Information
- OpenAPI version:
3.1.0
Control-plane API
Quasar Control-Plane API 1.0.0
Section titled “Quasar Control-Plane API 1.0.0”The public/control API of the Quasar control plane (/v1). JSON in/out.
All endpoints except /v1/auth/register and /v1/auth/login require
Authorization: Bearer <access_token>. Admin endpoints (tagged
x-required-role: admin) reject a valid non-admin token with 403 — the gate
is server-enforced (RequireAuth → RequireAdmin), never UI-gated.
CLIENT VERSION GATE (#380, additive). Every bearer-authenticated endpoint
accepts the OPTIONAL request header X-Quasar-Client-Version (strict
MAJOR.MINOR.PATCH) and MAY answer 426 client_too_old when the presented
version is below the operator-configured floor. It is enforced once, in the
shared auth middleware (RequireAuth), never per handler — so rather than
repeating the parameter and the response on ~200 operations, it is declared
once here and as the reusable ClientVersionHeader parameter /
ClientTooOld response components. Absent header ⇒ no gate (web/legacy);
malformed value ⇒ treated as absent (logged, not gated). Order of checks on a
bearer request: 401 → 426 → 403 → handler. See control-api.md §Client version
gate on bearer-authenticated endpoints.
Authentication
Section titled “Authentication”bearerAuth
Section titled “bearerAuth”The opaque access_token from POST /v1/auth/login (Authorization: Bearer <access_token>).
Security scheme type: http