HTTP API - Radar

Everything Radar does in the UI is available over HTTP / SSE / WebSocket. The endpoints below are served by the OSS binary on --port (default 9280). Through Cloud, the same endpoints are reachable at https://api.radarhq.io/c/<cluster_id>/api/... with a PAT for auth.

This is a high-level surface tour, not a per-field reference. Run Radar with --debug-events for verbose request logging while exploring.

Conventions

Authentication: see Authentication. For Cloud, send Authorization: Bearer rhp_....
Content type: JSON unless noted. SSE endpoints emit text/event-stream.
Error shape: { "error": "<message>" }. A few responses also include a stable error_code; do not assume it is present on ordinary validation or server errors.

Health & metadata

GET  /api/health
GET  /api/version-check       # checks releases.skyhook.io for a newer version
GET  /api/diagnostics
GET  /api/agents              # locally available AI agent CLIs
GET  /api/auth/me             # current user (when auth is enabled)
GET  /api/cluster-info
GET  /api/capabilities        # which features are available given current RBAC + flags
GET  /api/vitals

Config & settings

GET  /api/config
PUT  /api/config
GET  /api/settings
PUT  /api/settings
GET  /api/settings/audit
PUT  /api/settings/audit
PUT  /api/integrations/prometheus
PUT  /api/integrations/argocd
GET  /api/integrations/argocd/status

Dashboard

GET /api/dashboard
GET /api/dashboard/crds
GET /api/dashboard/helm
GET /api/resource-counts

Applications, search & problems

GET /api/applications
GET /api/applications/history
GET /api/search
GET /api/issues
GET /api/issues/resource/{kind}/{namespace}/{name}

Resources & topology

GET    /api/resources/{kind}
GET    /api/resources/{kind}/{namespace}/{name}
PUT    /api/resources/{kind}/{namespace}/{name}
DELETE /api/resources/{kind}/{namespace}/{name}
POST   /api/resources/apply
POST   /api/resources/preview
POST   /api/resources/schemas
GET    /api/resources/{kind}/{namespace}/{name}/cascade-preview

GET /api/topology
GET /api/namespaces
GET /api/api-resources

Timeline & events

GET /api/events
GET /api/events/stream                  # SSE
GET /api/changes
GET /api/changes/{kind}/{namespace}/{name}/children
GET /api/timeline/events

Logs

GET /api/pods/{namespace}/{name}/logs/stream                         # SSE
GET /api/workloads/{kind}/{namespace}/{name}/logs/stream             # SSE
GET /api/pods/{namespace}/{name}/logs
GET /api/workloads/{kind}/{namespace}/{name}/logs
GET /api/workloads/{kind}/{namespace}/{name}/runs
GET /api/pods/{namespace}/{name}/environment
POST /api/pods/{namespace}/{name}/environment/reveal

Exec, debug, terminal, port-forward

GET    /api/pods/{namespace}/{name}/exec        # WebSocket
POST   /api/pods/{namespace}/{name}/debug
GET    /api/local-terminal                      # WebSocket
GET    /api/pods/{namespace}/{name}/files
GET    /api/pods/{namespace}/{name}/files/download

GET    /api/portforwards
POST   /api/portforwards
DELETE /api/portforwards/{id}
GET    /api/portforwards/available/{type}/{namespace}/{name}

Workload & node operations

POST /api/workloads/{kind}/{namespace}/{name}/restart
POST /api/workloads/{kind}/{namespace}/{name}/scale
POST /api/workloads/{kind}/{namespace}/{name}/rollback
GET  /api/workloads/{kind}/{namespace}/{name}/revisions
GET  /api/workloads/{kind}/{namespace}/{name}/pods

POST   /api/nodes/{name}/cordon
POST   /api/nodes/{name}/uncordon
POST   /api/nodes/{name}/drain
POST   /api/nodes/{name}/debug
DELETE /api/nodes/{name}/debug

Capacity & upgrade readiness

Capacity endpoints are cluster-wide and require permission to list Karpenter NodePools. Demand can be filtered with state, pool, owner, and pod query parameters.

