Developers
The GrowLeafy Brain LIOS runtime API
These are the endpoints a LIOS client calls, and the same endpoints any other GrowLeafy client calls. They are the runtime surface, not a second product with its own accounts.
Authentication
There is no separate LIOS login.
Authentication is the canonical GrowLeafy ID. A client signs in the way every
GrowLeafy client does and calls these endpoints with a Bearer token. There is no
LIOS username, no LIOS password and no LIOS session: a second identity system
would mean a second answer to "who is this", and two answers to that question
is the thing this API exists to avoid.
- Send Authorization: Bearer <token> on every call below.
- An unauthenticated call is refused. It does not fall back to a guest or shared identity.
- Ownership is answered by the server from entitlements, never by the client and never by a build flag.
- Activation and offline packages are rate limited, and an offline package additionally requires a fresh MFA confirmation.
- A live example of the public material is the trust anchor page, which serves the public key clients pin.
Endpoints
Versioned under /api/v1/lios. Paths containing {id} take the activation identifier returned when an installation was activated.
| Method | Endpoint | Purpose |
|---|---|---|
| Identity and ownership | ||
| GET | /api/v1/lios/entitlements | What this account owns, with signatures. |
| GET | /api/v1/lios/trust-anchor | The public key clients pin. |
| GET | /api/v1/lios/vocabulary | The capability vocabulary. |
| Devices and activation | ||
| POST | /api/v1/lios/activations | Bind an installation, get a certificate. |
| POST | /api/v1/lios/activations/offline-package | Signed offline activation package, for a machine that cannot reach us; requires MFA. |
| DELETE | /api/v1/lios/activations/{id} | Release a device slot. |
| POST | /api/v1/lios/activations/{id}/revoke | Revoke a device, as an admin or support flow. |
| Releases and downloads | ||
| GET | /api/v1/lios/releases | Release catalogue for a platform. |
| GET | /api/v1/lios/compatibility | Server-side compatibility verdict. |
| POST | /api/v1/lios/downloads/authorize | Mint a short-lived signed download URL. |
What the client is not allowed to decide
Three rules explain most of the shape of this API.
- Compatibility
- The verdict comes from the server. A client may report what hardware it sees, but it does not rate itself as supported, and a build is not offered for a platform the server cannot describe. See the compatibility page.
- Ownership
- What an account owns comes from signed entitlements issued by GrowLeafy. A client verifies them; it never writes them, and an unsigned claim of ownership is not an entitlement.
- Downloads
- A download URL is minted by the server, signed, and short-lived. No storage credential and no permanent object URL is ever handed to a client, which is why authorisation is a call rather than a link.
Account-facing surfaces for the same facts are at your account. Enterprise deployment and support are described on the enterprise page and the support page.