# DoiT Cloud Intelligence Documentation > DoiT Cloud Intelligence Public APIs Documentation Append .md to any documentation page URL to get its markdown version. ## Guides - [Get Started](https://developer.doit.com/docs/start.md): Welcome to DoiT Cloud Intelligence™ Public API - [Rate limits](https://developer.doit.com/docs/rate-limits.md): Learn about the rate limits of DoiT API. - [Terraform Provider](https://developer.doit.com/docs/tf-provider.md): The DoiT Cloud Intelligence Terraform provider lets you manage DoiT Cloud Intelligence™ via code. - [Integrating with SOPS](https://developer.doit.com/docs/managing-the-api-token-with-sops.md): How to integrate DoiT Terraform provider using best practices for authentication, and SOPS secrets. - [MCP Server](https://developer.doit.com/docs/doit-mcp-server.md): Embed DoiT Cloud Intelligence in your FinOps, development, and architecture workflows - [Resource IDs](https://developer.doit.com/docs/resource-ids.md): Get the IDs for reports, budgets, and other resources. - [Filters](https://developer.doit.com/docs/filters.md): Filters are a powerful tool you can use to access the data you need - [API Availability Matrix](https://developer.doit.com/docs/availability-matrix.md): A list of our generally available APIs and the currently supported version - [Ava](https://developer.doit.com/docs/ava-our-ai-assitant.md): Ava is DoiT’s AI-powered, cloud expert virtual assistant. - [Reports API](https://developer.doit.com/docs/reports.md): Programmatically obtain cost, usage and savings information for your cloud infrastructure with easy-to-use RESTful API. - [Sharing API](https://developer.doit.com/docs/sharing-api.md): Take the unified approach to managing permissions of Cloud Analytics resources. - [Allocations API](https://developer.doit.com/docs/allocations.md): Programmatically manage Allocations that you use across DoiT Cloud Intelligence™ for reports, budgets, alerts, anomalies, and more. - [Annotations API](https://developer.doit.com/docs/annotations-api.md): Programmatically manage Cloud Analytics report annotations with a REST API. - [Labels API](https://developer.doit.com/docs/labels-api.md): The **Labels API** allows you to programmatically manage and apply custom metadata to your DoiT Cloud Intelligence™ resources. By defining and assigning labels, you can organize your cloud governance objects—such as budgets, allocations, and reports—to better align with your organization's team structure, cost centers, or environments. - [Anomalies API](https://developer.doit.com/docs/anomalies-1.md) - [Alerts](https://developer.doit.com/docs/alerts.md): Alerts are notifications for user-defined events or conditions. You can create alerts to track different metrics and dimensions, including allocations. - [Cloud Incidents](https://developer.doit.com/docs/knownissues.md) - [CloudFlow API](https://developer.doit.com/docs/cloudflow-api.md): DoiT CloudFlow is a GenAI-powered FinOps and CloudOps automation platform. It provides the automation and intelligence you need to manage your FinOps and CloudOps processes at scale. - [DataHub API](https://developer.doit.com/docs/datahub-api.md): Ingest data from various sources for contextualized analysis of your spend. - [Invoices API](https://developer.doit.com/docs/invoice.md): Programatically access cloud infrastructure invoices - [Insights API](https://developer.doit.com/docs/insights-api.md) - [Users API Overview](https://developer.doit.com/docs/users-api-overview.md): Programmatically manage your users - [Manage License-based Assets](https://developer.doit.com/docs/manage-license-based-assets.md): Programatically add or remove licenses for your Google Workspace or Office 365 subscriptions - [Manage AWS Assets](https://developer.doit.com/docs/manage-aws-assets.md) - [Support API](https://developer.doit.com/docs/support.md) - [Platforms and Products](https://developer.doit.com/docs/support-metadata.md): Possible values for `platform` and `product` fields - [Ticket Status and Severity](https://developer.doit.com/docs/ticket-statuses.md): How to parse API status and severity values - [Partner Provisioning](https://developer.doit.com/docs/partner-endpoints.md): Reference-style documentation for partner tenant provisioning, bulk provisioning, and job polling endpoints. ## API Reference - [Welcome](https://developer.doit.com/reference/welcome.md): Welcome to DoiT Cloud Intelligence™ API Reference - [List alerts](https://developer.doit.com/reference/listalerts.md): Returns a list of alerts that your account has access to. Alerts are listed in reverse chronological order by default. - [Create an alert](https://developer.doit.com/reference/createalert.md): Creates a new alert. - [Retrieve an alert](https://developer.doit.com/reference/getalert.md): Returns an alert by the specified Id. - [Delete an alert](https://developer.doit.com/reference/deletealert.md): Deletes the alert specified by the Id. - [Update an alert](https://developer.doit.com/reference/updatealert.md): Updates the alert specified by the Id. - [List anomalies](https://developer.doit.com/reference/listanomalies.md): Returns a list of detected anomalies. Anomalies can be sorted by `startTime`, `severityLevel`, or `costOfAnomaly` using `sortBy` and `sortOrder`. By default they are sorted by `startTime` in descending order (most recent first). The sort order is total and reproducible: ties on the selected field are broken by `startTime` descending and then by anomaly `id` ascending, so the same result set always paginates in the same order. The `notifications` array is always present on each anomaly item; it is empty unless `includeNotifications=true` is supplied. **Pagination stability**: `sortBy`, `sortOrder`, `filter`, `minCreationTime`, and `maxCreationTime` must be held constant across a pagination sequence. A `pageToken` presented with any of them changed is rejected with `400`. - [Retrieve an anomaly](https://developer.doit.com/reference/getanomaly.md): Returns the specified anomaly. - [Update an anomaly's review status](https://developer.doit.com/reference/patchanomaly.md): Updates the review status of the anomaly identified by `{id}`, the same identifier `getAnomaly` accepts. Mirrors the review workflow available in the console: set `reviewStatus`, and when resolving, qualify it with `resolution` and optionally a `resolutionNote` (feedback reason and comment). The change is recorded in the anomaly's review history exactly like a console update, and the actor is derived from the API credentials - never from the request body. Validation: `reviewStatus` is one of `NEEDS_REVIEW`, `UNDER_REVIEW`, `RESOLVED`; `resolution` (`ANOMALY_CONFIRMED` or `NOT_ANOMALY`) is required when `reviewStatus` is `RESOLVED` and forbidden otherwise; `resolutionNote.reason` must belong to the given `resolution` - `SECURITY_BREACH`, `MISCONFIGURATION`, `UNINTENTIONAL_PROVISIONING`, `EXPECTED_COST_SPIKE` or `ANOMALOUS_OTHER` for `ANOMALY_CONFIRMED`, and `FAULTY_ANOMALY_DETECTION_MODEL`, `INCORRECT_DATA`, `LOW_IMPACT` or `NON_ANOMALOUS_OTHER` for `NOT_ANOMALY`. Requires the `AnomaliesManager` permission and DoiT API access (`platform:externalApi`). - [Explain an anomaly](https://developer.doit.com/reference/getanomalyexplanation.md): Returns a likely-cause explanation for the specified anomaly, alongside the deterministic facts and evidence references it was generated from. The explanation itself is AI-generated; it is always returned separately from the deterministic `facts`, and is marked as such in the `explanation` object. Generation is ephemeral: no conversation is persisted on your behalf. - [List budget suggestions](https://developer.doit.com/reference/listbudgetsuggestions.md): Returns the pending AI-generated budget suggestions for your account. The set is small (a handful of pending suggestions) and is returned in full. Each suggestion can be accepted (after you create a matching budget via `POST /analytics/v1/budgets`) or dismissed. - [Accept a budget suggestion](https://developer.doit.com/reference/acceptbudgetsuggestion.md): Marks the suggestion as accepted and links it to an existing budget. Create the budget first via `POST /analytics/v1/budgets`, then pass its `id` as `budgetId`. The budget must belong to your account. - [Dismiss a budget suggestion](https://developer.doit.com/reference/dismissbudgetsuggestion.md): Marks the suggestion as dismissed so it no longer appears in the pending list. - [List budgets](https://developer.doit.com/reference/listbudgets.md): Returns a list of budgets that your account has access to. Budgets are listed in reverse chronological order by default. Each budget includes a server-computed `riskStatus` (`atRisk`, `onTrack`, or `unknown`), and the response includes a `riskAggregations` summary of risk counts across the full filtered result set (all pages, not just the current page). - [Create a budget](https://developer.doit.com/reference/createbudget.md): Create a new budget - [Retrieve a budget](https://developer.doit.com/reference/getbudget.md): Returns the current utilization and configuration of the specified budget. - [Delete a budget](https://developer.doit.com/reference/deletebudget.md): Deletes the specified budget. - [Update a budget](https://developer.doit.com/reference/updatebudget.md): Updates the specified budget. - [List