GET /api/capacity
GET /api/capacity/pools
GET /api/capacity/pools/{name}
GET /api/capacity/pools/{name}/members
GET /api/capacity/demand
GET /api/capacity/activity
GET /api/upgrade-readiness?target={major.minor}

Helm

GET    /api/dashboard/helm
GET    /api/helm/releases
POST   /api/helm/releases
POST   /api/helm/releases/install-stream                              # SSE
GET    /api/helm/releases/{namespace}/{name}
GET    /api/helm/releases/{namespace}/{name}/manifest
GET    /api/helm/releases/{namespace}/{name}/values
GET    /api/helm/releases/{namespace}/{name}/diff
GET    /api/helm/releases/{namespace}/{name}/upgrade-info
GET    /api/helm/upgrade-check                                        # batched, all releases
POST   /api/helm/releases/{namespace}/{name}/rollback
POST   /api/helm/releases/{namespace}/{name}/rollback-stream          # SSE
POST   /api/helm/releases/{namespace}/{name}/upgrade
POST   /api/helm/releases/{namespace}/{name}/upgrade-stream           # SSE
POST   /api/helm/releases/{namespace}/{name}/values/preview
PUT    /api/helm/releases/{namespace}/{name}/values
DELETE /api/helm/releases/{namespace}/{name}
GET    /api/helm/repositories
POST   /api/helm/repositories/{name}/update
GET    /api/helm/charts
GET    /api/helm/charts/{repo}/{chart}
GET    /api/helm/charts/{repo}/{chart}/{version}
GET    /api/helm/artifacthub/search
GET    /api/helm/artifacthub/charts/{repo}/{chart}
GET    /api/helm/artifacthub/charts/{repo}/{chart}/{version}

CronJobs

POST /api/cronjobs/{namespace}/{name}/trigger
POST /api/cronjobs/{namespace}/{name}/suspend
POST /api/cronjobs/{namespace}/{name}/resume

GitOps - Argo CD

GET  /api/gitops/tree/{kind}/{namespace}/{name}
GET  /api/gitops/insights/{kind}/{namespace}/{name}
GET  /api/gitops/managed-resources
GET  /api/argo/destinations
POST /api/argo/applications/{namespace}/{name}/sync
POST /api/argo/applications/{namespace}/{name}/validate-resource
POST /api/argo/applications/{namespace}/{name}/refresh
POST /api/argo/applications/{namespace}/{name}/rollback
POST /api/argo/applications/{namespace}/{name}/terminate
POST /api/argo/applications/{namespace}/{name}/suspend
POST /api/argo/applications/{namespace}/{name}/resume
GET  /api/argo/applications/{namespace}/{name}/resource-diff
GET  /api/argo/applications/{namespace}/{name}/revision-metadata

GitOps - Flux CD

POST /api/flux/{kind}/{namespace}/{name}/reconcile
POST /api/flux/{kind}/{namespace}/{name}/sync-with-source
POST /api/flux/{kind}/{namespace}/{name}/suspend
POST /api/flux/{kind}/{namespace}/{name}/resume

Argo Rollouts

The {action} endpoint accepts abort, retry, promote, promote-full, and skip-step. Revision history and rollback use the workload endpoints above.

GET  /api/rollouts/{namespace}/{name}/capabilities
POST /api/rollouts/{namespace}/{name}/{action}

Audit (cluster-level best-practices, not Cloud audit log)

GET /api/audit
GET /api/audit/resource/{kind}/{namespace}/{name}

RBAC & policy findings

RBAC reverse lookups return effective grants and their binding provenance. Policy counts can cover the cluster while returned subjects remain limited by RBAC and the active namespace view; responses report withheld results.

