Schemas

The OpenAI-compatible base URL clients call (ends in /v1), with Authorization: Bearer <key>. From the same gateway credential the keys are minted against.

Every serving tier name in the catalogue, sorted.

The model's architecture, as recorded: dense or moe (mixture of experts). Other values may appear.

Published benchmark scores: benchmark name to score, e.g. {"SWE-bench Verified": 69.6}. As published by the vendor; not measured here.

What the model is for: coding, agentic, reasoning, vision, embedding, rerank, general, speech or video. Other values may appear.

The context window in human form, as recorded, e.g. 128K or 256K→1M.

When the model entered the catalogue.

A longer introduction, for the model's detail view.

The serving recipe a DGX cluster runs it with, if any.

The name the catalogue shows. On create it defaults to the last part of repo.

Which hosted frontier model it is roughly comparable to, and from when, in a few words. An estimate, not a measurement.

The Hugging Face repo needs an accept-click (access approval) before a pull.

The AI gateway serving tier the model is meant for, e.g. code or general (GET /ai/gateway/tiers). Recorded only: which model backs a tier is decided there, not here.

The model's id in the catalogue.

The model's licence, as recorded, e.g. Apache-2.0, MIT.

Read-only: set by the store actions (pull, node cache, purge), never by a client. Where the weights are. synology: the central model store; local: node caches only; both: the central model store and at least one node cache; null: nowhere yet. Other values may appear.

The smallest hardware it runs on, in human form, e.g. 1× 3090 or 2×DGX.

The model card's web address.

Where the central copy is; null without one.

Read-only: set by the store actions (pull, node cache, purge), never by a client. The central-store share holding the weights; null while there is no central copy.

The node caches (see /node-caches).

Free-form notes of the platform's operators.

Read-only: set by the store actions (pull, node cache, purge), never by a client. A node holds a cached copy.

The Hugging Face organisation the repo is published under. It may be a quantizer rather than the lab that built the model (that is vendor).

The parameter count in billions, as a number to sort by.

The parameter count in human form, e.g. "480B (35B active)".

When the model was released upstream, as recorded, e.g. 2024-11.

The weights' precision or quantisation, as recorded, e.g. BF16, FP8, AWQ, NVFP4.

A Hugging Face repo id org/name: each part starts with a letter or digit and holds only letters, digits, ., _ and - (no ..), at most 96 characters. Frozen after create.

Where the model is meant to be served: an AI node's hostname or a DGX cluster, as recorded. Recorded only: loading a model is not part of this API.

The weights' size on disk in GB, as recorded.

Read-only: set by the store actions (pull, node cache, purge), never by a client. planned (recorded, no weights yet), pulling (a copy into the central store is running), owned (the weights are in the central store) or serving (a node serves it). Other values may appear.

What the model is strongest at, in a few words, e.g. agentic coding.

A one-line introduction, for a catalogue card.

The last change to the row, by a client or by a store action; equal to created_at until the first change.

The lab that built the model. The Hugging Face organisation (org) may be a quantizer.

The vendor's home country, as recorded, e.g. China, France, USA.

The model's architecture, as recorded: dense or moe (mixture of experts). Other values may appear.

Published benchmark scores: benchmark name to score, e.g. {"SWE-bench Verified": 69.6}. As published by the vendor; not measured here.

What the model is for: coding, agentic, reasoning, vision, embedding, rerank, general, speech or video. Other values may appear.

The context window in human form, as recorded, e.g. 128K or 256K→1M.

A longer introduction, for the model's detail view.

The name the catalogue shows. On create it defaults to the last part of repo.

Which hosted frontier model it is roughly comparable to, and from when, in a few words. An estimate, not a measurement.

The Hugging Face repo needs an accept-click (access approval) before a pull.

The AI gateway serving tier the model is meant for, e.g. code or general (GET /ai/gateway/tiers). Recorded only: which model backs a tier is decided there, not here.

The model's licence, as recorded, e.g. Apache-2.0, MIT.

The smallest hardware it runs on, in human form, e.g. 1× 3090 or 2×DGX.

The model card's web address.

Free-form notes of the platform's operators.

The Hugging Face organisation the repo is published under. It may be a quantizer rather than the lab that built the model (that is vendor).

The parameter count in billions, as a number to sort by.

The parameter count in human form, e.g. "480B (35B active)".

When the model was released upstream, as recorded, e.g. 2024-11.

The weights' precision or quantisation, as recorded, e.g. BF16, FP8, AWQ, NVFP4.

A Hugging Face repo id org/name: each part starts with a letter or digit and holds only letters, digits, ., _ and - (no ..), at most 96 characters. Frozen after create; unique.

Where the model is meant to be served: an AI node's hostname or a DGX cluster, as recorded. Recorded only: loading a model is not part of this API.

The weights' size on disk in GB, as recorded.

What the model is strongest at, in a few words, e.g. agentic coding.

A one-line introduction, for a catalogue card.

The lab that built the model. The Hugging Face organisation (org) may be a quantizer.

The vendor's home country, as recorded, e.g. China, France, USA.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

The model's architecture, as recorded: dense or moe (mixture of experts). Other values may appear.

Published benchmark scores: benchmark name to score, e.g. {"SWE-bench Verified": 69.6}. As published by the vendor; not measured here.

What the model is for: coding, agentic, reasoning, vision, embedding, rerank, general, speech or video. Other values may appear.

The context window in human form, as recorded, e.g. 128K or 256K→1M.

A longer introduction, for the model's detail view.

The name the catalogue shows. On create it defaults to the last part of repo.

Which hosted frontier model it is roughly comparable to, and from when, in a few words. An estimate, not a measurement.

The Hugging Face repo needs an accept-click (access approval) before a pull.

The AI gateway serving tier the model is meant for, e.g. code or general (GET /ai/gateway/tiers). Recorded only: which model backs a tier is decided there, not here.

The model's licence, as recorded, e.g. Apache-2.0, MIT.

Read-only.

The smallest hardware it runs on, in human form, e.g. 1× 3090 or 2×DGX.

The model card's web address.

Read-only.

Free-form notes of the platform's operators.

Read-only.

The Hugging Face organisation the repo is published under. It may be a quantizer rather than the lab that built the model (that is vendor).

The parameter count in billions, as a number to sort by.

The parameter count in human form, e.g. "480B (35B active)".

When the model was released upstream, as recorded, e.g. 2024-11.

The weights' precision or quantisation, as recorded, e.g. BF16, FP8, AWQ, NVFP4.

Frozen.

Where the model is meant to be served: an AI node's hostname or a DGX cluster, as recorded. Recorded only: loading a model is not part of this API.

The weights' size on disk in GB, as recorded.

Read-only.

What the model is strongest at, in a few words, e.g. agentic coding.

A one-line introduction, for a catalogue card.

The lab that built the model. The Hugging Face organisation (org) may be a quantizer.

The vendor's home country, as recorded, e.g. China, France, USA.

Live (monitoring); null when monitoring_reachable is false.

Live (monitoring); null when monitoring_reachable is false. The node's metrics collector has not reported for more than 30 seconds, so its model and GPU figures may be out of date.

Live (monitoring); null when monitoring_reachable is false. CPU use over the last minute, 0-100.

Live (monitoring); null when monitoring_reachable is false. Root file system in use, 0-100.

e.g. rtx-3090, gb10, rtx-pro-6000.

Live (monitoring); null when monitoring_reachable is false. GPUs reporting; also null when none does.

Live (monitoring); null when monitoring_reachable is false. The hottest GPU's temperature, in °C.

Live (monitoring); null when monitoring_reachable is false. Average GPU use across the node's GPUs, 0-100.

The node's hostname: its id here.

A GPU VM on a hybrid host (its power belongs to parent_host).

Live (monitoring); null when monitoring_reachable is false. The one-minute load average.

Live (monitoring); null when monitoring_reachable is false. Memory in use, 0-100.

The node's management address, as the hardware inventory records it.

Live (monitoring); null when monitoring_reachable is false. Loaded models.

Monitoring reachable: false when monitoring could not be read, and every live field of this node is then null.

Live (monitoring); null when monitoring_reachable is false.

For a virtual node, the host it runs on; null otherwise.

Live (monitoring); null when monitoring_reachable is false. The node's role as monitoring labels it, e.g. ai-rtx, ai-epyc, ai-k8s; null when it carries none. Other values may appear.

Other user-facing services the node hosts (they go offline with it): those seen answering, plus those the inventory declares.

The site the node is at, as the hardware inventory records it.

CPU, GPUs and memory in one line, from the hardware inventory.

Live (monitoring); null when monitoring_reachable is false. serving, loaded_idle, idle, offline, standby or powered_off.

Live (monitoring); null when monitoring_reachable is false. A GPU is throttling its clock (for power or heat).

Live (monitoring); null when monitoring_reachable is false. Seconds since the node booted.

For a virtual node, its VM id on parent_host; null otherwise.

Live (monitoring); null when monitoring_reachable is false. GPU memory in total, in bytes, summed over the GPUs.

Live (monitoring); null when monitoring_reachable is false. GPU memory in use, in bytes, summed over the GPUs (unified memory on gb10).

This page's items, in the list's order.

Monitoring reachable: false means every live field below is null.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

The stable, machine-readable reason, e.g. gitlab_group_failed. Each operation names the warnings it can give.

What happened, for a person. The wording may change.

What was done, e.g. user.create, api_v1.post.

Who made the change: the person's e-mail address as it was at the time, or system, pipeline:<run id>, ops:<script> for automated writers.

The entity after the change as the writer recorded it: usually an object, null on a delete. Every member whose NAME looks secret (it contains secret, password, token, hash, pepper, credential, api_key and the like, at any depth) is always null here, whatever it held.

session, pat (personal API token) or service_account. Null when the writer did not record it: every row older than the public API, and today most portal pages and automated writers (only /api/v1, API-token management and platform settings record it).

The entity before the change as the writer recorded it: usually an object, null on a create. Every member whose NAME looks secret (it contains secret, password, token, hash, pepper, credential, api_key and the like, at any depth) is always null here, whatever it held.

Which one, as the writer spelled its id. For entity_type licence this is the licence serial, masked to its last group (ATAILA-XXXXX-XXXXX-XXXXX-XXXXX-5F8N5) unless the caller holds licence-admin-global, exactly as on GET /licence.

The kind of thing changed, e.g. users, project.

The event's id: a string holding a positive integer. Ids grow with time but are not a clock; order by occurred_at.

When the change was recorded.

The request's X-Request-ID, when recorded.

The client address as the portal saw it, when recorded.

The API token used, when auth_kind is pat or service_account.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

Read-only. The line printed under the product name; computed from first_party, never stored and never settable.

Six-digit hex colour; returned lower-case.

A brand asset of kind favicon; null keeps the built-in one. In a PUT, null is a value that CLEARS the favicon, not "leave as is".

Read-only. True only on ATAILA's own portal; selects the attribution line. No request can change it.

A brand asset of kind logo; null shows the built-in logo. In a PUT, null is a value that CLEARS the logo, not "leave as is".

Horizontal nudge of the logo, in pixels.

The sidebar logo size preset.

The browser-tab title.

The wordmark in the sidebar and on the sign-in page.

A part of product_name rendered in brand_color. Empty colours the whole name.

When the brand was last changed.

Bumped by every change; send it back in If-Match.

The file's size in bytes.

The file name given at upload, kept for display only; may be empty.

Height in pixels; null for an SVG.

The asset's id; logo_asset_id and favicon_asset_id name it.

What the asset is for: a logo or a favicon.

The file's type, read from its bytes: image/png, image/webp or image/svg+xml for a logo; image/png, image/svg+xml or image/x-icon for a favicon.

The SHA-256 of the file's bytes, in lowercase hex.

When the file was first uploaded.

Where the asset is served, without a file extension (/api/brand/assets/<sha256>); readable without signing in, like the sign-in page itself.

Width in pixels; null for an SVG.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

The file, standard base64; at most 512 KB decoded. Its type is read from the bytes; no content type is sent.

The original file name, kept for display only: the asset is addressed by its content (sha256).

What the asset is for: a logo or a favicon.

Six-digit hex colour; returned lower-case.

A brand asset of kind favicon; null keeps the built-in one. In a PUT, null is a value that CLEARS the favicon, not "leave as is".

A brand asset of kind logo; null shows the built-in logo. In a PUT, null is a value that CLEARS the logo, not "leave as is".

Horizontal nudge of the logo, in pixels.

The sidebar logo size preset.

The browser-tab title.

The wordmark in the sidebar and on the sign-in page.

A part of product_name rendered in brand_color. Empty colours the whole name.

When the copy was last made or checked.

The model's display_name.

The model's Hugging Face repo id.

The copy's size on the node's disk in GB, when measured.

The member's address on the cluster's own interconnect (crosslink_subnet).

The member's hostname.

The member's management address.

head or worker. Other values may appear.

The model it serves.

The serving recipe the cluster runs, by name.

When serving started, if recorded (a value that is not a timestamp reads as null).

INTERNAL: not invoiced (ATAILA's own and reference customers); PAYING: invoiced.

When the customer was registered.

The customer's number on this platform, 1-999; unique, archived customers included. Frozen.

The mail service the customer's mailboxes are created on by default: 1, 2 or 3, as the portal's customer page names them.

sp (the default): a customer of this multi-tenant platform; enterprise: a customer with a single-tenant installation of its own. Frozen.

The customer's top-level GitLab group; also its primary tenant's slug. Frozen.

Only with ?include=gitlab_status on a read; null when GitLab could not be asked (a warning then says why).

The customer's id.

The customer's full name.

Free text for operators, up to 2000 characters.

An e-mail address. Stored and returned normalised: the domain is lower-cased (and internationalised domains are converted to their canonical form), the local part (before @) keeps its case exactly as sent, surrounding whitespace is dropped, and a Name <address> form is reduced to the address. Pat@Example.COM is therefore returned as Pat@example.com; compare with the domain case-folded to avoid a perpetual diff.

The name of the customer's primary contact.

The tenant created with the customer; it can never be deleted.

Upper-case letters and digits, e.g. ACME; unique, archived customers included. Frozen.

active, suspended or archived. archived is set only by DELETE /customers/{id} and is final: v1 has no way to restore an archived customer.

What did not go as planned on this request, which still succeeded; empty when everything did. Show these to a person.

INTERNAL: not invoiced (ATAILA's own and reference customers); PAYING: invoiced. Default INTERNAL.

Omit to have the server allocate the next free index.

The mail service the customer's mailboxes are created on by default: 1, 2 or 3, as the portal's customer page names them. Default 3.

sp (the default): a customer of this multi-tenant platform; enterprise: a customer with a single-tenant installation of its own. Frozen after create.

Also the primary tenant's slug, so the tenant slug rule applies: Lowercase letters, digits and '-', starting with a letter, 2-30 characters. Frozen after create.

The customer's full name.

Free text for operators, up to 2000 characters.

An e-mail address. Stored and returned normalised: the domain is lower-cased (and internationalised domains are converted to their canonical form), the local part (before @) keeps its case exactly as sent, surrounding whitespace is dropped, and a Name <address> form is reduced to the address. Pat@Example.COM is therefore returned as Pat@example.com; compare with the domain case-folded to avoid a perpetual diff.

The name of the customer's primary contact.

Upper-case letters and digits, starting with a letter, 2-16 characters (e.g. ACME). Frozen after create.

active (default) or suspended.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

INTERNAL: not invoiced (ATAILA's own and reference customers); PAYING: invoiced.

Frozen.

The mail service the customer's mailboxes are created on by default: 1, 2 or 3, as the portal's customer page names them.

Frozen.

Frozen.

The customer's full name.

Free text for operators, up to 2000 characters. null clears it.

An e-mail address. Stored and returned normalised: the domain is lower-cased (and internationalised domains are converted to their canonical form), the local part (before @) keeps its case exactly as sent, surrounding whitespace is dropped, and a Name <address> form is reduced to the address. Pat@Example.COM is therefore returned as Pat@example.com; compare with the domain case-folded to avoid a perpetual diff.

The name of the customer's primary contact.

Frozen.

active or suspended; archiving is DELETE /customers/{id}.

When the cluster was defined.

The subnet (CIDR) of the members' interconnect addresses.

Why the last change failed, when status is error.

The cluster's id.

The interconnect the members share: direct-cable, or the switch they are connected through. Other values may appear.

The member nodes, head first.

The cluster's name, unique; a load target names it so.

Free-form notes of the platform's operators.

What the cluster serves; null when nothing is recorded.

As recorded: defined, forming, active, breaking or error. This read does not converge a cluster that is mid-change (the portal's DGX page does).

How the members are wired: pair-direct (two nodes, cabled to each other), pair-switch (two nodes through a switch), ring3 (three nodes in a ring) or quad-switch (four nodes through a switch). Other values may appear.

The last change; equal to created_at until the first change.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

Frozen.

The soft budget's period, e.g. 30d.

When the key was created or adopted.

The id of the user (a person or a service account) who created or adopted the key; null when not recorded.

Frozen.

Frozen.

The key's id (a UUID).

<organisation-slug>-<env>-<app>[-<feature>] for a key created here; an adopted key keeps the alias it had. Unique among live keys.

Where models and the limits in this answer come from. present: the gateway's live values (a GET of one key); missing: the gateway no longer has the key (the registry values are shown); not_read: the gateway was not read and the registry values are shown. A list answers not_read, and so does EVERY write (create, PATCH, rotation): after a write, live is not_read and spend_usd is null until the next GET of the key. Read the key again (GET) for its live values.

Tier names the key may call. A SET of tier names from the serving-tier catalogue: order carries no meaning and a name given twice counts once. Written de-duplicated and sorted (to the registry and to the gateway) and always returned sorted, so the same set always reads back the same.

The tenant (organisation) that owns the key. Frozen.

api: created here; adopted: an existing gateway key taken under management. An adopted key's value lives with its consumer, so it cannot be rotated here (409 key_adopted).

A project of the tenant the key serves; null when it serves none in particular.

When the key's value was last replaced (a rotation); null when never.

Requests per minute the gateway allows the key; null for no limit.

The key's value (sk-…). Present ONLY in the response to the create or rotation that produced it, and only when that request set expose_secret: true; null everywhere else, including an idempotent replay of that same request. The value is always stored in the platform's secrets store at secret_path; the API never returns it again.

The field of that secrets-store entry that holds the value. Null when secret_path is.

Where the value is stored: a path in the platform's secrets store. Null for an adopted key whose location was never recorded.

SOFT budget in US dollars: the gateway alerts when it is reached and NEVER blocks. There is no hard limit in v1.

Spend the gateway has recorded for this key (shadow USD). Only in the answer to a GET of one key: null in a list, and null in the answer to every write (create, PATCH, rotation) until the next GET.

The first 12 characters of the AI gateway's SHA-256 of the key, to find it in the AI gateway's own records. Never the value.

Tokens per minute the gateway allows the key; null for no limit.

The last change; equal to created_at until the first change.

What did not go as planned on this request, which still succeeded; empty when everything did. Show these to a person.

The application the key is for: lowercase words joined by single hyphens, 1-40 characters. Part of key_alias. Frozen.

The soft budget's period: a number and s, m, h, d or mo, e.g. 30d; the spend counted against soft_budget_usd restarts after each period.

The environment the key is for: dev, uat or prod. Frozen.

Return the key's value in THIS response (secret). It is stored in the secrets store either way and never returned again.

Optional: the application's feature the key is for, same rule as app. Part of key_alias. Frozen.

A SET of tier names from the serving-tier catalogue: order carries no meaning and a name given twice counts once. Written de-duplicated and sorted (to the registry and to the gateway) and always returned sorted, so the same set always reads back the same. A tier that exists but serves nothing right now is accepted with a tier_not_serving warning.

The owning tenant.

Optional: a project of that tenant the key serves.

Requests per minute the gateway allows the key; null for no limit.

SOFT budget in US dollars: the gateway alerts when it is reached and NEVER blocks. There is no hard limit in v1.

Tokens per minute the gateway allows the key; null for no limit.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

Frozen.

null clears it.

Frozen.

Frozen.

A SET of tier names from the serving-tier catalogue: order carries no meaning and a name given twice counts once. Written de-duplicated and sorted (to the registry and to the gateway) and always returned sorted, so the same set always reads back the same.

Frozen.

null clears it.

null clears it.

SOFT budget in US dollars: the gateway alerts when it is reached and NEVER blocks. There is no hard limit in v1. null clears it.

null clears it.

Return the NEW value in this response (secret). It is stored in the secrets store either way.

The group exists in GitLab.

The group's full path; null when it does not exist.

The group's page in GitLab; null when it does not exist.

app or www. Other values may appear.

<customer group>/<repository>.

The project's main repository.

The environment, e.g. dev.

The namespace's name.

The entry is offered for loading in the portal.

The serving engine: vllm, ollama or spark-vllm (a DGX cluster). Other values may appear.

The node (for a cluster: its head).

The entry's stable key, unique.

The name the portal shows for the entry.

The model it loads, as the serving engine names it.

The port the loaded model answers on.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

The name the installed licence is bound to. A licence bound to another name puts the portal in DOMAIN_MISMATCH.

SENSITIVE. The installed bundle as an acplic1. string, for a principal holding licence-admin-global; null for everyone else and when none is installed.

Whole days until valid_until; negative in grace. Null without a term.

sha256 (hex) of the installed licence document envelope — the document member of the bundle, as ASCII. The same value the issuer records for the document it signed. Null when none is installed.

The name this portal answers on, as the licence engine derives it.

Days of grace after valid_until before the licence locks (14 unless the document says otherwise); null when none is installed.

The licence gate lets the estate grow (projects, AI, customers and tenants): false in the restricted and read-only states.

When the installed document was installed.

This portal's instance id, which a licence document binds. Null until the portal first activates or imports a licence.

The kind of licence: evaluation, commercial, internal-sp or partner; null when none is installed. Other values may appear.

The installed document's epoch; a bundle installs only when its epoch is higher (see PUT /licence/bundle).

The installed licence's id, as ATAILA issued it; null when none is installed. The audit row of an install names it.

Entitled modules; empty unless the state gives full function.

Conditions shown next to the state, never a state of their own: clock_skew, over_deployed.

The product the licence is for, as ATAILA issued it, e.g. enterprise or eval-internal; null when none is installed or the document names none. Other values may appear.

The licence serial. Shown in full only to a principal holding licence-admin-global; everyone else gets it masked to its last group. Null when no licence is installed.

True when serial is masked for this caller.

Sockets licensed and observed.

The licence gate lets the service-provider plane (customers and tenants) change: requires growth, the sp-mode module and a tenancy mode other than single.

The licence state. ACTIVE, EXPIRING and GRACE give full function; UNLICENSED, PENDING_ACTIVATION, INVALID and DOMAIN_MISMATCH refuse what would grow the platform (403 licence_restricted); LOCKED and REVOKED refuse every change except installing a licence (403 licence_locked).

Why the licence is in this state; empty when ACTIVE.

single or multi, as the licence states it (multi is the service-provider plane: customers and tenants). Other values may appear.

The product tier: standard, enterprise, enterprise-plus or service-provider; null when none is installed. Other values may appear.

When the licence term starts; null without a term.

When the licence term ends; null without a term. After it the licence runs in GRACE for grace_days, then LOCKED.

The licence gate lets ordinary changes through: false only in the read-only states (LOCKED, REVOKED).

SENSITIVE. The acplic1. bundle ATAILA issued for this portal.

The name the installed licence is bound to. A licence bound to another name puts the portal in DOMAIN_MISMATCH.

SENSITIVE. The installed bundle as an acplic1. string, for a principal holding licence-admin-global; null for everyone else and when none is installed.

Whole days until valid_until; negative in grace. Null without a term.

sha256 (hex) of the installed licence document envelope — the document member of the bundle, as ASCII. The same value the issuer records for the document it signed. Null when none is installed.

The name this portal answers on, as the licence engine derives it.

Days of grace after valid_until before the licence locks (14 unless the document says otherwise); null when none is installed.

The licence gate lets the estate grow (projects, AI, customers and tenants): false in the restricted and read-only states.

Always true: the bundle was installed (a bundle that was not is a problem, never this answer).

When the installed document was installed.

This portal's instance id, which a licence document binds. Null until the portal first activates or imports a licence.

The kind of licence: evaluation, commercial, internal-sp or partner; null when none is installed. Other values may appear.

The installed document's epoch; a bundle installs only when its epoch is higher (see PUT /licence/bundle).

The installed licence's id, as ATAILA issued it; null when none is installed. The audit row of an install names it.

