Molecule AI
Platform Management API

Reference & OpenAPI Contract

The machine-readable OpenAPI contract for the Molecule Management API, and a per-surface endpoint summary that derives from it.

Reference & OpenAPI Contract

This guide's prose is the human layer. The contract — exact paths, request bodies, response schemas, status codes — is the OpenAPI spec. This page points you at it and gives a navigational summary by surface. It does not re-author endpoint definitions, to avoid a second source of truth.

Machine-readable contract (OpenAPI)

The Management API contract is authored as an OpenAPI 3 document at workspace-server/docs/openapi/management.yaml in the molecule-core repository (branch feat/openapi-management-spec, in review as of 2026-06). This document is the single source of truth for endpoint shapes. The prose guides in this section derive from it; when they disagree, the spec wins.

The pre-existing swaggo-generated workspace-server/docs/openapi/swagger.yaml is a /schedules-only stub and is not the management contract — do not generate clients from it. Use management.yaml once it lands.

When the spec is published to the docs site, this page will embed the rendered schema. Until then, read the YAML directly from the source repo.

Endpoint summary by surface

The tables below are a navigational index, not the contract. Auth tiers are per the auth model. For request and response shapes, consult management.yaml.

Control plane — api.moleculesai.app

Build against the stable /api/v1/* prefix; /cp/* is identical but sunset-headed.

Method · PathPurposeTier
/auth/{signup,login,callback,signout,me,...}AuthKit session lifecycle
POST /api/v1/orgsCreate org (412/402/409)WorkOS session
GET /api/v1/orgs · GET/DELETE /api/v1/orgs/:slugList / get / delete (owner GDPR purge, 204)WorkOS session (+ownership)
GET /api/v1/orgs/:slug/{export,provision-status}Export, provision statusWorkOS session
GET /api/v1/orgs/:slug/instanceRouting lookuppublic
…/orgs/:slug/members[...], invitationsMember managementWorkOS session
/billing/{invoices,checkout,portal,topup,auto-credits}BillingWorkOS session
POST /webhooks/stripeStripe webhooksignature
GET /templates[/:slug]List templatesWorkOS session
POST/DELETE /api/v1/admin/templates[/:slug]Manage templatesCP admin bearer
GET/POST /api/v1/admin/orgs (?dry_run=true)Admin org opsCP admin bearer
GET /api/v1/admin/orgs/:slug/admin-tokenRead tenant-admin-tokenCP admin bearer
GET /api/v1/admin/orgs/:slug/workspacesList org workspacesCP admin bearer
DELETE /api/v1/admin/tenants/:slug (body {"confirm":"<slug>"})Tenant teardownCP admin bearer
/api/v1/admin/tenants/:slug/{redeploy,reboot,diagnostics,console-output,boot-events,scrub-artifacts}Tenant fleet opsCP admin bearer
POST /api/v1/admin/tenants/redeploy-fleetFleet rolloutCP admin bearer
POST /api/v1/admin/workspaces/:id/envForce-set workspace env (SSM + restart)CP admin bearer
/api/v1/admin/tenants/:slug/migrate-data-volumeData-volume migrationCP admin bearer
/api/v1/admin/{thin-ami,runtime-image}/{promote,list,rollback}Image/AMI pinsCP admin bearer
POST /api/v1/workspaces/provision (422 RUNTIME_PIN_MISSING)Provision workspaceprovision-secret
DELETE /api/v1/workspaces/:id?prune=Deprovisionprovision-secret + X-Molecule-Admin-Token
GET /api/v1/workspaces/:id/status?instance_id=Provision statusprovision-secret

Tenant workspace server — <org-slug>.moleculesai.app

Method · PathPurposeTier
GET/POST/DELETE /workspaces[/:id]Workspace lifecycleAdminAuth (Org API Key / ADMIN_TOKEN)
PATCH /workspaces/:id · /restart|/pause|/resume|/hibernateUpdate / lifecycleWorkspaceAuth
GET/PUT /admin/workspaces/:id/llm-billing-mode {mode}Read/set billing-mode (platform_managed|byok|disabled; null clears)AdminAuth (Org API Key)
GET/PATCH /workspaces/:id/budgetRead/set budget (budget_limits period map)AdminAuth (Org API Key)
POST/PUT /workspaces/:id/secrets {key,value}Set workspace secret (auto-restart)WorkspaceAuth
POST /settings/secretsSet org-wide secretAdminAuth
POST /org/import · GET /org/templatesCreate workspaces from org template · listAdminAuth
GET/POST/DELETE /org/tokens[/:id]Mint / list / revoke Org API KeysAdminAuth
GET/PUT /orgs/:id/plugins/allowlistPlugin allowlistAdminAuth
GET /templates · POST /templates/importTemplatesAdminAuth
GET /bundles/export/:id · POST /bundles/importBundlesAdminAuth
GET/POST /workspaces/:id/tokensPer-workspace tokens (self-service)WorkspaceAuth
POST /admin/workspaces/:id/tokensMint a per-workspace token (admin tier; used by the management MCP/CLI)AdminAuth (Org API Key / ADMIN_TOKEN)
a2a, delegations, registry, activity, schedules, memory, approvals, traces, channels, files, mcp-bridgeAgent/runtime surfaceper route

For deeper tenant route tables see Platform API (Go Backend) and the API Reference.

Tooling that consumes this contract

  • CLI — the molecule CLI (Go/cobra). Today it is primarily a runtime-bridge; management verbs are being extended and its runHTTP path does not yet attach Authorization (verify against source). See per-task CLI lines in the task guides.
  • MCPMCP Server Setup. Today's MCP server is single-tenant workspace-ops; a dedicated org-key-authed management MCP (org/secret/template/token tools) is planned and will be generated from this same OpenAPI contract.
  • Dashboard — the canonical management surface (AuthKit session + X-Molecule-Org-Slug), org ops via the /cp/* proxy, tenant ops direct.

Generate clients and MCP tools from management.yaml, not from the /schedules-only swaggo stub. The MCP, CLI, and these docs all derive from the one OpenAPI contract — keeping them downstream of a single SSOT is what prevents drift.

On this page