GET /api/rbac/subject/{kind}/{namespace}/{name}
GET /api/rbac/subject/{kind}/{name}
GET /api/rbac/role/{kind}/{namespace}/{name}
GET /api/rbac/namespace/{namespace}
GET /api/rbac/whoami?namespace={namespace}

GET /api/policy/resource/{kind}/{namespace}/{name}
GET /api/policy/policies/{policy}
GET /api/policy/policies/{policy}/queued

Traffic & networking

GET  /api/traffic/sources
GET  /api/traffic/flows
GET  /api/traffic/flows/stream                  # SSE
GET  /api/traffic/source
POST /api/traffic/source
POST /api/traffic/connect
GET  /api/traffic/connection
GET  /api/network-policies/evaluate

Reachability

probe=true adds active probes from Radar’s own vantage. The in-cluster endpoint creates short-lived Jobs only after its RBAC preflight succeeds; see Reachability for the evidence and confidence model.

GET  /api/trace/{kind}/{namespace}/{name}
GET  /api/trace/{kind}/{namespace}/{name}/probe-in-cluster/capability
POST /api/trace/{kind}/{namespace}/{name}/in-cluster

OpenCost

GET /api/opencost/summary
GET /api/opencost/workloads
GET /api/opencost/trend
GET /api/opencost/nodes
GET /api/opencost/workload/{kind}/{namespace}/{name}
GET /api/opencost/workload/{kind}/{namespace}/{name}/trend
POST /api/opencost/application
POST /api/opencost/application/trend

Prometheus

GET  /api/prometheus/status
POST /api/prometheus/connect
GET  /api/prometheus/cluster
GET  /api/prometheus/namespace/{namespace}
GET  /api/prometheus/resources/{kind}/{namespace}/{name}
GET  /api/prometheus/resources/{kind}/{name}      # cluster-scoped resources
GET  /api/prometheus/rightsizing/{kind}/{namespace}/{name}
POST /api/prometheus/rightsizing/scan
GET  /api/prometheus/query                        # raw PromQL pass-through

Image filesystem

GET /api/images/metadata          # OCI manifest + config
GET /api/images/inspect           # filesystem tree
GET /api/images/file              # single file content

Packages

GET /api/packages                 # CNCF packages discovered (powers Fleet > Packages)

Operator-specific reverse lookups

GET  /api/cnpg/imagecatalogs/{namespace}/{name}/clusters
GET  /api/cnpg/clusterimagecatalogs/{name}/clusters
GET  /api/velero/backupstoragelocations/{namespace}/{name}/backups
POST /api/velero/{backups|restores}/{namespace}/{name}/messages

Sessions

GET /api/sessions                 # active exec / port-forward / log streams

Cluster API (multi-context, kubeconfig discovery)

GET  /api/contexts
POST /api/contexts/{name}                                            # switch
GET  /api/cluster/namespace-scope
POST /api/cluster/namespace                                          # update the active namespace view
GET  /api/capi/clusters/{ns}/{name}/kubeconfig
POST /api/capi/clusters/{ns}/{name}/connect                          # promote a CAPI cluster
GET  /api/connection
POST /api/connection/retry

Cloud Connect driver

These power the in-product device-flow installer for eligible local, auth-disabled Radar instances. Other configurations hand off to the Hub wizard.

POST /api/cloud/install/prepare
POST /api/cloud/install/start
GET  /api/cloud/install/status
POST /api/cloud/install/cancel
POST /api/cloud/install/dismiss
GET  /api/cloud/connect/self

Self-update

POST /api/agent/self-upgrade                     # in-cluster Radar pulls a newer image
GET  /api/github/starred
POST /api/github/star
POST /api/github/dismiss

Desktop app

These are no-ops outside the desktop binary. The web app uses them to open files, save artifacts, and trigger app self-update.

