Cloudraw API · v0
Automate your Cloudraw workspace
The Cloudraw API lets your scripts and tools do what an admin does in the Cloudraw console: add and remove people, manage devices, install and update connectors, publish apps, change access rules, export the audit log and react to alerts.
Getting startedCreate a token and make your first call in two minutes.
AuthenticationAPI tokens, read-only vs full access, rotation and revocation.
API referenceEvery operation, with errors and code samples.123 operations
WebhooksSigned callbacks for alerts and events, with verification code.
The basics
| Base URL | https://cdapi.cloudraw.com |
|---|---|
| Workspace scope | Every path starts with /v0/tenants/{tenant_id}. A token only works for its own workspace. |
| Format | JSON in and out (UTF-8). Send Content-Type: application/json with a body. Times are ISO 8601 in UTC. |
| Authentication | Authorization: Bearer crw_… — a workspace API token. Details. |
| Errors | RFC 9457 problem details with a stable code. Details. |
| Retries | Send Idempotency-Key on POSTs; honour Retry-After on 429 and 503. Idempotency · Rate limits. |
| Machine-readable | OpenAPI 3.1: openapi.yaml · openapi.json. Import it into Postman, Insomnia or a code generator. |
What you can automate
Workspace
Identity
PeopleThe people who may use Cloudraw: invite, update, suspend, quarantine and remove them.13 operationsGroupsGroups of people. Access rules and apps are usually granted to groups.5 operations
Devices
DevicesComputers and phones running Cloudraw Connect: health, trust, quarantine.10 operationsEnrollmentsEnrollment codes that add a device or a connector to the workspace.4 operations
Network
ConnectorsConnectors run in your network and publish its apps to Cloudraw. Install, monitor and update them.10 operationsConnector updatesUpdate a connector now, pause or resume its automatic updates, and the workspace update policy.9 operationsAppsApps (connections): a host and port behind a connector, published to people.5 operationsPrivate networksWhole subnets behind a connector, reachable from Cloudraw Connect.5 operations
Access control
Access rulesWho may reach which app, from which device, under which conditions.9 operationsDevice trustTrust rules and device-health (posture) profiles that decide whether a device is trusted.9 operationsJust-in-time accessRequests for temporary access, their approval, and active grants.7 operations
Activity
SessionsLive sessions to your apps; end one.3 operationsAudit logEvery change and sign-in in the workspace, tamper-evident (hash chained). Read, export, verify.3 operations
Alerts & integrations
AlertsAlerts raised in the workspace and security events; acknowledge, resolve, dismiss.12 operationsWebhooksSigned HTTPS callbacks for alerts and events. See the Webhooks guide for signature verification.6 operationsLog streamingStream the audit log and alerts to your SIEM.4 operations
Support & reports
SupportYour support cases: summary and status.2 operationsDashboard tilesThe numbers on the dashboard: which tiles exist and their current values.2 operationsReportsProtection status of the workspace and the monthly customer report.2 operations
Some things stay in the console on purpose. Creating API tokens, managing workspace admins, changing the sign-in method, second-factor resets, removing or disabling a connector, remote assist and support access always need a named admin signed in to the console (often with a second-factor check). The API answers 403 panel-only for them.