cloud incidents](https://developer.doit.com/reference/listknownissues.md): Returns a list of all the active and historical cloud incidents for Google Cloud and Amazon Web Services. Incidents are returned in reverse chronological order by default. - [Retrieve a cloud incident](https://developer.doit.com/reference/getknownissue.md): Returns the specified cloud incident. - [List allocations](https://developer.doit.com/reference/listallocations.md): Returns a list of allocations that your account has access to. Allocations are listed in reverse chronological order by default. - [Create an allocation](https://developer.doit.com/reference/createallocation.md): Creates a new allocation. - [Retrieve an allocation](https://developer.doit.com/reference/getallocation.md): Returns an allocation by the specified Id. - [Delete an allocation](https://developer.doit.com/reference/deleteallocation.md): Deletes the allocation specified by the Id. - [Update an allocation](https://developer.doit.com/reference/updateallocation.md): Updates the allocation specified by the Id. - [List annotations](https://developer.doit.com/reference/listannotations.md): Returns a list of annotations that your account has access to. Annotations are listed in reverse chronological order by default. - [Create an annotation](https://developer.doit.com/reference/createannotation.md): Creates a new annotation. - [Retrieve an annotation](https://developer.doit.com/reference/getannotation.md): Returns an annotation by the specified Id. - [Delete an annotation](https://developer.doit.com/reference/deleteannotation.md): Deletes the annotation specified by the Id. - [Update an annotation](https://developer.doit.com/reference/updateannotation.md): Updates the annotation specified by the Id. - [Retrieve a dimension](https://developer.doit.com/reference/getdimensions.md): Returns a dimension by type and key. - [List dimensions](https://developer.doit.com/reference/listdimensions.md): Returns a list of the dimensions that your account has access to. - [List labels](https://developer.doit.com/reference/listlabels.md): Returns a list of labels that your account has access to. Labels are listed in reverse chronological order by default. - [Create a label](https://developer.doit.com/reference/createlabel.md): Creates a new label. - [Retrieve a label](https://developer.doit.com/reference/getlabel.md): Returns a label by the specified Id. - [Delete a label](https://developer.doit.com/reference/deletelabel.md): Deletes the label specified by the Id. - [Update a label](https://developer.doit.com/reference/updatelabel.md): Updates the label specified by the Id. - [Assign or unassign objects to a label](https://developer.doit.com/reference/assignobjectstolabel.md): Assigns or un-assigns objects to the label specified by the ID. - [Get label assignments](https://developer.doit.com/reference/getlabelassignments.md): Returns the list of objects currently assigned to the label specified by the ID. - [List folders](https://developer.doit.com/reference/listfolders.md): Returns Cloud Analytics folders the current customer has access to. Folders are returned in id-ascending order. - [Create a folder](https://developer.doit.com/reference/createfolder.md): Creates a new Cloud Analytics folder. - [Get a folder](https://developer.doit.com/reference/getfolder.md): Returns the specified Cloud Analytics folder. - [Update a folder](https://developer.doit.com/reference/updatefolder.md): Updates the specified folder. All fields are optional. To reparent the folder, set `parentFolderId` to the target folder ID (use "root" for the top level). If a sibling at the target has the same name, the folder is auto-renamed. To move reports or allocations into or out of a folder, update the item's `folderId` field via the report or allocation PATCH endpoint. - [Delete a folder](https://developer.doit.com/reference/deletefolder.md): Deletes the specified folder. All nested folders will be deleted. Any reports or allocations contained in the folder are moved to the root. - [Reports](https://developer.doit.com/reference/reports.md): Learn how to use the Reports API to manage and interact with Cloud Analytics reports, including listing, creating, updating, and querying reports. - [List reports](https://developer.doit.com/reference/listreports.md): Returns a list of all Cloud Analytics reports that your account has access to. Reports are returned in reverse chronological order by default. - [Create a report](https://developer.doit.com/reference/createreport.md): Creates a new report. - [Run a query](https://developer.doit.com/reference/query.md): Runs a report query with the specified configuration without persisting it. Fields that are not populated will use their default values if needed. - [Get report results](https://developer.doit.com/reference/getreport.md): Returns the results of the specified report. - [Delete a report](https://developer.doit.com/reference/deletereport.md): Deletes the specified Cloud Analytics report. - [Update a report](https://developer.doit.com/reference/updatereport.md): Updates a report with the specified configuration. Only specified fields will be updated. - [Get report config](https://developer.doit.com/reference/getreportconfig.md): Returns the configuration of the specified Cloud Analytics report. - [Run a report asynchronously](https://developer.doit.com/reference/asyncruninline.md): Submits an async report execution job using an inline configuration. Returns 202 immediately with a Location header pointing to the operation status endpoint. Requires the Idempotency-Key header to ensure at-most-once submission. Duplicate requests with the same config for the same customer return the existing in-flight operation. Use ?dryRun=true to validate the config without creating an operation. - [Poll an async report run operation](https://developer.doit.com/reference/getasyncoperation.md): Returns the current status of an async report operation. Non-terminal operations (pending, running) include a Retry-After header suggesting when to poll again. This endpoint does not return result data — once status is "succeeded", fetch the result from the operation's results endpoint. When status is "failed", the error field contains an RFC 9457-shaped error. Returns 404 if the operationId does not exist, belongs to a different tenant, or has expired. - [Run a saved report asynchronously](https://developer.doit.com/reference/asyncrunreportbyid.md): Submits an async execution job for a saved report identified by ID. Returns 202 immediately with a Location header pointing to the operation status endpoint. Requires the Idempotency-Key header. Use ?dryRun=true to validate without creating an operation. - [Cancel an async report run operation](https://developer.doit.com/reference/cancelasyncoperation.md): Cancels a pending or running async report operation. Already-terminal operations (succeeded, failed, canceled) are returned as-is without any state change (idempotent). Returns 404 if the operationId does not exist or belongs to a different tenant. Use ?dryRun=true to validate the request without modifying any state. - [Get results of an async report run operation](https://developer.doit.com/reference/getasyncoperationresults.md): Returns the result of a succeeded async report operation, including report metadata (id, reportName, owner, type, createTime, updateTime, urlUI) when the operation was started against a saved report — the same shape as the sync GetReportResponse, instead of requiring a second call to GET /analytics/v1/reports/{id}/config for it. Returns 404 if the operationId does not exist, has expired, or belongs to a different tenant. Returns 425 Too Early if the operation has not yet reached a terminal state — poll the operation status endpoint, which returns its own Retry-After guidance, until it succeeds. Returns 422 if the operation terminated as failed or canceled. The poll status endpoint response does not include result data inline — this is the only endpoint that returns it. - [List custom themes](https://developer.doit.com/reference/listcustomthemes.md): Returns the list of custom color themes defined for your account. - [Create a custom theme](https://developer.doit.com/reference/createcustomtheme.md): Creates a new custom color theme. Requires Cloud Analytics Admin permission. - [Retrieve a custom theme](https://developer.doit.com/reference/getcustomtheme.md): Returns a custom theme by the specified Id. - [Update a custom theme](https://developer.doit.com/reference/updatecustomtheme.md): Updates the custom theme specified by the Id. Requires Cloud Analytics Admin permission. - [Delete a custom theme](https://developer.doit.com/reference/deletecustomtheme.md): Deletes the custom theme specified by the Id. Requires Cloud Analytics Admin permission. - [Set the active theme](https://developer.doit.com/reference/setactivetheme.md): Sets the theme active for the authenticated user. Send the reserved sentinel `themeId: "default"` to clear the active theme and fall back to the built-in default. Returns the updated active theme. - [Get the active theme](https://developer.doit.com/reference/getactivetheme.md): Returns the theme currently active for the authenticated user. `themeId` is the reserved sentinel `"default"` when no custom or preset theme is