POST /api/desktop/open-url
POST /api/desktop/open-file
POST /api/desktop/open-folder
POST /api/desktop/save-file
POST /api/desktop/update
GET  /api/desktop/update/status
POST /api/desktop/update/apply

Certificates

GET /api/secrets/certificate-expiry
GET /api/certificates

Kubernetes resource metrics

GET /api/metrics/pods/{namespace}/{name}
GET /api/metrics/pods/{namespace}/{name}/history
GET /api/metrics/nodes/{name}
GET /api/metrics/nodes/{name}/history
GET /api/metrics/top/pods
GET /api/metrics/top/nodes
GET /api/metrics/top/resources

AI

GET  /api/ai/resources/{kind}
GET  /api/ai/resources/{kind}/{namespace}/{name}
GET  /api/ai/neighborhood/{kind}/{namespace}/{name}

GET  /api/diagnose/runs
POST /api/diagnose/runs
GET  /api/diagnose/runs/{id}/stream                # SSE
POST /api/diagnose/runs/{id}/turns
POST /api/diagnose/runs/{id}/stop
POST /api/diagnose/history/clear
POST /api/diagnose/consent

GET  /mcp                                          # MCP Streamable HTTP session / SSE
POST /mcp                                          # MCP JSON-RPC
GET  /mcp-readonly
POST /mcp-readonly                                 # read-tool-only MCP mount

Auth (when enabled)

GET  /auth/login
GET  /auth/callback
GET  /auth/logout
POST /auth/backchannel-logout

Cloud control plane

These live on api.radarhq.io, not on the in-cluster Radar. Auth is the WorkOS session cookie or a PAT. All endpoints are owner / member / viewer gated as documented per page.

# Orgs & members
GET    /api/orgs/{org_id}
PATCH  /api/orgs/{org_id}
GET    /api/orgs/{org_id}/members
POST   /api/orgs/{org_id}/invitations
GET    /api/orgs/{org_id}/audit

# Clusters
GET    /api/clusters
POST   /api/clusters
PATCH  /api/clusters/{id}
DELETE /api/clusters/{id}
POST   /api/clusters/{id}/rotate-token

# Cross-cluster fleet aggregates (rate-limited 30/min/user)
GET    /api/fleet/problems
GET    /api/fleet/certs
GET    /api/fleet/audit
GET    /api/fleet/packages
GET    /api/fleet/search

# Per-cluster tunnel - any in-cluster Radar route is reachable via /c/<id>/<path>
GET    /c/{cluster_id}/{path...}                  # browser cookie or PAT auth
GET    /c/{cluster_id}/mcp                        # per-cluster MCP transport
GET    /mcp                                       # org-wide MCP aggregator

# Billing
GET    /api/orgs/{org_id}/billing
POST   /api/orgs/{org_id}/billing/checkout
POST   /api/orgs/{org_id}/billing/portal
POST   /api/billing/webhook                        # Stripe → control plane

# PATs
GET    /api/pats
POST   /api/pats
DELETE /api/pats/{id}

# Account
GET    /api/account
GET    /api/preferences
PATCH  /api/preferences

Debug

GET /debug/pprof/*
GET /api/debug/events
GET /api/debug/informers
GET /api/debug/events/diagnose

The pprof routes are disabled in Cloud mode. The /api/debug/* routes remain available behind Radar’s normal authentication and authorization middleware.

​Conventions

​Health & metadata

​Config & settings

​Dashboard

​Applications, search & problems

​Resources & topology

​Timeline & events

​Logs

​Exec, debug, terminal, port-forward

​Workload & node operations

​Capacity & upgrade readiness

​Helm

​CronJobs

​GitOps - Argo CD

​GitOps - Flux CD

​Argo Rollouts

​Audit (cluster-level best-practices, not Cloud audit log)

​RBAC & policy findings

​Traffic & networking

​Reachability

​OpenCost

​Prometheus

​Image filesystem

​Packages

​Operator-specific reverse lookups

​Sessions

​Cluster API (multi-context, kubeconfig discovery)

​Cloud Connect driver

​Self-update

​Desktop app

​Certificates

​Kubernetes resource metrics

​AI

​Auth (when enabled)

​Cloud control plane

​Debug

​See also