Management API

Files and DLP

• Method: POST | Route: /api/atlasberg/files/scan | Use: The portal sends a multipart file and receives the DLP verdict (upload_id, status, reason, codes). A block comes as HTTP 200 with the verdict in the body; 400, 413 and 503 are gateway failures, not verdicts.
• Method: GET | Route: /api/atlasberg/policies | Use: The DLP policy in force.
• Method: POST | Route: /api/atlasberg/policies/test | Use: Policy test.

Approvals

• Method: GET | Route: /api/atlasberg/approvals | Use: Pending approval queue: reason codes plus the payload hash, never the text.
• Method: POST | Route: /api/atlasberg/approvals/{id}/approve and /deny | Use: Decide an approval. The approver identity is mandatory: a verified session, or the x-atlasberg-approver header or the aprovador body field.

Audit

• Method: GET | Route: /api/atlasberg/audit | Use: Trail status.
• Method: GET | Route: /api/atlasberg/audit/events | Use: Event reads.
• Method: POST | Route: /api/atlasberg/audit/verify | Use: Trail verification by the gateway itself.
• Method: GET | Route: /api/atlasberg/audit/export | Use: Signed export.
• Method: POST | Route: /api/atlasberg/audit/anchor | Use: Force an anchor.

Cost and intelligence

• Method: GET/POST, PUT/DELETE on {id} | Route: /api/atlasberg/orcamentos | Use: Soft budgets (the soft cut).
• Method: GET | Route: /api/atlasberg/economometro and /economometro/alerta | Use: The passive waste meter.
• Method: GET | Route: /api/atlasberg/agentes | Use: The observed agents inventory.
• Method: GET | Route: /api/atlasberg/cambio | Use: USD quote for BRL display in the console.
• Method: GET | Route: /api/atlasberg/finops/chargeback | Use: FinOps allocation.
• Method: GET | Route: /api/atlasberg/executivo and /executivo/export | Use: Executive panel and its export (PDF).
• Method: GET/POST, PUT/DELETE on {id}, POST/DELETE on {id}/times/{team_id} | Route: /api/atlasberg/executivo/unidades | Use: Organizational unit tree and team mapping.

Compliance

• Method: GET | Route: /api/atlasberg/compliance and /compliance/export | Use: Compliance report.

Copilot

• Method: GET | Route: /api/atlasberg/copilot | Use: Imported Copilot license panel. Always answers with data and carries modulo_licenciado (boolean) and, when false, modulo_aviso. The superficies and por_time lists may be empty, never null.
• Method: POST/DELETE | Route: /api/atlasberg/copilot/{superficie} | Use: Import or remove an inventory. POST answers 403 without the copilot module; DELETE never depends on the license.
• Method: GET, PUT/DELETE on /conexoes/{superficie} | Route: /api/atlasberg/copilot/conexoes | Use: Per-surface access configuration. GET always returns the full configuration plus modulo_licenciado and modulo_aviso; the secret is never returned. PUT answers 403 without the module.

License

• Method: GET | Route: /api/atlasberg/license | Use: Live license state: plan, expiry, grace, modules, high water mark, deployment public key.
• Method: POST | Route: /api/atlasberg/license/import | Use: Imports the signed license (raw body or multipart file, max 64 KiB).
• Method: GET | Route: /api/atlasberg/license/activation | Use: Signed activation request, to copy to the back office.
• Method: GET | Route: /api/atlasberg/license/usage | Use: Signed usage report (?period=YYYY-MM; empty aggregates the whole trail).

SSO

• Method: GET | Route: /api/atlasberg/sso/login and /sso/callback | Use: OIDC login.
• Method: POST | Route: /api/atlasberg/sso/local-login and /sso/logout | Use: Air-gapped local login and logout.
• Method: GET | Route: /api/atlasberg/sso/session | Use: Session.
• Method: GET | Route: /api/atlasberg/sso/downloads and /sso/downloads/{arquivo} | Use: List and download the atlasberg CLI binaries served by the appliance (closed list of five files, from ATLASBERG_DOWNLOADS_DIR).

Device login and personal tokens

RFC 8628 device flow. These routes are mounted outside the management chain, alongside the other /sso/ routes: the terminal calls the first two without any credential, the portal calls the next three with its session cookie, and the last two are the person's own tokens. Personal tokens carry the prefix atu- (43 base64url characters); the user code has 8 letters from the alphabet BCDFGHJKLMNPQRSTVWXZ, shown as XXXX-XXXX.

