which have no version.
object
Absent for guardrails, which have no version.
object
The version the agent is registered as.
The version the agent’s or flow’s definition names, present when it differs from version: that version was registered already with other pins or content, and versions never change, so the deploy registered the next free version in its line (or an earlier deploy did).
Why version differs from authoredVersion: pins-changed (a tool or agent it uses has a new version), unpinned (authoredVersion was published before pins existed), version-taken (authoredVersion is registered with other content).
true: this deploy registered version; false: an earlier deploy did.
For pins-changed: the pins that differ from authoredVersion’s.
One pin that differs between two versions of an agent or a flow.
object
The earlier version’s pin; absent when it had none.
The later version’s pin; absent when it has none.
object
The version the agent is registered as.
The version the agent’s or flow’s definition names, present when it differs from version: that version was registered already with other pins or content, and versions never change, so the deploy registered the next free version in its line (or an earlier deploy did).
Why version differs from authoredVersion: pins-changed (a tool or agent it uses has a new version), unpinned (authoredVersion was published before pins existed), version-taken (authoredVersion is registered with other content).
true: this deploy registered version; false: an earlier deploy did.
For pins-changed: the pins that differ from authoredVersion’s.
One pin that differs between two versions of an agent or a flow.
object
The earlier version’s pin; absent when it had none.
The later version’s pin; absent when it has none.
Example
{ "endpoint": { "status": "pending", "waiting": true, "packEnvProblem": { "code": "pack-env-ambiguous" } }, "contents": { "agents": [ { "reason": "pins-changed", "pinChanges": [ { "kind": "tool" } ] } ], "flows": [ { "reason": "pins-changed", "pinChanges": [ { "kind": "tool" } ] } ] }}Deployment registered.
object
Full digest-pinned OCI reference: <host>/<repo>@sha256:<hex>.
Idempotency key. Extracted from imageRef after the @.
Issuer-supplied YYYYMMDD.N — matches what was signed.
Sha256 of the canonicalised /app/index.json inside the image.
Base64 of the raw Ed25519 public key bytes (32 bytes → 44 chars).
Base64 of the raw Ed25519 signature (64 bytes → 88 chars).
Issuer-supplied timestamp inside the signed envelope.
Server-side ledger timestamp — when the register call succeeded.
The project the deploy named, which its primitives were registered into. Absent for a tenant-wide deploy (the tenant’s Default project).
The names the pack service reads from its process environment, as the image’s index.json declares them (env), each list in name order. Names only, never a value. On a deployment: absent when it declares none, and from older servers.
object
Names the pack service needs, set and non-empty, to be ready.
Names the pack reads when present.
When this deployment was made by promoting another into the next environment of its order: the deployment it was promoted from. Absent for one deployed directly.
The pack’s id, from the image’s index. Absent from a runtime that doesn’t keep it.
Its pack service’s status, when the server routes each pack call to the deployment that shipped the tool (KINDGI_PACK_ROUTING=per-deployment). Absent otherwise. pending: no pack service yet, and calls to its tools fail (pack-endpoint-pending) rather than go to another deployment. ready: calls go to its own pack service. cleared: its pack service was taken down, and calls fail (pack-endpoint-cleared); it carries waiting or retired to say whether it comes back. Carries no URL and no token.
object
When the status last changed.
While the deployment waits for a pack service (pending, or cleared and waiting): the last reason recorded while it waited. A ready endpoint has none, nor a retired one. A fixed code, never free text.
object
One of a fixed list; a later runtime may add codes, so treat an unknown one as a reason not yet named. The server refused the endpoint it was given: endpoint-url-invalid (not https, or with user info or a path), endpoint-host-not-allowed (the host isn’t on the operator’s allowlist), endpoint-name-mismatch (the host doesn’t name this deployment’s service), endpoint-unreachable (the pack service didn’t answer), endpoint-info-mismatch (it answered as another pack or version), image-not-allowed (the image is outside the tenant’s repository). The pack service couldn’t be created: tenant-not-provisioned (the tenant has nowhere to run pack services yet), capacity-unavailable (no room for another pack service just now), service-start-failed (the image was deployed but didn’t start). It can’t be given its declared environment (GET /v1/deployments/{deploymentId}/pack-env names the names): pack-env-ambiguous, pack-env-secret-not-yet, pack-env-missing, pack-env-secret-unreadable (a name’s secret can’t be read for a reason the platform fixes, not the owner; it’s tried again). It can’t be given its secrets: pack-env-secrets-unaudited (the runtime has nowhere to audit a secret it gives out; the platform fixes it, and it’s tried again), pack-env-secret-too-large (a secret’s value is over 32768 bytes, the most a pack service can be given), pack-env-secret-capacity (a name is set only as a secret, and there’s no room just now for a pack service that can be given one, apart from other projects’; it’s tried again).
