Skip to main content

​
Management API

The Runlayer platform provides a RESTful API for programmatic management of your organization’s MCP infrastructure. Key Capabilities:
  • Server Management: Create, update, and delete MCP servers
  • User Operations: Read user information and permissions
  • Audit Logs: Query activity history and security events
  • Analytics: Access usage metrics and insights

​
Coverage by Data Type

Use this table to decide which public surface to start from:
Data or configurationPublic surface
Connectors / MCP serversManagement API, dashboard, Runlayer MCP
Audit logs and security eventsAPI/CLI, Runlayer MCP, S3 SIEM export
Analytics / usage / cost dashboardsDashboard and Runlayer MCP CSV exports; exact API schemas are available at /docs on your tenant
Policies and rolesDashboard; API coverage depends on tenant version and is documented in /docs
Sessions and incidentsDashboard-first in public docs; audit events for policy/security decisions are exportable through audit-log paths
Webhooks / OTEL exportsOTLP ingestion is documented for Claude Cowork; public docs do not document a general outbound webhook export for sessions or incidents
For full interactive API documentation with request/response schemas and a built-in API explorer, visit /docs on your hosted Runlayer instance.

​
Authentication

For personal or organization API keys, send the key in the x-runlayer-api-key header. Do not send API keys as bearer tokens. The base URL is your Runlayer instance with the /api/v1 prefix. 
export RUNLAYER_API_KEY="rl_..."
export RUNLAYER_BASE_URL="https://<your-tenant>.runlayer.com"

# List the servers you can access
curl "$RUNLAYER_BASE_URL/api/v1/servers" \
  -H "x-runlayer-api-key: $RUNLAYER_API_KEY"
Responses are JSON. Standard HTTP status codes apply — 401 for a missing or invalid key, 403 when the key’s role lacks access to the endpoint.

​
API Keys

Create API keys in Settings → Personal API keys or Settings → Organization API keys. (For a map of all admin settings pages, see Where to Find Key Settings.)
  • Personal API keys authenticate as the user who created them and work for user-scoped management API calls.
  • Organization API keys authenticate as the workspace and are scoped by role. Use them for workload-specific automation that should not depend on a user’s session.
Organization API key roles include:
RoleUse case
DeployCI/CD workflows that initialize, validate, deploy, pull, and destroy Runlayer Deploy deployments
Shadow AI ScanShadow AI detection scan submissions
Security ScanSecurity scanner API submissions
For deploy pipelines, see CI/CD with organization API keys.

Analytics

View usage metrics

Audit Logs

Activity history