selected and the user is on the built-in default. - [Get resource permissions](https://developer.doit.com/reference/getresourcepermission-2.md): Returns the permissions associated with the specified Cloud Analytics resource. Supports Allocations, Alerts, Budgets, and Reports. - [Update resource permissions](https://developer.doit.com/reference/updateresourcepermission.md): Updates the permissions associated with the specified Cloud Analytics resource. Supports Allocations, Alerts, Budgets, and Reports. - [Retrieve an asset](https://developer.doit.com/reference/getasset.md): Returns the full details of an asset specified by the asset id. - [Create an asset](https://developer.doit.com/reference/createasset.md): Creates a new asset. - [List assets](https://developer.doit.com/reference/idofassets.md): Returns a list of all available customer assets, such as Google Cloud billing accounts, G Suite/Workspace subscriptions, etc. Assets are returned in reverse chronological order by default. - [Update an asset](https://developer.doit.com/reference/idofasset.md): Updates an existing asset, such as G Suite/Workspace or Office 365 subscription, to add or remove licenses. - [Ingest CSV file](https://developer.doit.com/reference/datahubeventscsvfile.md): Sends a batch of events to DataHub using a CSV file, either uncompressed or compressed in ZIP or GZ format. It may take up to 15 minutes for the data to become available in the DoiT console. - [Ingest JSON](https://developer.doit.com/reference/datahubevents.md): Sends a batch of events to DataHub. - [Delete specific events](https://developer.doit.com/reference/deletedatahubeventsbyfilter.md): Deletes specific events using filters. Note that the two filters, `eventIds` and `time ranges`, are mutually exclusive. - [List datasets](https://developer.doit.com/reference/listdatahubdatasets.md): Returns a list of all DataHub datasets for the customer. - [Create dataset](https://developer.doit.com/reference/createdatahubdataset.md): Creates a new DataHub dataset. A dataset is a logical grouping of events that share the same provider name. Creating a dataset allows you to define metadata such as name and description before ingesting events. - [Delete datasets](https://developer.doit.com/reference/deletedatahubdatasets.md): Deletes one or more DataHub datasets and all their associated data. - [Retrieve a dataset](https://developer.doit.com/reference/getdatahubdataset.md): Returns a specific DataHub dataset by name. - [Delete a dataset](https://developer.doit.com/reference/deletedatahubdataset.md): Deletes a specific DataHub dataset. - [Update dataset](https://developer.doit.com/reference/updatedatahubdataset.md): Updates an existing DataHub dataset's metadata. The `description`, `displayName` and `logoName` fields can be updated. Only the fields present in the request body are changed; an omitted field keeps its stored value, and an empty string clears it. The dataset `name` is immutable and serves as the resource identifier and the ingest `provider` value. To change how a dataset is displayed in the console and in report results, set `displayName`; saved reports, budgets, alerts and filters keep working because they reference `name`. If `name` is included in the request body, it must match the dataset name in the URL path. A mismatched name will be rejected with a 400 error. - [Export dataset records](https://developer.doit.com/reference/exportdatahubdatasetrecords.md): Returns one page of the live records of a DataHub dataset, as CSV (default) or as newline-delimited JSON in the same shape as the `/datahub/v1/events` payload. A time window is required: `startTime` is inclusive, `endTime` is exclusive, and the window must not exceed 366 days. Rows are ordered by their event time and event id, and pages never overlap: read the `X-Next-Page-Token` response header and pass it back as `pageToken` until the header is absent. `X-Row-Count` carries the number of rows in the page. Only live rows are returned; rows deleted through the console or the delete endpoints are excluded. Every row starts with five provenance columns (`event_id`, `batch`, `source`, `export_time`, `updated_by`) followed by the dataset's business columns in the CSV ingest vocabulary (`usage_date`, `fixed.`, `label.`, `project_label.`, `system_label.`, `metric.`). The business columns are computed from the rows of each page, so consecutive pages can have different label and metric columns; union the headers when concatenating pages. Datasets created with the FOCUS schema template use the FOCUS column names instead and can only be exported as CSV. To re-import an export into another dataset, drop the `batch`, `source`, `export_time` and `updated_by` columns, and either drop `event_id` or rename it to `id`. - [List invoices](https://developer.doit.com/reference/listinvoices.md): Returns a list of all the current and historical invoices for your organization. Invoices are returned in reverse chronological order by default. - [Retrieve an invoice](https://developer.doit.com/reference/getinvoice.md): Returns the full details of an invoice specified by the invoice number. - [Retrieve a per-payer billing explainer](https://developer.doit.com/reference/getbillingexplainerperpayer.md): Returns the invoiced cost changes for each payer in the authenticated tenant. - [Retrieve an entity invoice explainer](https://developer.doit.com/reference/getentityinvoiceexplainer.md): Returns invoiced cost changes for an invoice owned by the specified billing profile in the authenticated tenant. - [Get diagram cost snapshot](https://developer.doit.com/reference/getclouddiagramcostsnapshot.md): Returns a bounded cost snapshot for the specified diagram layer over a date window. The response composes the diagram's total spend, period-over-period change, top resources by cost (capped at 5), top services by cost (capped at 5), and a trend series (most recent 12 buckets at the requested interval). - [Get resource relationships](https://developer.doit.com/reference/getclouddiagramresourcerelationships.md): Walks the diagram graph from the anchor resource and returns related resources. Edge traversal walks the diagram's link set (same-scheme guard, BFS, cycle-safe); group traversal walks the group membership set. The result list is capped at 200 relations; `truncated` is `true` when the cap is hit. Read-only: does not mutate diagram state. - [Find diagrams](https://developer.doit.com/reference/findclouddiagrams.md): Returns diagram URLs matching the provided resource IDs. - [Get diagrams with stats](https://developer.doit.com/reference/getclouddiagramsstats.md): Returns a list of all diagrams with activity stats for the given time period. - [Get diagram components](https://developer.doit.com/reference/getclouddiagramcomponents.md): Returns diagram and layer data. When the request body is empty, returns all diagrams the caller has access to. When the body is populated, returns full diagram data including layer components projected to key display and cloud fields. - [Search diagrams and components](https://developer.doit.com/reference/searchclouddiagrams.md): Full-text search across diagram layers, components by name, and components by property values. Returns three result categories: diagram (matching layers), component (matching components by name), and prop (matching components by property values). - [Get layer components](https://developer.doit.com/reference/getstatussheetcomponents.md): Returns the specified components of a diagram layer. Provide at least one component type with one or more IDs in the request body (for example, `node` or `element`). - [Export diagram as JSON](https://developer.doit.com/reference/exportclouddiagramjson.md): Exports the full content of a diagram layer as a structured JSON document, including all components and export metadata. - [List layer snapshots](https://developer.doit.com/reference/listclouddiagramlayersnapshots.md): Returns the list of saved snapshots for the specified diagram layer. - [Get a layer snapshot](https://developer.doit.com/reference/getclouddiagramlayersnapshot.md): Returns a single snapshot of the specified diagram layer identified by its ID. - [List activity groups for a layer](https://developer.doit.com/reference/listclouddiagramactivitygroups.md): Returns snapshot activity groups for the specified diagram layer, ordered by timestamp descending. Each group contains a snapshot reference and the individual activity records that belong to it. - [List node activities](https://developer.doit.com/reference/listclouddiagramnodeactivities.md): Returns individual activity records for the specified component node, ordered by timestamp descending. - [List CloudFlows](https://developer.doit.com/reference/listcloudflows.md): Returns a cursor-paginated list of CloudFlows. - [Trigger a webhook flow](https://developer.doit.com/reference/triggercloudflowwebhook.md): Triggers execution of a published CloudFlow whose first node is a webhook trigger. The request body must be valid JSON and is passed to the flow as webhook payload data. - [List connections](https://developer.doit.com/reference/listcloudflowconnections.md): Returns a cursor-paginated list of cloud provider connections for the authenticated tenant. - [Create a connection](https://developer.doit.com/reference/createcloudflowconnection.md): Creates