When it was recorded.
cleared only: a pack service is wanted for it again, as once a suspension that took its service down is lifted, and it lists as needing one; problem says why it isn’t back yet. A cleared endpoint carries this or retired, never both. Absent from older servers, which send neither.
cleared only: why no pack service is wanted for it now. superseded is for good: newer deployments ship every tool version and check it does, so no new call reaches it; a tool call a step made on it still goes back to it when the step runs again, and fails closed (pack-endpoint-cleared). tenant-closing, tenant-suspended, project-suspended and pack-suspended last until the tenant, project or pack is restored. A later runtime may add reasons, so treat an unknown one as a reason not yet named. A cleared endpoint carries this or waiting, never both. Absent from older servers, which send neither.
ready only: the pack service runs on the values it was last given, because the newest can’t be given to it (a required one was removed, say, or a secret can’t be given), or didn’t start (pack-env-update-failed). Gone once they can, or do. For a name that can’t be given, GET /v1/deployments/{deploymentId}/pack-env names it. Absent from older servers.
object
Why a ready pack service runs on the values it was last given: a PackEnvProblemCode, so the newest can’t be given to it; pack-env-update-failed: they were given, and its new revision with them didn’t start, so the last ready one serves. That revision is tried again for an hour after it’s first recorded; setting the values again is a new revision, tried again too. The orchestrator couldn’t give it its secrets: pack-env-secrets-unaudited (the runtime has nowhere to audit a secret it gives out, so it gives none; the platform fixes it), pack-env-secret-too-large (a secret’s value is over 32768 bytes, the most a pack service can be given), pack-env-secret-redeploy (a name is now set only as a secret, and this pack service was made where no secret can be given to it; a new deployment’s can be, from a new build of the pack). A service held as pack-env-secret-unreadable or pack-env-secrets-unaudited is listed by GET /v1/system/pack-env every time, with its held, as the revision doesn’t move when the platform fixes it. A later runtime may add codes, so treat an unknown one as a reason not yet named.
When it was recorded.
object
object
object
Absent for guardrails, which have no version.
object
Absent for guardrails, which have no version.
object
The version the agent is registered as.
The version the agent’s or flow’s definition names, present when it differs from version: that version was registered already with other pins or content, and versions never change, so the deploy registered the next free version in its line (or an earlier deploy did).
Why version differs from authoredVersion: pins-changed (a tool or agent it uses has a new version), unpinned (authoredVersion was published before pins existed), version-taken (authoredVersion is registered with other content).
true: this deploy registered version; false: an earlier deploy did.
For pins-changed: the pins that differ from authoredVersion’s.
One pin that differs between two versions of an agent or a flow.
object
The earlier version’s pin; absent when it had none.
The later version’s pin; absent when it has none.
object
The version the agent is registered as.
The version the agent’s or flow’s definition names, present when it differs from version: that version was registered already with other pins or content, and versions never change, so the deploy registered the next free version in its line (or an earlier deploy did).
Why version differs from authoredVersion: pins-changed (a tool or agent it uses has a new version), unpinned (authoredVersion was published before pins existed), version-taken (authoredVersion is registered with other content).
true: this deploy registered version; false: an earlier deploy did.
For pins-changed: the pins that differ from authoredVersion’s.
One pin that differs between two versions of an agent or a flow.
object
The earlier version’s pin; absent when it had none.
The later version’s pin; absent when it has none.
