Skip to content

Runtime API reference

This reference describes Runtime Plane–related application programming interfaces (APIs) exposed by Trust3AI (for example configuration and connector operations via the Trust3AICloud). Each reference page is presented primarily from a representational state transfer (REST) perspective.

Typical REST calls include the following components:

  • The host URL, which depends on your deployment type:
    • Partially Managed (D2P) — Trust3AICloud: https://api.privaceracloud.com
    • Self-Managed — your portal URL (the domain you configured for the runtime plane). The portal proxies runtime API calls to the in-cluster service under the /runtime-plane/ path prefix, so the calls stay within your network.
  • The HTTP method for the operation, such as GET, POST, PUT, or DELETE.
  • The path for the operation (for example a path that identifies a connector or configuration resource). On Self-Managed, prefix the path with /runtime-plane (see the per-operation pages).
  • Authentication for the request—see Authentication. D2P uses the x-pcloud-key header; Self-Managed uses HTTP Basic auth with your portal credentials.
  • Any request body (JSON) or query parameters the operation supports.

For how to supply these components from your shell, CI job, or application—and how to parse JSON responses—see your tool or language documentation.

This reference describes the paths, methods, and supported request and response shapes for each operation. Pages may add examples (for example curl) as they are filled in.

Authentication

How you authenticate depends on your deployment type. Select the tab for yours.

Call the HTTP APIs in this reference with the x-pcloud-key request header set to your Trust3AI API key.

The portal shows the key only once when the runtime plane is created (or when it is first issued for your access). If you saved that value, use it in the header.

For example:

Bash
1
curl -H "x-pcloud-key: <PCLOUD_KEY>" ...

If you did not save it, run the following in a shell that has kubectl access to your cluster. Replace <YOUR_RUNTIME_PLANE_NAMESPACE> with the Kubernetes namespace for your runtime plane.

Bash
1
2
3
kubectl get secret privacera-runtime-secret -n <YOUR_RUNTIME_PLANE_NAMESPACE> \
  -o go-template='{{index .data "runtime.api.key"}}' | base64 -d
echo

The command prints the decoded API key as plain text—treat the output as sensitive (do not log it or commit it to source control).

If the Secret or key name does not match your cluster, inspect the Secret’s Data key names without printing values:

Bash
1
kubectl describe secret privacera-runtime-secret -n YOUR_RUNTIME_PLANE_NAMESPACE

If you cannot recover the key from the cluster or the portal, use Regenerate (available on Portal) or your Trust3AI administrator, as described in Trust3AI Managed keys.

There is no x-pcloud-key. Call the portal with HTTP Basic authentication using your portal credentials; the account must have the system admin role. The portal handles the request and forwards it to the in-cluster runtime service.

For example:

Bash
1
curl -u "<portal_user>:<portal_password>" ...

Because the portal runs in your cluster, send these requests over your portal's HTTPS endpoint and treat the credentials as sensitive.