a new cloud provider connection. Exactly one of `gcpConfig` or `awsConfig` must be supplied. Returns `400 invalid_connection_config` when both or neither are present. - [Retrieve a connection](https://developer.doit.com/reference/getcloudflowconnection.md): Returns a single connection by ID. - [Update a connection](https://developer.doit.com/reference/updatecloudflowconnection.md): Partially updates a connection. All fields are optional. At most one of `gcpConfig` or `awsConfig` may be set per request. - [Delete a connection](https://developer.doit.com/reference/deletecloudflowconnection.md): Deletes a connection. Returns 409 if the connection is referenced by one or more flows. - [List templates](https://developer.doit.com/reference/listcloudflowtemplates.md): Returns the catalogue of available CloudFlow templates (blueprints). Templates are read-only. To create a flow from a template, use `POST /flows` with a `templateId`. - [Retrieve a template](https://developer.doit.com/reference/getcloudflowtemplate.md): Returns a single CloudFlow template by ID. - [Refine a CloudFlow from natural language intent](https://developer.doit.com/reference/refinecloudflow.md): Refines the specified CloudFlow by generating and updating nodes and connections based on the provided natural language intent. The operation streams incremental build events as they are produced. - [Build a new CloudFlow from scratch](https://developer.doit.com/reference/buildcloudflow.md): Creates a new CloudFlow and generates its nodes and connections based on the provided natural language intent. The operation streams incremental build events, including the ID of the newly created flow, as they are produced. - [Export a flow as a portable bundle](https://developer.doit.com/reference/exportcloudflowflow.md): Serializes the flow — plus every flow it references through subflow nodes — into a tenant-neutral, credential-free JSON bundle that can be imported into any tenant with the import operation. Tenant-scoped references (connections, Datastore tables, global variables) are declared as named requirements and rebound at import time; policy and Slack-channel references cannot travel and are recorded as unsupported references. The bundle never contains credentials, tenant identifiers, schedules, or execution state. - [Import a flow bundle](https://developer.doit.com/reference/importcloudflowflow.md): Creates every flow of a previously exported bundle in the authenticated tenant. Imports are create-only: each call creates new draft flows with new IDs — nothing is published and no schedule is activated until the target tenant publishes. Requirements declared by the bundle are resolved through `bindings` (requirement key → target-tenant resource ID). Unbound connections and Datastore tables leave the referencing nodes flagged incomplete; unbound global variables are auto-created. Pass `options.createMissingTables: true` to create missing Datastore tables from the schemas embedded in the bundle (structure only, never row data). **Dry-run**: pass `?dryRun=true` to validate without writing. The response is an import plan: per-requirement resolutions with candidate bindings in the target tenant, the flows that would be created, and every validation issue at once. - [Test-run a flow](https://developer.doit.com/reference/testruncloudflowflow.md): Runs a flow once as a test, and **accepts an unpublished (draft) flow** — unlike `actions/trigger`, which requires the flow to be published. Use this to verify a newly authored or edited flow before publishing it. Execution is identical to a production run: the same graph, the same bound connections, the same credentials, and the same approval behaviour. An approval-gated node still parks the run and its side effect still waits for a real approval — there is no request that skips one. The run is recorded as a test, so it does not appear in run history, does not count towards dashboard statistics, does not become a dashboard widget's data source, and does not consume a scheduled-run budget. It does hold the flow's concurrency lock, so a `409` is returned while the flow is already running. The flow's first node must be a webhook, scheduled, or manual trigger. Before dispatching, the flow is validated with the same checks publish applies — a draft has never been through them. A flow that fails returns `422` listing every offending node at once, so all of them can be fixed in one pass. Poll the `Location` URL to follow the run and read what each node produced. Pass `?dryRun=true` to validate the flow without starting a run. - [List a flow's runs](https://developer.doit.com/reference/listcloudflowflowruns.md): Returns a flow's runs, newest first. Use `mode` to separate test runs from production ones — test runs are included by default. Per-node detail is not included here; fetch a single run to read what each node consumed and produced. - [Read a flow run, node by node](https://developer.doit.com/reference/getcloudflowflowrun.md): Returns a run's status and, for each node, the JSON it consumed and produced. This is how you find out *why* a run failed, or that it "succeeded" while producing the wrong data. **`input` is null for most node types, and that is not an error.** Only action nodes — the AWS, GCP, Azure, Oracle, DoiT and admin operations — record their inputs. Transform, code, branch, switch, datastore, subflow and trigger nodes record none, so their `input` is always null. `output` is recorded by every node that finishes, so read a transform's behaviour from its `output`. Payloads appear as soon as a node reports a terminal status, so a poll loop can read results while later nodes are still running. Any value the node's schema marks sensitive is replaced with a redaction marker; credentials and connection configuration never appear. Each `input` and `output` is capped at 64KB. When a payload exceeds that, whole entries are dropped from the end, `truncated` is true, and `totalBytes` reports the untruncated size — nothing is silently cut, and what you receive is always valid JSON. Runs belonging to another tenant, or to a different flow, return `404`. Nodes inside a fan-out currently report only the last path to finish. - [Get customer](https://developer.doit.com/reference/getcustomer.md): Returns the customer, including its general settings and contact info, scoped to `{customerId}`. `{customerId}` must match the customer resolved from the bearer token; a token scoped to a different customer gets `403`, even if that customer would otherwise be reachable through a reseller/MTS relationship. Requires the `Settings` permission and DoiT API access (`platform:externalApi`). - [Update customer](https://developer.doit.com/reference/updatecustomer.md): Partially updates the general settings and contact info of the customer identified by `{customerId}`. `{customerId}` must match the customer resolved from the bearer token; a token scoped to a different customer gets `403`, even if that customer would otherwise be reachable through a reseller/MTS relationship. Requires the `Settings` permission and DoiT API access (`platform:externalApi`); updating `allowedInviteDomains` additionally requires the `UsersManager` permission. The request body must use `application/merge-patch+json` (RFC 7396): an omitted field leaves the current value unchanged, and an explicit `null` also leaves it unchanged, except for `urlSlug`, where an explicit empty string removes the customer's active URL slug rather than leaving it unchanged. Fields are nested exactly as `getCustomer` returns them - `currency` and `allowedInviteDomains` under `settings`, `emails` under `contact` - so every value is read and written at the same path. `settings.currency` accepts only the codes listed in the schema and cannot be cleared; `allowedInviteDomains` and `contact.emails` are cleared with an empty array. - [List roles](https://developer.doit.com/reference/listroles.md): Returns a list of roles. - [List organizations](https://developer.doit.com/reference/listorganizations.md): Returns a list of organizations. - [List users](https://developer.doit.com/reference/listusers.md): Returns a list of users in the organization, including both active users and invited users. When the `email` query parameter is provided, returns only the user matching that email address. If no user is found for the given email, an empty list is returned. - [Delete user](https://developer.doit.com/reference/deleteuser.md): Deletes a user. - [Update user](https://developer.doit.com/reference/updateuser.md): Updates user information, including name, job function, phone, language, and role. - [Invite user](https://developer.doit.com/reference/inviteuser.md): Invites a new user to the organization with specified role and organization. - [Resend invite](https://developer.doit.com/reference/resendinvite.md): Resets the invite expiry to 48 hours from now, invalidates the previous invite token (so old email links stop working), and triggers a fresh invitation email. Works on invites in any state including `Cancelled` — resending a cancelled invite reactivates it to `Pending`. Returns `404` if no invite exists for the given ID (never created, or already accepted and removed). Requires `usersManager` permission. - [Cancel invite](https://developer.doit.com/reference/cancelinvite.md): Marks