Example
{ "endpoint": { "status": "pending", "waiting": true, "packEnvProblem": { "code": "pack-env-ambiguous" } }, "contents": { "agents": [ { "reason": "pins-changed", "pinChanges": [ { "kind": "tool" } ] } ], "flows": [ { "reason": "pins-changed", "pinChanges": [ { "kind": "tool" } ] } ] }}Signature invalid, image unverifiable, or deployment-validation-failed with per-primitive details[]. When image-unverifiable comes from a failed registry read, details.cause names why: image-not-found, image-file-not-found, image-registry-unreachable, image-registry-unauthorized, image-unreadable (a layer that isn’t a readable archive), or image-limit-exceeded, with the bound in details.limit (manifest, file, layer, read or unpack: the image’s own, so the same image is refused again). The tenant’s hour of image reads passes, so it answers 429. A tool that declares or sends a model provider’s key is one such issue (path /secrets/<name>): a tool never gets a model provider’s key. An agent’s output.schema, or a flow’s loop, fanout branch or subgraph outputSchema or its output.schema, that doesn’t compile is one too (path where it sits, such as /output/schema or /nodes/<i>/branches/<k>/outputSchema), as defineAgent and the flow loader refuse it: every turn or run would. A tool whose metadata has a key under kindgi. (the runtime’s own) is a validation-failed detail at /metadata/<key>. Or reference-out-of-scope: an agent or flow names a tool, agent, flow, guardrail or data block that neither the deployment brings nor its project reaches (details.issues, at /agents/<i>/… or /flows/<i>/…); nothing is registered.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Missing / malformed / expired / revoked bearer token.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Signer key not on the tenant’s trust list. Or, with projectId, no admin on that project (forbidden), or a key limited to another project (key-project-mismatch); without it, no admin on the tenant.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}The body’s projectId names no project of this tenant (project-not-found).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Idempotency-Key was reused with a different body, or resource-state conflict. Or, on a runtime serving many tenants (KINDGI_TENANCY=multi), where each tenant deploys only its own images: image-not-allowed, the image is outside the tenant’s repository (details.imagePrefix, its own), or image-prefix-unset, the tenant has no repository set yet; both are checked before any registry read, and never on a runtime serving one tenant. Or tool-project-mismatch, agent-project-mismatch or flow-project-mismatch: one of the image’s tools, agents or flows belongs to another project (details.primitive, details.id; the message doesn’t name the project); nothing was deployed, even when it was unchanged. Or tool-kind-mismatch: one of the image’s tools has the id of an MCP endpoint’s tool (details.endpointId; details.primitive, details.id), whose active versions are all the endpoint’s; nothing was deployed. Or project-suspended: the project the deploy goes into (the named one, or the Default for a tenant-wide deploy) is suspended, and nothing deploys into it until it’s restored. Or environment-takes-promotions: the project the deploy goes into is a later environment of an environment order, which takes builds only by promotion from the one before it; deploy into the order’s first environment and promote the build from there (details.firstProjectId, when you can read that project; details.position, the project’s place from 0). Nothing is written. Or registry-read-only: this registry takes no writes (under kindgi dev, the pack’s files are the source); the message says what to do instead.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}The request body is over the API’s limit (request-too-large; details.maxBytes says how much).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}rate-limit-exceeded with details.limit: "schema-compile-time", on a server with a compile budget (Kindgi Cloud): this tenant’s schemas spent details.budgetMs compiling in the last 60 seconds. Nothing was stored; Retry-After says when to send it again. Or details.limit: "tenant-unpack-hour", on a server that bounds each tenant’s image reads (Kindgi Cloud): this tenant’s image reads unpacked as much as they may in an hour. Nothing was deployed; Retry-After says when there’s room again.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Server error (unmapped domain code or framework crash).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}See also
GET /v1/deployments: List signed deployments- Kindgi 0.1.9
- Error code
agent-project-mismatch - Error code
environment-takes-promotions - Error code
flow-project-mismatch - Error code
image-not-allowed - Error code
image-prefix-unset - Error code
image-unverifiable - Error code
key-project-mismatch - Error code
project-not-found - Error code
project-suspended - Error code
rate-limit-exceeded - Error code
reference-out-of-scope - Error code
registry-read-only - Error code
request-too-large - Error code
tool-kind-mismatch - Error code
tool-project-mismatch - Error code
validation-failed - Every error code