Skip to content

Concepts

Resource model

Every Management API request addresses a durable resource at an explicit scope. The hierarchy determines ownership, isolation, and which identifiers belong in each request.

Tenancy hierarchy

Cantora uses one fixed hierarchy: Organization → Project → Environment → Tenant → User. Resource URLs repeat the identifiers that establish their complete scope; the API never infers scope from a display name or an external provider payload.

ResourcePurposeContains
OrganizationCustomer ownership, administration, and billing boundaryProjects and management identities
ProjectOne product built on CantoraAgent Definitions, Agent Versions, and Environments
EnvironmentEither test or live, with separate runtime configuration and dataAgents, Agent Releases, Surface registrations, and Tenants
TenantRuntime and data-isolation boundary inside one EnvironmentUsers and Tenant-scoped Product State
UserOne human runtime identity on a SurfaceUser-scoped context and authority

An Organization and a Tenant may represent the same real-world company, but they remain different resources. The Organization is the management boundary; the Tenant is the runtime isolation boundary.

Agent Configuration resources

Agent behavior moves through four resources. Publication and activation are separate operations, so creating a version does not silently change runtime traffic.

  1. An Agent Definition gives one logical Agent a stable Project-scoped identity.
  2. An Agent Version is an immutable snapshot of instructions, the exact model it runs on, Tools, required bindings, and finite execution budgets.
  3. An Agent binds the Agent Definition to one Environment as a runtime principal.
  4. An Agent Release is an append-only activation of one exact Agent Version for that Agent.

Test and Live can select the same immutable Agent Version, but each Environment has its own Agent, Connections, Surface registrations, Tenants, and release history. A release affects new work only; accepted Runs stay pinned to the version and release they started on.

Continue with the generated operations for Agent Definitions, Agent Versions, Agents, and Agent Releases.

Identity and authority

A machine caller is a ServicePrincipal. Its API key proves which principal is calling; Grants determine which operations and scopes that principal may use. An Agent is a different principal kind: it runs inside one Environment for an authorized subject and is not a management credential.

The response status distinguishes authentication from authorization. A missing or invalid credential returns 401. An authenticated principal without the required authority returns 403, while some cross-scope lookups return 404 to avoid revealing whether another scope contains the resource.