the invite as `Cancelled` and invalidates the invite token so any outstanding email links stop working. The invite document is retained (soft cancel) — the user row remains visible in `GET /iam/v1/users` with `inviteStatus: Cancelled`. Use `DELETE /iam/v1/users/{id}` to fully remove the record. Returns `404` if no invite exists for the given ID, and `409` if the invite is already cancelled. Requires `usersManager` permission. - [List countries available for geographic access](https://developer.doit.com/reference/listgeographicaccesscountries.md): Returns the canonical ISO 3166-1 alpha-2 country catalogue used by geographic access policies. - [List custom regions](https://developer.doit.com/reference/listgeographicaccesscustomregions.md): Returns the ready custom regions owned by the authenticated tenant. Requires the UsersManager permission. - [Create a custom region](https://developer.doit.com/reference/creategeographicaccesscustomregion.md): Creates a custom region owned by the authenticated tenant. The tenant must be a customer-hierarchy root. Requires the UsersManager permission. - [Get a custom region](https://developer.doit.com/reference/getgeographicaccesscustomregion.md): Returns a custom region owned by the authenticated tenant. Requires the UsersManager permission. - [Update a custom region](https://developer.doit.com/reference/updategeographicaccesscustomregion.md): Updates the name, country membership, or both for a custom region owned by the authenticated tenant. Requires the UsersManager permission. - [Delete a custom region](https://developer.doit.com/reference/deletegeographicaccesscustomregion.md): Deletes a custom region owned by the authenticated tenant. Assigned regions cannot be deleted. Requires the UsersManager permission. - [Get a customer's geographic scope](https://developer.doit.com/reference/getcustomergeographicaccessscope.md): Returns the geographic scope for a target customer. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Targets outside that hierarchy are returned as not found. Requires the UsersManager permission. - [Replace a customer's geographic scope](https://developer.doit.com/reference/updatecustomergeographicaccessscope.md): Atomically replaces the geographic scope for a target customer. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Repeating an identical request is idempotent. Requires the UsersManager permission. - [Clear a customer's geographic scope](https://developer.doit.com/reference/deletecustomergeographicaccessscope.md): Clears the geographic scope for a target customer, leaving it unassigned. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Repeating the request is idempotent. Requires the UsersManager permission. - [Get a user's geographic scope](https://developer.doit.com/reference/getusergeographicaccessscope.md): Returns the geographic scope assigned to a user who belongs to the target customer. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Targets outside that hierarchy are returned as not found. Requires the UsersManager permission. - [Replace a user's geographic scope](https://developer.doit.com/reference/updateusergeographicaccessscope.md): Atomically replaces the geographic scope assigned to a user who belongs to the target customer. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Repeating an identical request is idempotent. Requires the UsersManager permission. - [Clear a user's geographic scope](https://developer.doit.com/reference/deleteusergeographicaccessscope.md): Clears the geographic scope assigned to a user who belongs to the target customer, leaving it unassigned. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Repeating the request is idempotent. Requires the UsersManager permission. - [List customer groups](https://developer.doit.com/reference/listcustomergroups.md): Returns the ready customer groups owned by the authenticated tenant. Requires the UsersManager permission. - [Create a customer group](https://developer.doit.com/reference/createcustomergroup.md): Creates a customer group owned by the authenticated tenant. Requires the UsersManager permission. - [Get a customer group](https://developer.doit.com/reference/getcustomergroup.md): Returns a customer group owned by the authenticated tenant. Requires the UsersManager permission. - [Update a customer group](https://developer.doit.com/reference/updatecustomergroup.md): Updates the name, customer membership, or both for a customer group owned by the authenticated tenant. Requires the UsersManager permission. - [Delete a customer group](https://developer.doit.com/reference/deletecustomergroup.md): Deletes a customer group owned by the authenticated tenant. Groups with assigned users cannot be deleted. Requires the UsersManager permission. - [Assign a user to a customer group](https://developer.doit.com/reference/assigncustomergroupuser.md): Assigns a user to a customer group owned by the authenticated tenant. Requires the UsersManager permission. - [Unassign a user from a customer group](https://developer.doit.com/reference/unassigncustomergroupuser.md): Unassigns a user from a customer group owned by the authenticated tenant. Requires the UsersManager permission. - [List commitments](https://developer.doit.com/reference/listcommitments.md): Returns a list of commitments for the customer. Commitments are listed in reverse chronological order by default. - [Retrieve a commitment](https://developer.doit.com/reference/getcommitment.md): Returns a commitment by the specified Id. - [List insights](https://developer.doit.com/reference/getinsightresults.md): Returns a paginated list of insights with their aggregate summaries (savings, risk counts). Use query parameters to filter by status, category, provider, or priority. Does not include individual resource-level results — use the resource-results endpoint for those. - [Create insights (batch)](https://developer.doit.com/reference/postinsightresults.md): Creates or updates multiple insights in a single batch request. Each insight in the batch includes its metadata and resource results inline. For granular control over insight metadata and resource results independently, use the single-insight and resource-results endpoints instead. - [Delete insights (batch)](https://developer.doit.com/reference/deleteinsightresults.md): Deletes all insights matching the specified key from the batch source. This removes the insight and all its associated resource results. For single-insight deletion, use `DELETE /source/{sourceID}/insight/{insightKey}` instead. - [Update Insight Status](https://developer.doit.com/reference/updateinsightstatus.md): Updates the display status (e.g. actionable, acknowledged, dismissed) of a single insight. Only insights created via the public API can have their status changed. Deprecated: use the status field on the create/update insight endpoint instead. - [List resource results for an insight](https://developer.doit.com/reference/getinsightresourceresults.md): Returns a paginated list of individual resource-level results for a specific insight. Each resource result represents a single cloud resource (e.g. an EC2 instance, a GCS bucket) affected by the insight, along with its risk scores or potential savings. - [Retrieve an insight](https://developer.doit.com/reference/getinsightresult.md): Returns the metadata and aggregate summary for a single insight identified by source and key. Does not include individual resource-level results — use the resource-results endpoint for those. - [Create or update an insight](https://developer.doit.com/reference/postinsightresult.md): Creates or updates a single insight for the given source and key. If an insight with the same key already exists for the source, it will be updated. Resource results are managed separately via the resource-results endpoint. - [Delete an insight](https://developer.doit.com/reference/deleteinsightresult.md): Permanently deletes a single insight and all its associated resource results. Only insights created via the public API can be deleted. - [Replace resource results for an insight](https://developer.doit.com/reference/postinsightresourceresults.md): Replaces all resource results for the specified insight. Any existing unresolved resource results not present in the new set will be removed. The response includes server-computed fields (severity, resolved, enhancement) for each resource result. To delete all resource results, send an empty array. - [Ask Ava (streaming)](https://developer.doit.com/reference/askavastreaming.md): Send a question to Ava and receive a streaming response via Server-Sent Events (SSE). The response streams back events containing the answer text, conversation ID, and message metadata. - [Ask Ava](https://developer.doit.com/reference/askavasync.md): Send a question to Ava and receive a synchronous response. Set `ephemeral` to `true` to skip conversation persistence (recommended for programmatic consumers). When `ephemeral` is `false` (default), the response includes a `conversationId` that can be used with the delete endpoint. - [Submit feedback](https://developer.doit.com/reference/avafeedback.md): Submit feedback on an Ava answer to help improve response quality. - [Delete a conversation](https://developer.doit.com/reference/deleteavaconversation.md): Deletes