Entitled modules; empty unless the state gives full function.

Conditions shown next to the state, never a state of their own: clock_skew, over_deployed.

The product the licence is for, as ATAILA issued it, e.g. enterprise or eval-internal; null when none is installed or the document names none. Other values may appear.

The licence serial. Shown in full only to a principal holding licence-admin-global; everyone else gets it masked to its last group. Null when no licence is installed.

True when serial is masked for this caller.

Sockets licensed and observed.

The licence gate lets the service-provider plane (customers and tenants) change: requires growth, the sp-mode module and a tenancy mode other than single.

The licence state. ACTIVE, EXPIRING and GRACE give full function; UNLICENSED, PENDING_ACTIVATION, INVALID and DOMAIN_MISMATCH refuse what would grow the platform (403 licence_restricted); LOCKED and REVOKED refuse every change except installing a licence (403 licence_locked).

Why the licence is in this state; empty when ACTIVE.

single or multi, as the licence states it (multi is the service-provider plane: customers and tenants). Other values may appear.

The product tier: standard, enterprise, enterprise-plus or service-provider; null when none is installed. Other values may appear.

When the licence term starts; null without a term.

When the licence term ends; null without a term. After it the licence runs in GRACE for grace_days, then LOCKED.

What did not go as planned on this request, which still succeeded; empty when everything did. Show these to a person.

The licence gate lets ordinary changes through: false only in the read-only states (LOCKED, REVOKED).

Sockets the licence allows; null when uncapped or when no licence is installed.

Sockets the latest census measured; null when no census has run.

The licence sets no socket limit.

Whole days until the licence term ends; negative in grace. Null without a term.

The licence state. ACTIVE, EXPIRING and GRACE give full function; UNLICENSED, PENDING_ACTIVATION, INVALID and DOMAIN_MISMATCH refuse what would grow the platform (403 licence_restricted); LOCKED and REVOKED refuse every change except installing a licence (403 licence_locked). Other values may appear.

Why the licence is in this state, for a person; empty when ACTIVE.

The serving engine a load here uses: vllm (a node), k8s-vllm (a Kubernetes node) or spark-vllm (a DGX cluster). Other values may appear.

GPUs: counted live when the node is online, estimated from its static budget otherwise; a cluster counts one per member.

A node, or a DGX cluster by name.

The target is a DGX cluster.

False for fit-only targets (DGX clusters, Kubernetes nodes).

The served names of the models loaded here right now; empty when none is, or when monitoring cannot be read.

A cluster's member hostnames, head first; null for a node.

The node (for a cluster: its head) is up, as monitoring sees it; false also when monitoring cannot be read.

VRAM per GPU in GB.

As the AI node list reports it (serving, loaded_idle, idle, offline, standby, powered_off); for a DGX cluster active or forming while it is one. Other values may appear.

How many GPUs one model is spread across when served here.

The weight budget in GB: the share of the serving GPUs' VRAM a model's weights may take, the rest being left for its working memory. A model fits when its size_gb is at most this.

gpu_count times per_gpu_gb, in GB.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

When the membership was created; null on a legacy row.

developer can be read (legacy rows hold it) but not written: PUT accepts only owner, admin, member and viewer.

The tenant.

The member.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

owner, admin, member or viewer.

This API's version, semantic versioning (1.0.0). Within 1.x the contract only ever grows.

What pipeline dispatch does on this platform, as /api/version reports it. live: work runs. dryrun: the dispatch is faked, nothing is executed, and provisioning or a release never completes. simulate: provisioning stages are marked done without running (simulate_stage_seconds each) and every other dispatch behaves as dryrun. Read it before booking work, to fail fast on a platform that will not carry it out.

The licence state in short.

The modules the licence entitles; empty unless the licence state gives full function.

The platform build that answers, e.g. 1.0.181. Release notes and the developer documentation name contract changes by this version.

Under simulate: how long a simulated provisioning stage takes. Null in every other mode.

single or multi, as the licence states it (multi is the service-provider plane: customers and tenants); empty without a licence.

The licence's product tier; empty without a licence.

<model id>:<node>.

The model (id of an AI model).

The AI node's hostname.

Where the copy is on the node's disk, as the cache run reported it.

The copy's size on the node's disk in GB, when measured.

cached once the copy is complete; pulling while it is made; absent or failed when a copy was removed or did not finish. Other values may appear.

When the copy was last made or checked.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

The AI node's hostname.

The copy's size on the node's disk in GB, when measured.

cached once the copy is complete; pulling while it is made; absent or failed when a copy was removed or did not finish. Other values may appear.

The cluster's name (name of a DGX cluster).

The node's role in it: head or worker. Other values may appear.

The DGX cluster serving it, when it is served by a cluster rather than by this node alone.

The serving engine, e.g. vllm or ollama. Other values may appear.

The longest context, in tokens, it is served with, when reported.

The model as the serving engine names it (its repo or path).

The serving port (a node can run several).

The name clients call it by on the node's OpenAI-compatible endpoint; null when not reported.

How many GPUs the model is spread across, when reported.

Serving tiers it backs right now.

The models with a complete copy on this node, largest first.

When it was last scanned; null when never.

Free space in GB, as last scanned.

The kind of disk, as the scan reported it: nvme, hdd or raid. Other values may appear.

Where the storage is mounted, as the scan reported it.

The share's name, or the node's hostname.

Total capacity in GB, as last scanned.

When the work was booked.

For work that dispatches pipelines: dryrun means this platform fakes the dispatch, nothing is executed, and the operation can never succeed; simulate means stages are marked done without running (see simulated).

When status is failed: code says why (stage_failed with the stage, release_failed, rejected, operation_timed_out, run_failed, run_timeout, ...), and message (detail for a model store run) says it for a person. Null otherwise.

<kind>:<native id>, e.g. provision:4711. The Location of the 202 that started it is /api/v1/operations/<id>.

What the work is: provision (project provisioning), release (a release promotion), model-store-run (a model node cache or uncache, or a store run started in the portal) or order (a tenant order, placed in the portal; this API can poll one but not create it). Other kinds may appear.

What is happening or what happened, for a person. The wording may change.

For tenant orders (order:<id>, placed in the portal: this API can poll an order but not create one): true when the order succeeded only in part — what was delivered does not fully match what was ordered; message says what is missing.

