Runtimes API
Where agents run, the evidence about them, and the controls on managed deployments.
A runtime is an n8n instance, a Veefore-managed n8n deployment, an MCP client, an API platform or an SDK program. Connection health and enforcement status are separate: the status is computed from verification evidence, and a runtime kind is never reported above what Veefore can prove for it. Operating a runtime (pause, disable, recover) needs runtime:operate and step-up, and recovery re-verifies rather than lifting a block.
Step-up required
3 endpoints in this group require a fresh step-up authentication within the last few minutes, even for a session that already holds the permission. They are marked below.
#Endpoints
| Endpoint | Permission | Notes | |
|---|---|---|---|
GET |
/v1/runtimes |
runtime:read |
— |
POST |
/v1/runtimes |
runtime:manage |
— |
GET |
/v1/runtimes/capabilities |
none | — |
GET |
/v1/runtimes/posture |
runtime:read |
— |
GET |
/v1/runtimes/{runtimeId} |
runtime:read |
— |
PATCH |
/v1/runtimes/{runtimeId} |
runtime:manage |
— |
PUT |
/v1/runtimes/{runtimeId}/api-key |
runtime:managecredential:rotate |
step-up |
POST |
/v1/runtimes/{runtimeId}/test |
runtime:verify |
— |
POST |
/v1/runtimes/{runtimeId}/verify |
runtime:verify |
— |
POST |
/v1/runtimes/{runtimeId}/operate |
runtime:operate |
step-up, high impact |
POST |
/v1/runtimes/{runtimeId}/disconnect |
runtime:manage |
— |
GET |
/v1/runtimes/{runtimeId}/workflows |
runtime:read |
— |
GET |
/v1/runtimes/{runtimeId}/workflows/{workflowId} |
runtime:read |
— |
GET |
/v1/runtimes/{runtimeId}/runs |
runtime:read |
— |
GET |
/v1/runtimes/{runtimeId}/enforcement |
runtime:read |
— |
GET |
/v1/runtimes/{runtimeId}/bundle |
runtime:read |
— |
GET |
/v1/runtime-findings |
runtime:read |
— |
POST |
/v1/runtime-findings/{findingId}/accept |
runtime:operate |
step-up, high impact |
GET |
/v1/agents/{agentId}/enforcement |
agent:read |
— |
#What each endpoint does
#GET /v1/runtimes
List agent runtimes with connection and enforcement status.
Requires runtime:read.
#POST /v1/runtimes
Register an n8n instance, managed deployment, MCP client, API platform or SDK program.
Requires runtime:manage.
#GET /v1/runtimes/capabilities
What Veefore can and cannot enforce on each runtime kind.
Requires no console permission.
#GET /v1/runtimes/posture
Enforcement posture computed from evidence.
Requires runtime:read.
#GET /v1/runtimes/{runtimeId}
Read one runtime.
Requires runtime:read.
#PATCH /v1/runtimes/{runtimeId}
Change a runtime binding, fail-closed or admin-access setting.
Requires runtime:manage.
#PUT /v1/runtimes/{runtimeId}/api-key
Replace the n8n API key held in the credential broker.
Requires runtime:manage, credential:rotate. Step-up authentication is also required.
#POST /v1/runtimes/{runtimeId}/test
Test the connection with evidence.
Requires runtime:verify.
#POST /v1/runtimes/{runtimeId}/verify
Inspect workflows, record findings and recompute enforcement status.
Requires runtime:verify.
#POST /v1/runtimes/{runtimeId}/operate
Pause, disable or recover a runtime.
Requires runtime:operate. Step-up authentication is also required.
#POST /v1/runtimes/{runtimeId}/disconnect
Disconnect a runtime.
Requires runtime:manage.
#GET /v1/runtimes/{runtimeId}/workflows
Inspected workflows and their verification status.
Requires runtime:read.
#GET /v1/runtimes/{runtimeId}/workflows/{workflowId}
One inspected workflow with its findings.
Requires runtime:read.
#GET /v1/runtimes/{runtimeId}/runs
Verification runs and their evidence.
Requires runtime:read.
#GET /v1/runtimes/{runtimeId}/enforcement
Latest enforcement assessment and its history.
Requires runtime:read.
#GET /v1/runtimes/{runtimeId}/bundle
Deployment bundle for a managed n8n runtime.
Requires runtime:read.
#GET /v1/runtime-findings
Search bypass findings.
Requires runtime:read.
#POST /v1/runtime-findings/{findingId}/accept
Accept the risk of a finding, with a reason.
Requires runtime:operate. Step-up authentication is also required.
#GET /v1/agents/{agentId}/enforcement
An agent’s enforcement status across its runtimes.
Requires agent:read.