---
title: "Runtimes API"
description: "Where agents run, the evidence about them, and the controls on managed deployments."
label: "Runtimes"
generated: "the API catalogue in apps/control-plane/src/routes/developer.ts"
---


A runtime is an n8n instance, a Veefore-managed n8n deployment, an MCP client, an API platform or an SDK program. Connection health and enforcement status are separate: the status is computed from verification evidence, and a runtime kind is never reported above what Veefore can prove for it. Operating a runtime (pause, disable, recover) needs `runtime:operate` and step-up, and recovery re-verifies rather than lifting a block.

:::warning Step-up required
3 endpoints in this group require a fresh step-up authentication within the last few minutes, even for a session that already holds the permission. They are marked below.
:::

## Endpoints

| | Endpoint | Permission | Notes |
| --- | --- | --- | --- |
| `GET` | `/v1/runtimes` | `runtime:read` | — |
| `POST` | `/v1/runtimes` | `runtime:manage` | — |
| `GET` | `/v1/runtimes/capabilities` | _none_ | — |
| `GET` | `/v1/runtimes/posture` | `runtime:read` | — |
| `GET` | `/v1/runtimes/{runtimeId}` | `runtime:read` | — |
| `PATCH` | `/v1/runtimes/{runtimeId}` | `runtime:manage` | — |
| `PUT` | `/v1/runtimes/{runtimeId}/api-key` | `runtime:manage`<br>`credential:rotate` | step-up |
| `POST` | `/v1/runtimes/{runtimeId}/test` | `runtime:verify` | — |
| `POST` | `/v1/runtimes/{runtimeId}/verify` | `runtime:verify` | — |
| `POST` | `/v1/runtimes/{runtimeId}/operate` | `runtime:operate` | step-up, high impact |
| `POST` | `/v1/runtimes/{runtimeId}/disconnect` | `runtime:manage` | — |
| `GET` | `/v1/runtimes/{runtimeId}/workflows` | `runtime:read` | — |
| `GET` | `/v1/runtimes/{runtimeId}/workflows/{workflowId}` | `runtime:read` | — |
| `GET` | `/v1/runtimes/{runtimeId}/runs` | `runtime:read` | — |
| `GET` | `/v1/runtimes/{runtimeId}/enforcement` | `runtime:read` | — |
| `GET` | `/v1/runtimes/{runtimeId}/bundle` | `runtime:read` | — |
| `GET` | `/v1/runtime-findings` | `runtime:read` | — |
| `POST` | `/v1/runtime-findings/{findingId}/accept` | `runtime:operate` | step-up, high impact |
| `GET` | `/v1/agents/{agentId}/enforcement` | `agent:read` | — |

## What each endpoint does

### `GET /v1/runtimes`

List agent runtimes with connection and enforcement status.

Requires `runtime:read`.

### `POST /v1/runtimes`

Register an n8n instance, managed deployment, MCP client, API platform or SDK program.

Requires `runtime:manage`.

### `GET /v1/runtimes/capabilities`

What Veefore can and cannot enforce on each runtime kind.

Requires no console permission.

### `GET /v1/runtimes/posture`

Enforcement posture computed from evidence.

Requires `runtime:read`.

### `GET /v1/runtimes/{runtimeId}`

Read one runtime.

Requires `runtime:read`.

### `PATCH /v1/runtimes/{runtimeId}`

Change a runtime binding, fail-closed or admin-access setting.

Requires `runtime:manage`.

### `PUT /v1/runtimes/{runtimeId}/api-key`

Replace the n8n API key held in the credential broker.

Requires `runtime:manage`, `credential:rotate`. Step-up authentication is also required.

### `POST /v1/runtimes/{runtimeId}/test`

Test the connection with evidence.

Requires `runtime:verify`.

### `POST /v1/runtimes/{runtimeId}/verify`

Inspect workflows, record findings and recompute enforcement status.

Requires `runtime:verify`.

### `POST /v1/runtimes/{runtimeId}/operate`

Pause, disable or recover a runtime.

Requires `runtime:operate`. Step-up authentication is also required.

### `POST /v1/runtimes/{runtimeId}/disconnect`

Disconnect a runtime.

Requires `runtime:manage`.

### `GET /v1/runtimes/{runtimeId}/workflows`

Inspected workflows and their verification status.

Requires `runtime:read`.

### `GET /v1/runtimes/{runtimeId}/workflows/{workflowId}`

One inspected workflow with its findings.

Requires `runtime:read`.

### `GET /v1/runtimes/{runtimeId}/runs`

Verification runs and their evidence.

Requires `runtime:read`.

### `GET /v1/runtimes/{runtimeId}/enforcement`

Latest enforcement assessment and its history.

Requires `runtime:read`.

### `GET /v1/runtimes/{runtimeId}/bundle`

Deployment bundle for a managed n8n runtime.

Requires `runtime:read`.

### `GET /v1/runtime-findings`

Search bypass findings.

Requires `runtime:read`.

### `POST /v1/runtime-findings/{findingId}/accept`

Accept the risk of a finding, with a reason.

Requires `runtime:operate`. Step-up authentication is also required.

### `GET /v1/agents/{agentId}/enforcement`

An agent’s enforcement status across its runtimes.

Requires `agent:read`.