For release operations: the pipeline carrying the work out, once one is known.

That thing's id (<model id>:<node> for a node cache).

What the work is about: project, release_operation, ai_model, ai_model_node_cache, ai_node or order. Other values may appear.

For project provisioning: the result rests on SIMULATED stages (dispatch_mode simulate). A succeeded simulated operation provisioned nothing.

For work done in stages (project provisioning): the stage it is on, or the one it stopped at.

pending, running, awaiting_approval (a person must approve it in the portal), awaiting_operator (a person must act in the portal), succeeded or failed. The last two are final.

When it last changed; the end, once it has ended.

The stage it is on (a stage key); null between stages.

apply-all: every stage not yet done; apply-pending: only the stale stages; delete-all: a teardown, started in the portal.

provision:<id>: poll it at /operations/{id}.

Its worker stopped heartbeating; it is resumed by the platform, not by a new start.

When it started.

The operation's status, as GET /operations/{id} reports it.

Its last heartbeat or step.

The group the portal lists the key under, e.g. AI or Security.

What holding the key allows, for a person.

The feature the key is about, e.g. users.

May be granted to a person (PUT /users/{id}/roles/{key}). A key that is not grantable is still honoured for those who hold it.

<feature>-<level>-<scope>, e.g. users-read-global: what a role grant, a token's scopes and a 403's required name.

The key's name, for a person.

read reads; admin also changes. An operation that reads accepts either.

May be carried by an API token.

global: the whole platform. tenant: limited to the holder's tenants where the feature enforces it; an API token carries global keys only.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

The stable, machine-readable reason, e.g. customer_not_found. Each operation names its own codes in its responses; the codes every operation can answer are listed under Errors in the API description.

What went wrong this time, written for a person. The wording may change at any time: branch on code, never on detail.

The path of the request that failed.

The request's id, the same as the X-Request-ID response header. Quote it when asking for support.

The HTTP status code of the response, repeated.

The HTTP status phrase, e.g. Forbidden.

urn:ataila:api:problem:<code>: names the kind of problem, the same for every occurrence of a code. An identifier, not a link.

The lock is set.

When it was set; null while it is not.

Who set it (an e-mail address, as recorded); null while it is not set.

The project.

Required to UNLOCK: the project's short name, exactly.

true sets the lock; false releases it and needs confirm_unlock.

Kubernetes projects: allow egress to public HTTPS.

Who reaches the PROD API: INTERNAL_ONLY (default) or PUBLIC. The UAT and DEV APIs are never public.

shared rides the environment's app gateway; dedicated gets its own.

When the project was registered.

The tenant's customer; null only for a tenant no customer owns.

k8s (default): namespaces on the shared Kubernetes clusters; vm: virtual machines of its own. Frozen.

Free text, up to 2000 characters.

An AI endpoint at ai.<primary_domain>. Also allows outbound HTTPS to the internet, as allow_public_https_egress does.

An in-memory key-value cache.

A disaster-recovery replica of the PROD database.

A disaster-recovery mirror of the PROD object storage.

An application: its front end at app.<primary_domain> and its API at api.<primary_domain>, in PROD, UAT and DEV.

IIS/.NET hosting. VM backend only.

SQL Server. VM backend only.

Replication of the object storage to the central store: recorded, not acted on yet.

Object storage for the project; false provisions none (a database-only project).

A web site at www.<primary_domain> (and uat.www., dev.www.), seeded from www_template.

Make the UAT front end (uat.app.) reachable from the internet, e.g. to share a preview. DEV is never public.

Make the UAT web site (uat.www.) reachable from the internet.

The web site ships from its own <gitlab_repo_slug>-www repository. Provisioning does not read it: the web site, its repository and its stages follow enable_static_site alone. With false, the platform's security scans leave the web site out, and a project with no application drops out of the traffic views. Keep it true (the default) unless the web site is not built from that repository.

Who reaches the PROD front end: PUBLIC (the internet; default) or INTERNAL_ONLY.

The front-end framework the application is generated with: react (default), angular, vue or nuxt4.

A GitHub repository URL, recorded in the project's manifest as its mirror.

A GitHub user name, recorded with the project.

The repository name in the customer's GitLab group. Frozen.

The project has a mobile app. Its PROD API is then public whatever api_exposure says: the app calls it from the internet.

The project's id.

The GitLab repository already holds code: provisioning does not seed it from the template.

One of ATAILA's own platform projects: readable, never writable through v1.

The project's display name, 2-60 characters. Double quotes, apostrophes, backslashes and control characters are refused: the name is written into the project's generated files.

The SQL Server edition PROD and UAT run, with enable_mssql: express (default; free), standard or enterprise (licensed through the platform operator).

Only the network zone is registered: no application and no web site. Frozen.

What the project's compiled manifest names; null for a project registered without one.

The domain the project's sites are named under (www., app., api., ai.). Frozen.

Data disks per PROD object storage node.

PROD object storage nodes. With enable_object_storage, nodes times prod_object_storage_disks_per_vm must be at least 4.

The third octet of the project's networks; unique on the platform. Frozen.

The id of the user (a person or a service account) who registered the project; null when that was not recorded.

Lowercase letters and digits, unique on the platform. Frozen.

Read-only. planned until provisioning starts, active once every stage is done; also provisioning, paused and retired.

The owning tenant. Frozen.

What did not go as planned on this request, which still succeeded; empty when everything did. Show these to a person.

Windows Server VMs in DEV, 0-10. VM backend only.

Windows Server VMs in PROD, 0-10. VM backend only.

Windows Server VMs in UAT, 0-10. VM backend only.

What seeds the web site's repository: template-www (an information site; default) or template-blog (articles in Markdown, with feeds). Ignored without enable_static_site.

Kubernetes projects: allow egress to public HTTPS.

Who reaches the PROD API: INTERNAL_ONLY (default) or PUBLIC. The UAT and DEV APIs are never public.

shared rides the environment's app gateway; dedicated gets its own.

k8s (default): namespaces on the shared Kubernetes clusters; vm: virtual machines of its own. Frozen.

Free text, up to 2000 characters.

An AI endpoint at ai.<primary_domain>. Also allows outbound HTTPS to the internet, as allow_public_https_egress does.

An in-memory key-value cache.

A disaster-recovery replica of the PROD database.