an Ava conversation by its ID. - [Get supported features for a connected account](https://developer.doit.com/reference/getcloudconnectsupportedfeatures.md): Returns the list of supported features and their permission status for a cloud account connected via CloudConnect. The account must belong to the authenticated customer. Supports AWS and Azure accounts. - [Create or update an AWS account role](https://developer.doit.com/reference/createaccountrole.md): Creates or updates a CloudConnect document for an AWS account. Unlike the CloudFormation variant, this endpoint does not update Firestore channel documents or require a CloudFormation stack ID. - [Get an AWS account](https://developer.doit.com/reference/getawsaccount.md): Returns the current state of an AWS account including role, supported features, and optional S3 bucket configuration. - [Delete an AWS account role](https://developer.doit.com/reference/deleteaccountrole.md): Deletes a CloudConnect document for an AWS account. - [Update an AWS feature](https://developer.doit.com/reference/updateawsfeature.md): Updates an AWS feature for an existing CloudConnect account. Unlike the CloudFormation variant, this endpoint does not update Firestore channel documents, require a CloudFormation stack ID, or handle StackSet member role ARNs. - [List service quotas](https://developer.doit.com/reference/listservicequotas.md): Returns the latest service quota usage snapshots collected by DoiT for the authenticated customer. Results include only quotas retained by DoiT's monitoring collectors and are not a complete or live inventory from the cloud providers. Results are sorted by utilization percentage in descending order. - [Create reseller handshakes (batch)](https://developer.doit.com/reference/createbillingtransferresellerhandshakes.md): Maps reseller to distributor; also sends the handshake if required, as part of AWS billing transfer onboarding. Distributor-only; callers without the ChannelOps distributor tier entitlement receive `403`. Each item in the batch is processed independently; per-item outcomes are returned in `results[]` with HTTP `200` even when some items fail. Malformed items (missing fields, duplicate `resellerPmaAccountId` within the batch) are rejected up front with `422` and reported in `invalidItems`, and none of the batch is processed in that case. - [List program management accounts](https://developer.doit.com/reference/listbillingtransferprogrammanagementaccounts.md): Lists the caller's program management accounts (PMAs) and the reseller tenants mapped to each one, including AWS Organizations handshake status per account. Distributor-only. - [Create end-customer mappings (batch)](https://developer.doit.com/reference/createbillingtransferendcustomermappings.md): Maps end-customer AWS accounts under a reseller's PMA to their DoiT tenant, as part of AWS billing transfer onboarding. Reseller-only; distributors are explicitly denied (`403`). Unlike `POST /billingtransfer/v1/resellerhandshakes`, this endpoint has no `Idempotency-Key` requirement and no `dryRun` support. This path is a deliberate exception to the de-hyphenation convention used by the sibling `resellerhandshakes` and `programmanagementaccounts` paths — it stays hyphenated to match the existing Go route and its console-facing equivalent. Each item in the batch is processed independently; per-item outcomes are returned in `results[]` with HTTP `200`. Malformed items are rejected up front and reported in `invalidItems` without processing any of the batch. - [Get program management account status](https://developer.doit.com/reference/getbillingtransferprogrammanagementaccountsstatus.md): Lightweight polling surface for the onboarding wizard: returns each of the caller's PMAs with only its IAM status/diff and timestamps — no tenant fan-out, no handshake aggregation, no pagination. Distributor-only. - [List end-customers under a reseller PMA](https://developer.doit.com/reference/listbillingtransferendcustomers.md): Lists the end-customer AWS account mappings under a reseller's program management account, identified by `dpmaId` and `resellerPmaAccountId`. Callable by the reseller who owns the PMA or the distributor who owns the DPMA. - [List end-customers under a reseller PMA, by reseller PMA alone](https://developer.doit.com/reference/listbillingtransferendcustomersbyreseller.md): Same result as `GET /billingtransfer/v1/end-customers`, identified by `resellerPmaAccountId` alone (no `dpmaId` needed). Callable by the reseller who owns the PMA or the distributor who owns its DPMA. - [List the caller's reseller PMA nodes](https://developer.doit.com/reference/listbillingtransferreselleraccounts.md): Lists every reseller program management account (RPMA) node belonging to the calling reseller, with handshake state and status but without end-customer tenants — the reseller-tier analog of `GET /billingtransfer/v1/programmanagementaccounts`. - [List the caller's reseller PMA nodes with their end-customer tenants](https://developer.doit.com/reference/listbillingtransferreselleraccountswithtenants.md): Lists every reseller PMA node belonging to the calling reseller, each with the end-customer tenants connected under it — the reseller-tier analog of `GET /billingtransfer/v1/programmanagementaccounts`. `region`, `iamStatus` and `lastRefreshTime` are inherited from the parent DPMA root; the reseller node itself carries no IAM/region metadata of its own. - [List contracts](https://developer.doit.com/reference/listcontracts.md): Lists the contracts held by the specified customer. Callable by a T1/T2 PartnerOps principal for its own tenant or any descendant tenant. Read access requires contractsReadOnly, contractsViewer, or a write-capable role (without contractsReadOnly). User API tokens must include the matching permission in their scope. - [Create contract](https://developer.doit.com/reference/createcontract.md): Creates a draft contract for the specified customer. Requires the caller to be the direct parent (T1 for a T2-level contract, T2 for a T3-level contract). Write access requires a role without contractsReadOnly; user API tokens must include the matching permission in their scope. - [Retrieve a contract](https://developer.doit.com/reference/getcontract.md): Returns the specified contract. - [Update contract](https://developer.doit.com/reference/updatecontract.md): Creates a new version of the contract. The contract type is immutable and cannot be changed by an update. - [Activate contract](https://developer.doit.com/reference/activatecontract.md): Transitions a draft contract to active or scheduled (when the start date is in the future). Produces the same system state as activating via the Console. - [Cancel contract](https://developer.doit.com/reference/cancelcontract.md): Cancels (deactivates) a contract. Active contracts cannot be deleted; cancel is the terminal operation. - [List contract templates](https://developer.doit.com/reference/listcontracttemplates.md): Lists contract templates owned by the authenticated tenant (from the bearer token). Requires ContractTemplatesAdmin, DoiT API access (`platform:externalApi`), and the `channelops:contracts:templates` entitlement. - [Create contract template](https://developer.doit.com/reference/createcontracttemplate.md): Creates a contract template for the authenticated tenant (from the bearer token). Requires ContractTemplatesAdmin, DoiT API access (`platform:externalApi`), and the `channelops:contracts:templates` entitlement. - [Get contract template](https://developer.doit.com/reference/getcontracttemplate.md): Returns a single contract template owned by the authenticated tenant (from the bearer token). Requires ContractTemplatesAdmin, DoiT API access (`platform:externalApi`), and the `channelops:contracts:templates` entitlement. - [Update contract template](https://developer.doit.com/reference/updatecontracttemplate.md): Updates a contract template owned by the authenticated tenant (from the bearer token). Requires ContractTemplatesAdmin, DoiT API access (`platform:externalApi`), and the `channelops:contracts:templates` entitlement. - [Archive contract template](https://developer.doit.com/reference/archivecontracttemplate.md): Soft-deletes (archives) a contract template owned by the authenticated tenant (from the bearer token). Instantiated contracts are unaffected. Requires ContractTemplatesAdmin, DoiT API access (`platform:externalApi`), and the `channelops:contracts:templates` entitlement. - [List GCP billing accounts](https://developer.doit.com/reference/listgcpbillingaccounts.md): Returns all GCP Billing Accounts accessible to the authenticated tenant. Use as the entry point to discover GCP billing account IDs, and billing-account-level onboarding status of the available product lines and savings metrics. Each item includes metadata, CUD export health, trailing 30-day aggregate statistics, and precomputed YTD/lifetime savings totals per product line. Sum across items for customer-level totals. - [Get a GCP billing account](https://developer.doit.com/reference/getgcpbillingaccount.md): Returns a single GCP Billing Account with the same list-item fields as List GCP Billing Accounts, plus the Overview time series. Use this when you need a single billing account's Console Overview in one call (identity and onboarding status, 30-day ESR and savings, YTD/lifetime totals, CUD export health, and the data behind Cost Summary and CUD Coverage charts) without fetching every billing account. Fields that drive the Overview tab in the DoiT console: - `stats30d`: last 30 days ESR and realized savings per product line (ESR and Savings cards). - `monthlyStats`: last 6 calendar months of ESR, on-demand cost, and cost with savings per product line (Cost Summary chart, and month-over-month card trends). - `dailyCoverage`: last 30 days of CUD coverage breakdown per product line (CUD Coverage chart). - `savingsTotals`: year-to-date and lifetime realized savings per product line (shown under the Savings card). Lifetime is bounded by PerfectScale for Commitments onboarding start. - [List GCP spend-based Committed Use Discounts](https://developer.doit.com/reference/listgcpspendcuds.md): Returns a paginated list of spend-based CUDs for the billing account. Optionally filter by CUD state (`status`). Omit to return CUDs in all states. - [List GCP resource-based Committed Use Discounts](https://developer.doit.com/reference/listgcpresourcecuds.md): Returns a paginated list of resource-based (vCPU / memory) CUDs for the billing account. Optionally filter by CUD state (`status`). Omit to return CUDs in all states. - [List GCP recommendations](https://developer.doit.com/reference/listgcprecommendations.md): Returns commitment purchase recommendations for the billing account, filtered to the term preferred in the customer's compute settings (`preferredCommitmentPeriod`). **`gcp_service` and `region` filters**: a `gcp_service` is required to select which product line's settings determine the term — omitting both returns no recommendations. Supply `gcp_service` alone to return all regions for that service; supply both to return a single service/region scope. `region` requires `gcp_service` — a request with `region` but no `gcp_service` returns `400` with code `gcp_service_required`. Invalid `gcp_service` or `region` values return `400`. In v1 the only supported values are `gcp_service=compute` and `region=global`. `404` is returned only when the billing account does not exist or the caller cannot access it. A billing account with no matching recommendation documents returns `200` with an empty `items` array. - [Get a GCP recommendation](https://developer.doit.com/reference/getgcprecommendation.md): Returns the recommendation for one product line (`gcp_service`) and region scope on the GCP billing account, including analysis metrics and time-bucketed eligible spend. Use `granularity` to choose the eligible-spend bucket size (defaults to `day`). `region` is an optional query param, defaulting to `global`. In v1 the only supported values are `gcp_service=compute` and `region=global`. When no stored recommendation matches the scope, `recommendation` is omitted and `estimatedEquivalentRecommendedCommitment` is `0`. - [List GCP planned purchases](https://developer.doit.com/reference/listgcpplannedpurchases.md): Returns the laddering projections for the billing account, grouped by PS4C product line (`service`) and region. Each service group lists one entry per available `gcp-purchases-projection` document for that scope (v1: `compute` / `global` only). With no filters, returns all existing projection documents in stable order: service groups sorted alphabetically by `service`; within each group, regions sorted with `global` first, then remaining regions alphabetically. Services with no projection documents are omitted (not returned as empty groups). When a filter matches no documents, the response is an empty `items` array (not `404`). Partial projection documents return only the fields available in storage. **`gcp_service` and `region` filters**: omit both to return all available services and their regions; supply `gcp_service` alone to return all regions for that service; supply both to return a single service/region scope. `region` requires `gcp_service` — a request with `region` but no `gcp_service` returns `400` with code `gcp_service_required`. Invalid `gcp_service` or `region` values return `400` with code `validation_failed`. `404` is returned only when the billing account does not exist or the caller cannot access it. A billing account that is not onboarded for PS4C still returns `200` with an empty `items` array when no projection documents exist — use `GET /ps4commitments/v1/gcp/billing-accounts` (or get-by-id) for onboarding status. **Pagination**: results are paginated by **service group** (a whole group is never split across pages). Groups are sorted alphabetically by `service`. Use `maxResults` to limit page size (default 50, max 500). When more groups remain, the response includes a non-null `pageToken`; pass it unchanged on the next request with the same query parameters (`gcp_service`, `region`, `maxResults`). `rowCount` is the number of service groups in this page. An invalid `pageToken` returns `400` with code `pagination_token_invalid`; an expired token returns `400` with code `pagination_token_expired`. - [List billing account engine settings](https://developer.doit.com/reference/listgcpbillingaccountssettings.md): Returns one item per onboarded GCP Billing Account. Each item includes that billing account's recommendation and automation engine settings for each product line activated on it (`compute`). Settings are stored independently on each billing account. Existing customer-level settings are copied lazily when an account is first read or initialized; if no valid legacy value exists, the complete backend defaults are materialized once on the account. Only product lines that are activated/onboarded for a given billing account are returned. In the DoiT Console, these settings are edited on an account's Settings tab. - [List AWS organizations](https://developer.doit.com/reference/listawsorganizations.md): Returns all AWS organizations (accounts) accessible to the authenticated tenant. Use as the entry point to discover AWS organization account IDs, and organization-level onboarding status of the available commitment types and savings metrics. Each item includes metadata, trailing 30-day aggregate statistics, precomputed YTD/lifetime savings totals per Savings Plan (SP) type, and estimated monthly potential savings (`monthlyPotentialSavings`) per SP type from the latest projection. Sum across items for customer-level totals. - [Get an AWS organization](https://developer.doit.com/reference/getawsorganization.md): Returns a single AWS organization with the same list-item fields as List AWS Organizations, plus the Overview time series. Use this when you need a single organization's Console Overview in one call (identity and onboarding status, 30-day ESR and savings, YTD/lifetime totals, monthly potential savings, and the data behind Cost Summary and Commitment Coverage charts) without fetching every organization. Fields that drive the Overview tab in the DoiT console: - `stats30d`: last 30 days ESR and realized savings per SP type (ESR and Savings cards). - `monthlyStats`: last 6 calendar months of ESR, on-demand cost, and cost with savings per SP type (Cost Summary chart, and month-over-month card trends). - `dailyCoverage`: last 30 days of commitment coverage breakdown per SP type (Commitment Coverage chart). - `savingsTotals`: year-to-date and lifetime realized savings per SP type (shown under the Savings card). Lifetime is bounded by PerfectScale for Commitments onboarding start. - `monthlyPotentialSavings`: estimated monthly additional savings per SP type from the latest purchase projection. - [List member accounts under an AWS organization](https://developer.doit.com/reference/listawsmemberaccounts.md): Returns all member AWS accounts under the specified AWS organization that have active or historical commitment coverage. Includes 30-day statistics and estimated monthly potential savings (`monthlyPotentialSavings`) per Savings Plan (SP) type. - [Get a member account](https://developer.doit.com/reference/getawsmemberaccount.md): Returns a single member AWS account with the same list-item fields as List member accounts, plus the Overview time series. Use this when you need a single members Console Overview in one call (identity and onboarding status, 30-day ESR and savings, YTD/lifetime totals, monthly potential savings, and the data behind Cost Summary and Commitment Coverage charts) without fetching every member account. Fields that drive the Overview tab in the DoiT console: - `stats30d`: last 30 days ESR and realized savings per SP type (ESR and Savings cards). - `monthlyStats`: last 6 calendar months of ESR, on-demand cost, and cost with savings per SP type (Cost Summary chart, and month-over-month card trends). - `dailyCoverage`: last 30 days of commitment coverage breakdown per SP type (Commitment Coverage chart). - `savingsTotals`: year-to-date and lifetime realized savings per SP type (shown under the Savings card). Lifetime is bounded by the parent organization's PerfectScale for Commitments onboarding start. - `monthlyPotentialSavings`: estimated monthly additional savings per SP type from the latest purchase projection. - [List AWS Savings Plans](https://developer.doit.com/reference/listawssavingsplans.md): Returns a paginated list of Savings Plans for the specified AWS organization. Optionally