Runtime API
The platform API at https://api.ghayma.tech, as a project API key (gsk_…)
reaches it. A key belongs to one project and opens a deny-by-default allowlist of
that project’s application routes — the surface your server code and pipelines
use. For how keys are created, restricted, rolled and injected, see
Project API Keys.
Capabilities
The 36 operations group into four capabilities, and a key carries only the ones its purpose was granted:
| Capability | Reaches | Operations |
|---|---|---|
auth | Administer the project’s auth apps and their end users | 11 |
storage | Buckets, objects, and presigned upload and download URLs | 12 |
databases | Read databases, their credentials and their metrics | 4 |
deploy | Upload deploys; read deployments, logs, sites and the project | 9 |
An Application key carries auth, storage and databases; a CI/CD key
carries deploy. The key guide lists
every route behind each one.
Credentials
Send the key as a Bearer credential:
curl https://api.ghayma.tech/api/v1/auth-apps \
-H "Authorization: Bearer gsk_..."Deny rules
The surface is an allowlist, and each refusal is shaped so a key never reveals what it cannot touch:
| Response | When |
|---|---|
401 | The key is missing or invalid |
403 | The route is outside the allowlist, or the key lacks that route’s capability |
404 | The resource lives in another project — so a key cannot probe what else its owner owns |
This is the server / project-key surface. Your auth apps’ end users
sign in against the separate auth service at https://auth.ghayma.tech,
documented at Auth Service API — a gsk_ key does not go
there.
Contract
The reference below is rendered from the live OpenAPI 3.0.3 document the API publishes. Download it as openapi.yaml or openapi.json to generate a client in any language or to import it into Postman or Insomnia.