A disaster-recovery mirror of the PROD object storage.

An application: its front end at app.<primary_domain> and its API at api.<primary_domain>, in PROD, UAT and DEV.

IIS/.NET hosting. VM backend only.

SQL Server. VM backend only.

Replication of the object storage to the central store: recorded, not acted on yet.

Object storage for the project; false provisions none (a database-only project).

A web site at www.<primary_domain> (and uat.www., dev.www.), seeded from www_template.

Make the UAT front end (uat.app.) reachable from the internet, e.g. to share a preview. DEV is never public.

Make the UAT web site (uat.www.) reachable from the internet.

The web site ships from its own <gitlab_repo_slug>-www repository. Provisioning does not read it: the web site, its repository and its stages follow enable_static_site alone. With false, the platform's security scans leave the web site out, and a project with no application drops out of the traffic views. Keep it true (the default) unless the web site is not built from that repository.

Who reaches the PROD front end: PUBLIC (the internet; default) or INTERNAL_ONLY.

The front-end framework the application is generated with: react (default), angular, vue or nuxt4.

A GitHub repository URL, recorded in the project's manifest as its mirror.

A GitHub user name, recorded with the project.

The repository name in the customer's GitLab group; unique within the customer. Frozen.

The project has a mobile app. Its PROD API is then public whatever api_exposure says: the app calls it from the internet.

The GitLab repository already holds code: provisioning does not seed it from the template.

The project's display name, 2-60 characters. Double quotes, apostrophes, backslashes and control characters are refused: the name is written into the project's generated files.

The SQL Server edition PROD and UAT run, with enable_mssql: express (default; free), standard or enterprise (licensed through the platform operator).

Register the network zone only: no app, no web site. Forces enable_static_site and enable_fullstack_app off. Frozen.

The domain the project's sites are named under (www., app., api., ai.). Frozen.

Data disks per PROD object storage node.

PROD object storage nodes. With enable_object_storage, nodes times prod_object_storage_disks_per_vm must be at least 4.

The third octet of the project's networks, estate-wide unique. Omit it and the server allocates one above the highest in use (never below 4). Frozen.

Lowercase letters and digits, 2-11, starting with a letter. Estate-wide unique. Frozen.

The owning tenant. Frozen.

Windows Server VMs in DEV, 0-10. VM backend only.

Windows Server VMs in PROD, 0-10. VM backend only.

Windows Server VMs in UAT, 0-10. VM backend only.

What seeds the web site's repository: template-www (an information site; default) or template-blog (articles in Markdown, with feeds). Ignored without enable_static_site.

When the role was given; null on a legacy row.

RECORDED, NOT ENFORCED: nothing creates the GitLab user or its GitLab membership from this value.

The project.

owner, admin, developer, member or viewer.

The member.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

Recorded, not enforced. maintainer is refused for a person who is not ATAILA staff.

owner, admin, developer (default), member or viewer.

The project's repositories in GitLab.

The project's namespace in the platform's image registry.

Kubernetes backend: its namespaces, one per environment.

dev and uat only. A VM-backend project's paths embed its machines' host names and are not listed.

The project's public URLs.

This page's items, in the list's order.

Send it as cursor to read the next page; null on the last page. Opaque: never build or change one.

Kubernetes projects: allow egress to public HTTPS.

Who reaches the PROD API: INTERNAL_ONLY (default) or PUBLIC. The UAT and DEV APIs are never public.

shared rides the environment's app gateway; dedicated gets its own.

Frozen.

null clears it.

An AI endpoint at ai.<primary_domain>. Also allows outbound HTTPS to the internet, as allow_public_https_egress does.

An in-memory key-value cache.

A disaster-recovery replica of the PROD database.

A disaster-recovery mirror of the PROD object storage.

An application: its front end at app.<primary_domain> and its API at api.<primary_domain>, in PROD, UAT and DEV.

IIS/.NET hosting. VM backend only.

SQL Server. VM backend only.

Replication of the object storage to the central store: recorded, not acted on yet.

Object storage for the project; false provisions none (a database-only project).

A web site at www.<primary_domain> (and uat.www., dev.www.), seeded from www_template.

Make the UAT front end (uat.app.) reachable from the internet, e.g. to share a preview. DEV is never public.

Make the UAT web site (uat.www.) reachable from the internet.

The web site ships from its own <gitlab_repo_slug>-www repository. Provisioning does not read it: the web site, its repository and its stages follow enable_static_site alone. With false, the platform's security scans leave the web site out, and a project with no application drops out of the traffic views. Keep it true (the default) unless the web site is not built from that repository.

Who reaches the PROD front end: PUBLIC (the internet; default) or INTERNAL_ONLY.

The front-end framework the application is generated with: react (default), angular, vue or nuxt4.

A GitHub repository URL, recorded in the project's manifest as its mirror. null clears it.

A GitHub user name, recorded with the project. null clears it.

Frozen.

The project has a mobile app. Its PROD API is then public whatever api_exposure says: the app calls it from the internet.

The GitLab repository already holds code: provisioning does not seed it from the template.

The project's display name, 2-60 characters. Double quotes, apostrophes, backslashes and control characters are refused: the name is written into the project's generated files.

The SQL Server edition PROD and UAT run, with enable_mssql: express (default; free), standard or enterprise (licensed through the platform operator).

Frozen.

Frozen.

Data disks per PROD object storage node.

PROD object storage nodes. With enable_object_storage, nodes times prod_object_storage_disks_per_vm must be at least 4.

Frozen.

Frozen.

Frozen.

Windows Server VMs in DEV, 0-10. VM backend only.

Windows Server VMs in PROD, 0-10. VM backend only.

Windows Server VMs in UAT, 0-10. VM backend only.

What seeds the web site's repository: template-www (an information site; default) or template-blog (articles in Markdown, with feeds). Ignored without enable_static_site.

When the project was registered.

The tenant's customer; null only for a tenant no customer owns.

k8s (default): namespaces on the shared Kubernetes clusters; vm: virtual machines of its own. Frozen.

The repository name in the customer's GitLab group. Frozen.

The project's id.

One of ATAILA's own platform projects: readable, never writable through v1.

The project's display name, 2-60 characters. Double quotes, apostrophes, backslashes and control characters are refused: the name is written into the project's generated files.

