API Reference
Orvanta exposes a REST API that gives you full programmatic access to every feature available in the UI and CLI — the UI and CLI are themselves just clients of it.
Authentication
Section titled “Authentication”All API requests require a Bearer token. Create a token from the Orvanta UI under User Settings → Tokens, or with the CLI via orvanta user create-token.
Authorization: Bearer <your-token>Base URL
Section titled “Base URL”| Environment | Base URL |
|---|---|
| Orvanta Cloud | https://app.orvanta.cloud/api |
| Self-hosted | https://<your-instance>/api |
Workspace scoping
Section titled “Workspace scoping”Most endpoints are scoped to a workspace and follow the shape /w/{workspace}/{resource}/{action}, rather than a version prefix — there’s no /v1//v2 in the path today. A handful of endpoints (auth, workspace and instance administration) sit outside any workspace, directly under the base URL.
Rate limiting
Section titled “Rate limiting”There’s no global, edition-wide API rate limit today. The one rate limit currently enforced is narrower: public app executions (unauthenticated requests hitting a workspace’s published app) are capped per workspace per minute; exceeding it returns 429 Too Many Requests with a plain-text message naming the workspace and limit. It does not apply to authenticated API calls against scripts, flows, or jobs.
Core endpoints
Section titled “Core endpoints”| Resource | Endpoint |
|---|---|
| List scripts | GET /api/w/{workspace}/scripts/list |
| Get a script | GET /api/w/{workspace}/scripts/get/p/{path} |
| Run a script | POST /api/w/{workspace}/jobs/run/p/{path} |
| List flows | GET /api/w/{workspace}/flows/list_search |
| List jobs | GET /api/w/{workspace}/jobs/list |
| Get a job | GET /api/w/{workspace}/jobs_u/get/{id} |
| Resume a suspended flow (approval) | POST /api/w/{workspace}/jobs_u/resume/{id}/{resume_id}/{signature} |
| Create an API token | POST /api/users/tokens/create |
For the full reference with request/response schemas, load the raw spec into an OpenAPI viewer: