The OpenDSC Pull Server exposes a REST API at version v1 for managing nodes,
configurations,
parameters, and compliance reports. All API endpoints are prefixed with
/api/v1/ unless otherwise
noted.
Scalar API Documentation
Scalar is an interactive API documentation and API tester. To enable it, set
the ASPNETCORE_ENVIRONMENT environment variable to Development and restart
the server.
$env:ASPNETCORE_ENVIRONMENT='Development'
exportASPNETCORE_ENVIRONMENT=Development
Note
If OpenDSC is running as a Windows service, set ASPNETCORE_ENVIRONMENT
at the service level or machine level and then restart the service.
The service registry key is:
HKLM:\SYSTEM\CurrentControlSet\Services\OpenDscServer
Add or update the Environment value under that key as a
REG_MULTI_SZ (multiple string) with:
ASPNETCORE_ENVIRONMENT=Development
Once in development mode, navigate to /scalar/v1 for an interactive API
reference. The OpenAPI schema is available at /openapi/v1.json.
Authentication
The Pull Server supports multiple authentication mechanisms depending on the
client type:
Mechanism
Used by
Description
Cookie / Session
Browser (Blazor UI)
Standard login with username and password
mTLS (Mutual TLS)
LCM nodes
Client certificate validated against the node registration record
Personal Access Token
Automation / scripts
Bearer token passed in the Authorization header
Registration Key
New nodes
Shared secret used only during initial node registration
Authentication endpoints
/api/v1/auth
Method
Route
Description
POST
/api/v1/auth/login
Sign in with username and password
POST
/api/v1/auth/logout
Sign out and end the current session
GET
/api/v1/auth/logout-redirect
Sign out and redirect to the login page
GET
/api/v1/auth/me
Return the current authenticated user
POST
/api/v1/auth/change-password
Change the current user's password
POST
/api/v1/auth/tokens
Create a Personal Access Token (PAT)
GET
/api/v1/auth/tokens
List Personal Access Tokens for the current user
DELETE
/api/v1/auth/tokens/{id}
Revoke a Personal Access Token
User endpoints
/api/v1/users
Method
Route
Description
GET
/api/v1/users/
List all users
GET
/api/v1/users/{id}
Get user details
POST
/api/v1/users/
Create a user
PUT
/api/v1/users/{id}
Update a user
DELETE
/api/v1/users/{id}
Delete a user
POST
/api/v1/users/{id}/reset-password
Reset user password
POST
/api/v1/users/{id}/unlock
Unlock a locked user account
GET
/api/v1/users/{id}/roles
Get roles assigned to a user
PUT
/api/v1/users/{id}/roles
Set roles for a user
Group endpoints
/api/v1/groups
Method
Route
Description
GET
/api/v1/groups/
List all groups
GET
/api/v1/groups/{id}
Get group details
POST
/api/v1/groups/
Create a group
PUT
/api/v1/groups/{id}
Update a group
DELETE
/api/v1/groups/{id}
Delete a group
GET
/api/v1/groups/{id}/members
Get group members
PUT
/api/v1/groups/{id}/members
Set group members
GET
/api/v1/groups/{id}/roles
Get roles assigned to a group
PUT
/api/v1/groups/{id}/roles
Set roles for a group
GET
/api/v1/groups/external-mappings
List external group mappings (SSO)
POST
/api/v1/groups/external-mappings
Create an external group mapping
DELETE
/api/v1/groups/external-mappings/{id}
Delete an external group mapping
Role endpoints
/api/v1/roles
Method
Route
Description
GET
/api/v1/roles/
List all roles
GET
/api/v1/roles/{id}
Get role details
POST
/api/v1/roles/
Create a custom role
PUT
/api/v1/roles/{id}
Update role details and permissions
DELETE
/api/v1/roles/{id}
Delete a custom role
Health endpoints
/health
These endpoints don't require authentication.
Method
Route
Description
GET
/health/
Liveness check — indicates the server process is running