Operations

List Operations Plugins

List available operations plugins (builtin + custom) for a project, with their operations and risk tiers.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

project*string

Filter by project ID or name.

Lengthlength <= 100

`application/json`

curl -X GET "https://example.com/v1/operations/plugins?project=my-project"

{  "plugins": [    {      "name": "string",      "version": "string",      "tier": "read-only",      "builtin": true,      "enabled": true,      "operations": [        {          "name": "string",          "tier": "read-only",          "description": "string"        }      ]    }  ]}

Register a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Replaces any existing plugin of the same name in that project. New custom plugins are enabled by default.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

project*string

Filter by project ID or name.

Lengthlength <= 100

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

name*string

Plugin name (from the bundle's metadata.json).

Length1 <= length

version*string

Plugin version.

Length1 <= length

tier*string

Plugin-level default risk tier.

Value in

"read-only"
"mutating"
"destructive"

metadata?unknown

The verbatim metadata.json (operations[], binaries{}).

Response Body

`application/json`

curl -X POST "https://example.com/v1/operations/plugins?project=my-project" \  -H "Content-Type: application/json" \  -d '{    "name": "string",    "version": "string",    "tier": "read-only"  }'

{  "name": "string",  "version": "string",  "tier": "read-only",  "enabled": true}

Create Operations Bundle Upload URL

Get a presigned S3 URL to upload a custom operations plugin bundle ZIP. Upload the ZIP with a PUT to the returned url (sending the given Content-Type), then call POST /plugins to register it.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

project*string

Filter by project ID or name.

Lengthlength <= 100

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

name*string

Plugin name (from the bundle's metadata.json).

Length1 <= length

Response Body

`application/json`

curl -X POST "https://example.com/v1/operations/plugins/upload-url?project=my-project" \  -H "Content-Type: application/json" \  -d '{    "name": "string"  }'

{  "uploadUrl": "http://example.com",  "contentType": "string"}

Set Operations Plugin Enabled

Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are baked into the operator image and can be invoked.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Path Parameters

name*string

Plugin name.

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

project*string

Filter by project ID or name.

Lengthlength <= 100

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

enabled*boolean

Whether the plugin should be baked into the operator image.

Response Body

`application/json`

curl -X PATCH "https://example.com/v1/operations/plugins/string/enabled?project=my-project" \  -H "Content-Type: application/json" \  -d '{    "enabled": true  }'

{  "name": "string",  "builtin": true,  "enabled": true}

Get Operations Policy

Get a project's per-command approval policy. Mirrors what the operator enforces: plugin/operation / plugin/* / * patterns → auto | manual.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

project*string

Filter by project ID or name.

Lengthlength <= 100

Response Body

`application/json`

curl -X GET "https://example.com/v1/operations/policy?project=my-project"

{  "rules": [    {      "pattern": "string",      "decision": "auto"    }  ],  "default": "auto"}

Update Operations Policy

Replace a project's per-command approval policy (full rule set). Patterns are plugin/operation, plugin/*, or *; each maps to auto | manual.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

project*string

Filter by project ID or name.

Lengthlength <= 100

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

rules*array<>

The full rule set (replaces the previous one).

Response Body

`application/json`

curl -X PUT "https://example.com/v1/operations/policy?project=my-project" \  -H "Content-Type: application/json" \  -d '{    "rules": [      {        "pattern": "string",        "decision": "auto"      }    ]  }'

{  "rules": [    {      "pattern": "string",      "decision": "auto"    }  ],  "default": "auto"}

Invoke Operation

Invoke a plugin operation against a deployment. Honors the project's per-command approval policy.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

project*string

Filter by project ID or name.

Lengthlength <= 100

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

deploymentId*string

Deployment to run the operation against.

plugin*string

Plugin name.

operation*string

Operation name exposed by the plugin.

params?unknown

JSON params passed to the operation.

Response Body

`application/json`

curl -X POST "https://example.com/v1/operations/invoke?project=my-project" \  -H "Content-Type: application/json" \  -d '{    "deploymentId": "string",    "plugin": "string",    "operation": "string"  }'

{  "plugin": "string",  "operation": "string",  "tier": "read-only",  "decision": "auto",  "status": "dispatched",  "commandId": "string"}

Create Access Request

Create a pending access request covering a remediation plan's commands. Awaits the engineer gate before it is queued for the operator.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

deploymentId*string

remediationPlanId*string

title*string

reason?string

commands*array<>

Items1 <= items

Response Body

`application/json`

curl -X POST "https://example.com/v1/access-requests" \  -H "Content-Type: application/json" \  -d '{    "deploymentId": "string",    "remediationPlanId": "string",    "title": "string",    "commands": [      {        "command": "kubernetes/get-pods",        "summary": "List pods in the ingestion namespace"      }    ]  }'

{  "id": "string",  "deploymentId": "string",  "remediationPlanId": "string",  "title": "string",  "reason": "string",  "commands": [    {      "command": "kubernetes/get-pods",      "summary": "List pods in the ingestion namespace"    }  ],  "status": "pending-approval",  "approvedUntil": "string"}

Queue Access Request

Engineer gate — approve a pending access request, queuing it for the operator to materialize. Records who queued it.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Path Parameters

id*string

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

Response Body

`application/json`

curl -X POST "https://example.com/v1/access-requests/string/queue"

{  "id": "string",  "deploymentId": "string",  "remediationPlanId": "string",  "title": "string",  "reason": "string",  "commands": [    {      "command": "kubernetes/get-pods",      "summary": "List pods in the ingestion namespace"    }  ],  "status": "pending-approval",  "approvedUntil": "string",  "kubectlApprove": "string"}

Get Access Request Coordinates

The customer's kubectl approve command for a queued access request, or null until the operator has materialized the grant CR and reported its coordinates. Used to update the access-plan message after a decision.

Authorization

apiKey

AuthorizationBearer <token>

API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys

In: header

Path Parameters

id*string

Query Parameters

workspace?string

Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.

Match^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$

Length4 <= length <= 100

Response Body

`application/json`

curl -X GET "https://example.com/v1/access-requests/string/coordinates"

{  "status": "pending-approval",  "kubectlApprove": "string"}

200application/json

500application/json

201application/json

400application/json

402application/json

500application/json

200application/json

402application/json

503application/json

200application/json

404application/json

500application/json

200application/json

500application/json

200application/json

400application/json

500application/json

200application/json

402application/json

403application/json

404application/json

500application/json

201application/json

404application/json

500application/json

200application/json

404application/json

409application/json

200application/json

404application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`