Only the network zone is registered: no application and no web site. Frozen.

The domain the project's sites are named under (www., app., api., ai.). Frozen.

The third octet of the project's networks; unique on the platform. Frozen.

Lowercase letters and digits, unique on the platform. Frozen.

Read-only. planned until provisioning starts, active once every stage is done; also provisioning, paused and retired.

The owning tenant. Frozen.

Kubernetes projects: allow egress to public HTTPS.

Who reaches the PROD API: INTERNAL_ONLY (default) or PUBLIC. The UAT and DEV APIs are never public.

shared rides the environment's app gateway; dedicated gets its own.

When the project was registered.

The tenant's customer; null only for a tenant no customer owns.

k8s (default): namespaces on the shared Kubernetes clusters; vm: virtual machines of its own. Frozen.

Free text, up to 2000 characters.

An AI endpoint at ai.<primary_domain>. Also allows outbound HTTPS to the internet, as allow_public_https_egress does.

An in-memory key-value cache.

A disaster-recovery replica of the PROD database.

A disaster-recovery mirror of the PROD object storage.

An application: its front end at app.<primary_domain> and its API at api.<primary_domain>, in PROD, UAT and DEV.

IIS/.NET hosting. VM backend only.

SQL Server. VM backend only.

Replication of the object storage to the central store: recorded, not acted on yet.

Object storage for the project; false provisions none (a database-only project).

A web site at www.<primary_domain> (and uat.www., dev.www.), seeded from www_template.

Make the UAT front end (uat.app.) reachable from the internet, e.g. to share a preview. DEV is never public.

Make the UAT web site (uat.www.) reachable from the internet.

The web site ships from its own <gitlab_repo_slug>-www repository. Provisioning does not read it: the web site, its repository and its stages follow enable_static_site alone. With false, the platform's security scans leave the web site out, and a project with no application drops out of the traffic views. Keep it true (the default) unless the web site is not built from that repository.

Who reaches the PROD front end: PUBLIC (the internet; default) or INTERNAL_ONLY.

The front-end framework the application is generated with: react (default), angular, vue or nuxt4.

A GitHub repository URL, recorded in the project's manifest as its mirror.

A GitHub user name, recorded with the project.

The repository name in the customer's GitLab group. Frozen.

The project has a mobile app. Its PROD API is then public whatever api_exposure says: the app calls it from the internet.

The project's id.

The GitLab repository already holds code: provisioning does not seed it from the template.

One of ATAILA's own platform projects: readable, never writable through v1.

The project's display name, 2-60 characters. Double quotes, apostrophes, backslashes and control characters are refused: the name is written into the project's generated files.

The SQL Server edition PROD and UAT run, with enable_mssql: express (default; free), standard or enterprise (licensed through the platform operator).

Only the network zone is registered: no application and no web site. Frozen.

What the project's compiled manifest names; null for a project registered without one.

The domain the project's sites are named under (www., app., api., ai.). Frozen.

Data disks per PROD object storage node.

PROD object storage nodes. With enable_object_storage, nodes times prod_object_storage_disks_per_vm must be at least 4.

The third octet of the project's networks; unique on the platform. Frozen.

The id of the user (a person or a service account) who registered the project; null when that was not recorded.

Lowercase letters and digits, unique on the platform. Frozen.

The provisioning stages this change left stale, in apply order: stages already done whose substrate the change affects. POST /projects/{id}/provisioning re-applies them.

Read-only. planned until provisioning starts, active once every stage is done; also provisioning, paused and retired.

The owning tenant. Frozen.

What did not go as planned on this request, which still succeeded; empty when everything did. Show these to a person.

Windows Server VMs in DEV, 0-10. VM backend only.

Windows Server VMs in PROD, 0-10. VM backend only.

Windows Server VMs in UAT, 0-10. VM backend only.

What seeds the web site's repository: template-www (an information site; default) or template-blog (articles in Markdown, with feeds). Ignored without enable_static_site.

The AI endpoint (ai.).

The application API (api.).

The application front end (app.).

The public web site (www.).

Every stage is done and none is stale — done by a real or by a simulated run.

dryrun: this platform fakes pipeline dispatch, so no stage is ever executed and provisioning never completes. simulate: each stage is marked done after a few seconds without running, so a walk can reach converged while provisioned stays false.

Of those, the stages whose latest run succeeded.

The keys of the stages whose latest run failed.

Under dryrun or simulate: what that means for this project's provisioning, for a person; null under live.

The keys of the stages waiting for an operator in the portal (manual).

The orchestration running on the project, if any.

Done stages as a share of total, 0-100, rounded.

The project.

Converged, and on real runs only: no stage is simulated. The one field that says the substrate exists.

The keys of the stages running now.

At least one stage's latest run was SIMULATED (dispatch_mode simulate): marked done, never run.

Every stage that counts, in catalogue order.

The keys of the stages done against an older manifest, in apply order: the next provisioning start re-applies exactly these.

not_started (no stage done), provisioning (some done or running), complete (every stage done), attention (a stage failed) or needs_action (a stage needs an operator in the portal). A failure outranks a stage needing an operator. Deferred stages do not count.

The stages that count (every stage but the deferred ones).

The requester's reason and the approver's note, as recorded.

When it ended (succeeded or failed); null until then.

What is promoted: app-api or www; null for a data copy.

When it was approved or rejected; null when no person decided it.

Who approved or rejected it.

Why it failed or was rejected. Host addresses and digests are masked.

The release operation's id (/release-operations/{id}).

promote_build (a promotion) or copy_data (a data copy, booked in the portal only).

release:<id>, for GET /operations/{operation_id}.

The pipeline that carries it out, once known.

Release management's own status.

The project.

When it was requested.

E-mail of the principal that asked (for a service account, its service address), or ci:<repo>@<commit>.

The API token used, when one was.

How the request was made through /api/v1. Null: booked in the portal or by a pipeline.

Where it comes from: the environment below the target (sandbox for dev, where a named build is deployed; dev for uat; uat for prod).

When the pipeline started carrying it out; null until then.

awaiting_approval: a PROD request waiting for a person in the portal. pending: approved, not yet picked up. failed also covers a rejected request (portal_status = rejected) and an operation the portal gave up on after hearing nothing (error_reason says so).

Where it goes.

The version promoted (an image tag); null for a data copy.