REST API
Every endpoint Veefore serves, across 21 groups.
Veefore serves 120 endpoints across 21 groups. Everything under /v1 is the control plane. Everything under /gateway/v1 is the enforcement plane, served by a different process, and is the only surface an agent ever calls.
Read Conventions first — pagination, idempotency, scope headers and the error envelope are the same everywhere, and are not repeated per endpoint.
#Groups
Sessions, multi-factor authentication and step-up re-authentication for humans. 17 endpoints.
The registry of what an agent is allowed to call. 6 endpoints.
Organizations, workspaces, environments and the enforcement mode of each. 13 endpoints.
Registration, lifecycle control and key rotation for agent identities. 13 endpoints.
Issue, read, export and verify the signed Agent Passport. 5 endpoints.
Author, version, simulate, test, activate and roll back policy. 10 endpoints.
Grant, narrow, inspect and revoke delegated authority. 6 endpoints.
Search protected actions and run the enforcement pipeline directly. 3 endpoints.
The human approval queue and its decisions. 4 endpoints.
Risk scores, the signals behind them, and the weights you control. 3 endpoints.
Trust evidence an agent has accumulated, and how to record more. 2 endpoints.
Credential references, rotation and revocation. Secrets are never returned. 4 endpoints.
Search, export and verify the tamper-evident audit trail. 4 endpoints.
Security Center, incidents and emergency controls. 5 endpoints.
Model Context Protocol servers and per-tool authorization. 5 endpoints.
Agent-to-agent connections and passport verification. 4 endpoints.
The private agent registry for internal discovery. 2 endpoints.
Subscriptions, signing secrets and delivery. 3 endpoints.
Veefore usage metering and subscription state. 2 endpoints.
Compliance evidence, SSO, SCIM and network restrictions. 4 endpoints.
The enforcement plane. Agents talk here and nowhere else. 5 endpoints.
#Permission coverage
The table below is derived from the same catalogue the console uses to grey out endpoints a session cannot call. "Open" means the endpoint requires no console permission, which is true of authentication and of every gateway route (agents authenticate with a key, not a role).
| Group | Endpoints | Step-up | Open |
|---|---|---|---|
| Authentication | 17 | 0 | 17 |
| Tools | 6 | 0 | 1 |
| Tenancy | 13 | 1 | 0 |
| Agents | 13 | 2 | 0 |
| Passport | 5 | 0 | 0 |
| Policy | 10 | 2 | 0 |
| Delegation | 6 | 0 | 0 |
| Actions | 3 | 0 | 0 |
| Approvals | 4 | 0 | 0 |
| Risk | 3 | 0 | 0 |
| Trust | 2 | 0 | 0 |
| Credentials | 4 | 2 | 0 |
| Audit | 4 | 0 | 0 |
| Security | 5 | 1 | 0 |
| MCP | 5 | 0 | 0 |
| A2A | 4 | 0 | 0 |
| Registry | 2 | 0 | 0 |
| Webhooks | 3 | 0 | 0 |
| Billing | 2 | 0 | 0 |
| Admin | 4 | 0 | 0 |
| Gateway | 5 | 0 | 5 |