• Method: POST | Route: /api/atlasberg/sso/device/code | Use: Terminal asks for a code (client_name optional). Returns device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval.
• Method: POST | Route: /api/atlasberg/sso/device/token | Use: Terminal polls with device_code. Returns access_token and token_type Bearer. RFC errors with 400: authorization_pending, slow_down, expired_token, access_denied, invalid_grant; codigo_desconhecido with 404; limite_de_origem with 429.
• Method: GET | Route: /api/atlasberg/sso/device/pendente?codigo= | Use: Portal (cookie): the pending request behind a code, for the approval screen at /portal/dispositivo.
• Method: POST | Route: /api/atlasberg/sso/device/aprovar and /negar | Use: Portal (cookie): the person approves or denies the code.
• Method: GET | Route: /api/atlasberg/sso/tokens | Use: The person's own tokens.
• Method: DELETE | Route: /api/atlasberg/sso/tokens/{id} | Use: Revoke one of the person's tokens; atual means the token of this very request.
• Policy defaults: code valid for 10 minutes (floor 1, ceiling 30), polling interval 5 seconds (minimum 1), token valid for 7 days (1 hour to 90 days), 5 tokens per person (minimum 1), 1000 pending grants, 10 code requests and 30 polls per origin per minute. Configured in the device_flow block of sso.json.
• The token roster stores only SHA-256 digests, in <app-dir>/atlasberg-tokens-pessoais.json with mode 0600.
• On inference the token is accepted in the same headers as a virtual key and exchanged for the team's live key; see the Data plane API page.

Identity

The routes behind Settings, Identity and SSO. Mounted on the management chain like the rest of this page. Every write to the configuration produces a config.change event with resource sso and the section in the details; every directory sync cycle produces config.change with resource diretorio and actor sincronizacao_diretorio.

• Method: GET/PUT | Route: /api/atlasberg/identidade/config | Use: Read the whole screen in one call, or write one section of sso.json; validated before saving, saved atomically, applied live.
• Method: POST | Route: /api/atlasberg/identidade/config/testar | Use: Run the OIDC discovery against the configured issuer.
• Method: POST | Route: /api/atlasberg/identidade/contas-locais | Use: Create a local account.
• Method: PUT/DELETE | Route: /api/atlasberg/identidade/contas-locais/{usuario} | Use: Update or remove a local account.
• Method: PUT | Route: /api/atlasberg/identidade/contas-locais/{usuario}/senha | Use: Change a local account's password.
• Method: GET | Route: /api/atlasberg/identidade/tokens | Use: All personal tokens issued on this gateway.
• Method: DELETE | Route: /api/atlasberg/identidade/tokens/{id} | Use: Revoke a token (administrator).
• Method: POST | Route: /api/atlasberg/identidade/tokens/revogar-pessoa | Use: Revoke all of a person's tokens.
• Method: GET | Route: /api/atlasberg/identidade/diretorio | Use: Directory synchronization status.
• Method: POST | Route: /api/atlasberg/identidade/diretorio/previa | Use: Preview the synchronization plan without applying it.
• Method: POST | Route: /api/atlasberg/identidade/diretorio/sincronizar | Use: Run a synchronization cycle now.

Inherited management routes

The base engine also exposes the inherited management routes: /api/governance/* for virtual keys and teams, /api/config, /api/providers, /api/plugins, and /api/session/login, logout and ws-ticket. POST /api/session/login accepts, besides the admin pair, the local_login roster accounts that carry the console group; the session is then bound to the person and the trail names them. Logout unbinds it.

License freeze: With the control plane frozen (expired past grace, or setup), mutations under /api are refused with 403 by allowlist. GET reads always pass. Only the license routes, login and session, the /api/atlasberg/sso/ routes, /api/atlasberg/files/scan and the revocations under /api/atlasberg/identidade/tokens stay open. Editing the identity configuration and the local accounts freezes with the rest. Details on the Licensing page.

About Atlasberg Platform

Atlasberg Platform is the control layer between a company and every AI model: each request is authenticated with a virtual key, filtered by policy and DLP, routed to the right provider and written to a hash-chained audit trail. It exposes an OpenAI-compatible API, so applications only swap the base URL.

The same artifact runs in Atlasberg Cloud, in your VPC, on-premises or fully air-gapped, and is priced by capacity and modules, never per seat.

This page is part of the official documentation. To talk to the engineering team, write to [email protected] or use https://atlasberg.com/contato. Answers come within one business day.