API

Management API

The Runlayer platform provides a RESTful API for programmatic management of your organization’s MCP infrastructure. Key Capabilities:

Server Management: Create, update, and delete MCP servers
User Operations: Read user information and permissions
Audit Logs: Query activity history and security events
Analytics: Access usage metrics and insights

Coverage by Data Type

Use this table to decide which public surface to start from:

Data or configuration	Public surface
Connectors / MCP servers	Management API, dashboard, Runlayer MCP
Audit logs and security events	API/CLI, Runlayer MCP, S3 SIEM export
Analytics / usage / cost dashboards	Dashboard and Runlayer MCP CSV exports; exact API schemas are available at `/docs` on your tenant
Policies and roles	Dashboard; API coverage depends on tenant version and is documented in `/docs`
Sessions and incidents	Dashboard-first in public docs; audit events for policy/security decisions are exportable through audit-log paths
Webhooks / OTEL exports	OTLP ingestion is documented for Claude Cowork; public docs do not document a general outbound webhook export for sessions or incidents

For full interactive API documentation with request/response schemas and a built-in API explorer, visit /docs on your hosted Runlayer instance.

Authentication

For personal or organization API keys, send the key in the x-runlayer-api-key header. Do not send API keys as bearer tokens. The base URL is your Runlayer instance with the /api/v1 prefix.

export RUNLAYER_API_KEY="rl_..."
export RUNLAYER_BASE_URL="https://<your-tenant>.runlayer.com"

# List the servers you can access
curl "$RUNLAYER_BASE_URL/api/v1/servers" \
  -H "x-runlayer-api-key: $RUNLAYER_API_KEY"

Responses are JSON. Standard HTTP status codes apply — 401 for a missing or invalid key, 403 when the key’s role lacks access to the endpoint.

API Keys

Create API keys in Settings → Personal API keys or Settings → Organization API keys. (For a map of all admin settings pages, see Where to Find Key Settings.)

Personal API keys authenticate as the user who created them and work for user-scoped management API calls.
Organization API keys authenticate as the workspace and are scoped by role. Use them for workload-specific automation that should not depend on a user’s session.

Organization API key roles include:

Role	Use case
Deploy	CI/CD workflows that initialize, validate, deploy, pull, and destroy Runlayer Deploy deployments
Shadow AI Scan	Shadow AI detection scan submissions
Security Scan	Security scanner API submissions

For deploy pipelines, see CI/CD with organization API keys.

Analytics

View usage metrics

Audit Logs

Activity history

Enable

Control

Self-Hosted Deployment

Operations

Cookbook

Integrations

Connectors

Resources

Management API

Coverage by Data Type

Authentication

API Keys

Analytics

Audit Logs

​Management API

​Coverage by Data Type

​Authentication

​API Keys

​Related Resources

Analytics

Audit Logs

Management API

Coverage by Data Type

Authentication

API Keys

Related Resources