Combine TAP API
The Combine TAP API manages users, servers, groups, AWS role assignments, certificates, alert events, configuration, metadata, and operational tools for a Combine deployment. The CAP- and SCAP-compatible endpoints that issue temporary AWS credentials are documented separately in the CAP / SCAP API section.
All requests must use HTTPS, except the health check and the OCSP responder, which are also served over HTTP. Except where explicitly noted, requests require mutual TLS with a valid client certificate issued for the deployment. There is no login step: the certificate's serial number identifies the caller's user account, and that account's role (user, admin, or super_admin) determines what the caller can access. A request over plain HTTP, without a valid client certificate, with a revoked certificate, or for an unknown or inactive account receives the Combine HTML error page, with HTTP status 200, instead of a JSON response.
The Users and Servers endpoints are available in two versions. Version v1 (/tap/api/v1/users and /tap/api/v1/servers) returns every user or server in full from the list endpoints and returns a presigned download link in bundlePath. Version v2 (/tap/api/v2/users and /tap/api/v2/servers) returns a summary of each user or server from the list endpoints, with optional paging and search, and returns the stored location of the certificate bundle in bundlePath. Every other endpoint uses /tap/api/v1.
Responses of at least 1,024 bytes, or of unknown length, with a JSON, plain text, HTML, CSS, or JavaScript content type are compressed with gzip when the request sends Accept-Encoding: gzip.
Requests that modify data must include the X-Requested-By header; this applies to every method except GET and HEAD. A request that omits it is rejected with 400 and an empty body. Administrative operations require an account with the admin role; the super_admin role satisfies every role check. A caller without the required role receives 403, except on POST /tap/api/v1/admin/certificate/custom, which returns 500.
For a step-by-step guide with curl and Python examples, see Call the TAP API.
Authentication
- Mutual TLS
- API Key: xRequestedBy
Authenticates the caller with an X.509 client certificate issued by the deployment. Combine identifies the caller's user account from the certificate's serial number, and that account's role determines what the caller can access.
Required on requests that change data, which is every method except GET and HEAD. Combine only checks that the header is present and accepts any value; a request without it is rejected with 400 and an empty body. The health check and OCSP endpoints are exempt, and a CORS preflight OPTIONS request is answered without it when CORS is enabled.
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Requested-By |