filter by plan type (`type`) and state (`status`). Omit both filters to return all plans for the AWS organization. - [List AWS Reserved Instances](https://developer.doit.com/reference/listawsreservedinstances.md): Returns a paginated list of Reserved Instances (RIs) for the specified AWS organization. Optionally filter by state, instance type, instance family, region, and offering class. Omit filters to return all RIs for the AWS organization. - [List account and commitment settings per AWS organization](https://developer.doit.com/reference/listawsorganizationssettings.md): Returns one item per onboarded AWS organization. Each item includes that AWS organization's commitments purchasing account (`purchaseAccountId`) and commitment settings for each commitment type activated on that AWS organization (`compute`, `database`). Commitment settings cover recommendation and automation preferences (policy, term, payment option, automation mode, commitment limits, and related fields). They are stored at the customer level per commitment type and therefore have the same values on every AWS organization item. Only `purchaseAccountId` and which commitment types appear differ per AWS organization. In the DoiT Console, commitment settings are edited on an account's Settings tab but apply across all AWS organizations for that commitment type; the purchasing account is set per AWS organization on Accounts Settings. - [List AWS recommendations](https://developer.doit.com/reference/listawsrecommendations.md): Returns commitment purchase recommendations for the AWS organization, keyed by commitment type (`compute`, `database`). A commitment type is present only when it is onboarded and a recommendation is available. - [Get an AWS recommendation](https://developer.doit.com/reference/getawsrecommendation.md): Returns the recommendation for one commitment type (`serviceId`) on the AWS organization, including analysis metrics and time-bucketed eligible spend. Use `granularity` to choose the eligible-spend bucket size (defaults to `day`). - [List AWS planned purchases](https://developer.doit.com/reference/listawsplannedpurchases.md): Returns planned purchases (laddering projections) for the AWS organization. One item per commitment type that has a projection available (typically `compute` and/or `database`; up to four commitment types as PerfectScale for Commitments expands). With no filters, returns all available planned-purchase items for the AWS organization in stable commitment-type order (`compute`, then `database`, then any future commitment types in enum order). When a filtered commitment type has no planned purchases, the response is an empty `items` array (not `404`). Partial items return only the fields available at response time. `404` is returned only when the AWS organization does not exist or the caller cannot access it. An AWS organization that is not onboarded for PerfectScale for Commitments still returns `200` with an empty `items` array when no planned purchases exist — use `GET /ps4commitments/v1/aws/organizations` (or get-by-id) for `onboardingStatus`. **Pagination**: results are returned in stable commitment-type order (`compute`, then `database`, then any future commitment types in enum order). Use `maxResults` to limit page size (default 50, max 500). When more items remain, the response includes a non-null `pageToken`; pass it unchanged on the next request with the same query parameters (`service`, `maxResults`). `rowCount` is the number of items in this page. An invalid `pageToken` returns `400` with code `pagination_token_invalid`; an expired token returns `400` with code `pagination_token_expired`. - [List available platforms](https://developer.doit.com/reference/listplatforms.md): Returns a list of all the available platforms. - [List available products](https://developer.doit.com/reference/listproducts.md): Returns a list of all the available products of specific platforms. - [List tags on a support request](https://developer.doit.com/reference/listtickettags.md): Returns the tags currently set on a support request. DoiT employee (doer) callers receive the full tag set verbatim, including internal namespaces (e.g. `tier/*`, `synapse_*`). Customer callers receive only tags under the `customer_tag/` namespace, with that prefix stripped (e.g. a tag added as `billing` reads back as `billing`). Always present; empty array when the caller has no visible tags. - [List requests](https://developer.doit.com/reference/listtickets.md): Returns a list of all historical requests that your account has access to. Tickets are returned in reverse chronological order by default. - [Create a request](https://developer.doit.com/reference/createticket.md): Creates a new support request - [Get a request](https://developer.doit.com/reference/getticket.md): Returns the details of a single support request by its ID. - [Update a request](https://developer.doit.com/reference/updateticket.md): Partially updates a support request. Supports setting the request `status` and/or `assignee`. DoiT employees may set any of `open`, `pending`, `hold`, or `solved` and may set the `assignee`; customers may set only `solved` (parity with the console "mark as resolved" action) and may not set an assignee. `closed` is not settable via the API (Zendesk auto-closes from `solved`). The `assignee` is a DoiT-employee email, resolved server-side to a Zendesk agent; an email that does not resolve to an active agent returns `400`. At least one mutable field must be present. The response echoes the fields that were applied. - [List request comments](https://developer.doit.com/reference/listticketcomments.md): Returns all permitted comments on a support request. Customers and service-account callers receive only public comments; private comment bodies and attachments are excluded. Callers authenticated with DoiT employee privileges receive both public and private comments, subject to existing ticket authorization. Each comment includes `public`, sourced from Zendesk: `true` means public and `false` means private (internal). Missing visibility in legacy responses or snapshots means unknown, not private. All comments are returned in a single response (no pagination). - [Add a comment](https://developer.doit.com/reference/createticketcomment.md): Adds a comment to an existing support request. For customers and service-account callers, comments are always public, even when `private` is `true`. Callers authenticated with DoiT employee privileges can create private internal notes by setting `private` to `true`. The response always includes `public`, reflecting the effective visibility after these rules are applied, not merely the requested privacy. Existing authentication and ticket authorization are unchanged. - [Add tags to a support request](https://developer.doit.com/reference/addtickettags.md): Adds one or more tags to an existing support request. The operation is surgical — only the tags listed in the request are added; existing tags on the ticket are preserved. Re-adding a tag that is already present is a successful no-op. All submitted tags are normalized (trim + lowercase) before storage. For customers, the system additionally applies a `customer_tag/` namespace prefix to prevent collisions with internal DoiT process tags. The response echoes the actual stored strings so callers can verify the transform. - [Remove tags from a support request](https://developer.doit.com/reference/removetickettags.md): Removes one or more tags from an existing support request. The operation is surgical — only the tags listed in the request are removed; tags not listed are preserved. Removing a tag that is not present is a successful no-op. For customers, the system applies the same `customer_tag/` namespace mapping as on add, so a customer who added `my_tag` (stored as `customer_tag/my_tag`) can remove it by sending `my_tag`. - [Validate a user](https://developer.doit.com/reference/validate.md): Returns the domain and email of the current API user. - [List account team](https://developer.doit.com/reference/listaccountteam.md): Returns a list of all DoiT account managers assigned to your organization. ## Changelog - [Support Requests error codes](https://developer.doit.com/changelog/support-requests-error-codes.md) - [Actual and expected max cost on anomaly responses](https://developer.doit.com/changelog/actual-and-expected-max-cost-on-anomaly-responses.md) - [Build a CloudFlow from scratch](https://developer.doit.com/changelog/build-a-cloudflow-from-scratch.md) - [Contract Templates](https://developer.doit.com/changelog/contract-templates.md) - [CloudAnalytics report features](https://developer.doit.com/changelog/cloudanalytics-report-features.md) - [Support request tags and status](https://developer.doit.com/changelog/update-status-of-support-request.md) - [PartnerOps Contract endpoint](https://developer.doit.com/changelog/partnerops-contract-endpoint.md) - [Result array required for create/update Insights](https://developer.doit.com/changelog/result-array-required-for-createupdate-insights.md) - [CloudFlow Endpoints](https://developer.doit.com/changelog/cloudflow-endpoint.md) - [Cloud Analytics: report display settings and active theme API](https://developer.doit.com/changelog/cloud-analytics-report-display-settings-and-active-theme-api.md)