API Reference
This page provides a complete reference of all Custom Resource Definitions (CRDs) and REST APIs exposed by the Control Plane.
Custom Resource Definitions
The Control Plane models its configuration as Kubernetes Custom Resources. Each resource represents a specific concept — an API, a subscription, a gateway route, and so on. Operators watch these resources and reconcile the desired state with the actual infrastructure.
All CRDs use API version v1 and are namespace-scoped. All API groups use the base domain cp.ei.telekom.de, except the external PermissionSet in pcp.ei.telekom.de.
Most users do not create these resources directly. Instead, they write a single Rover file that declaratively describes their application's API and event posture. The Rover operator then creates and manages the underlying resources automatically. See the Rover domain for details.
Summary
| Domain | API Group | CRDs |
|---|---|---|
| Admin | admin.cp.ei.telekom.de/v1 | 3 |
| Agentic | agentic.cp.ei.telekom.de/v1 | 4 |
| API | api.cp.ei.telekom.de/v1 | 5 |
| Application | application.cp.ei.telekom.de/v1 | 1 |
| Approval | approval.cp.ei.telekom.de/v1 | 3 |
| Event | event.cp.ei.telekom.de/v1 | 4 |
| File | file.cp.ei.telekom.de/v1 | 4 |
| Gateway | gateway.cp.ei.telekom.de/v1 | 5 |
| Identity | identity.cp.ei.telekom.de/v1 | 3 |
| Notification | notification.cp.ei.telekom.de/v1 | 3 |
| Organization | organization.cp.ei.telekom.de/v1 | 2 |
| Permission | permission.cp.ei.telekom.de/v1, pcp.ei.telekom.de/v1 | 2 |
| PubSub | pubsub.cp.ei.telekom.de/v1 | 3 |
| Rover | rover.cp.ei.telekom.de/v1 | 8 |
| SFTP | sftp.cp.ei.telekom.de/v1 | 3 |
| Spectre | spectre.cp.ei.telekom.de/v1 | 2 |
| Total | 55 |
Admin
API Group: admin.cp.ei.telekom.de/v1 · Architecture →
Platform-wide settings such as environments, zones, and federation.
| Kind | Description |
|---|---|
| Environment | Represents a deployment environment — the top-level organizational unit. |
| Zone | Configures a deployment zone with identity provider, gateway, and connection settings. Controls visibility (World/Enterprise) and circuit breaker settings. |
| RemoteOrganization | Represents a federated remote organization for cross-organization API subscription flows. (Planned feature — not yet fully supported.) |
Agentic
API Group: agentic.cp.ei.telekom.de/v1 · Architecture →
MCP server and A2A agent registration, exposure, and subscription.
| Kind | Description |
|---|---|
| McpServer | A registered MCP server definition that AgenticExposure and AgenticSubscription point to. |
| AgentCard | A registered A2A agent definition that AgenticExposure and AgenticSubscription point to when the variant is AGENT. |
| AgenticExposure | Declares that an application exposes an MCP server, making it available for subscription via the AI Gateway. |
| AgenticSubscription | A request by an application to consume an MCP server exposed via AgenticExposure, with approval and access control. |
API
API Group: api.cp.ei.telekom.de/v1 · Architecture →
API lifecycle management — definitions, exposures, and subscriptions.
| Kind | Description |
|---|---|
| Api | A registered API definition with version, base path, category, and optional OAuth2 scopes. |
| ApiCategory | Defines an API category with team restrictions, linting configuration, and naming requirements. |
| ApiExposure | Declares that a team exposes an API at a given base path with visibility, approval strategy, traffic management, and security settings. |
| ApiSubscription | Represents a subscription to an API by a consuming application, with security and failover configuration. |
| RemoteApiSubscription | Enables cross-organization API subscriptions between federated organizations. |
Application
API Group: application.cp.ei.telekom.de/v1 · Architecture →
Application registration and zone assignment.
| Kind | Description |
|---|---|
| Application | Represents a deployed application belonging to a team, with zone configuration, failover zones, and security settings. |
Approval
API Group: approval.cp.ei.telekom.de/v1 · Architecture →
Access request approvals with multiple strategies.
| Kind | Description |
|---|---|
| Approval | Manages the approval lifecycle for access requests, supporting Auto, Simple, and FourEyes strategies. |
| ApprovalRequest | A specific versioned approval request linked to an Approval, tracking individual decisions. |
| ApprovalExpiration | Tracks the expiration time of a parent Approval and the reminder notifications sent before it expires. Created by the Approval controller. |
Event
API Group: event.cp.ei.telekom.de/v1 · Architecture →
Asynchronous event publishing and subscription.
| Kind | Description |
|---|---|
| EventConfig | Per-zone configuration for the event system with connection settings and mesh topology. |
| EventType | Registry entry for a known event type with a dot-separated identifier and JSON schema. |
| EventExposure | Declares that an application publishes events of a specific type, with visibility and approval settings. |
| EventSubscription | Declares that an application subscribes to events, with delivery configuration and trigger filters. |
File
API Group: file.cp.ei.telekom.de/v1 · Architecture →
File-type exposure and subscription, delivered through SFTP.
| Kind | Description |
|---|---|
| FileType | A registered file type with an optional description, created by the Rover controller from a FileSpecification. |
| FileExposure | Declares that an application provides a file type in a zone, with SFTP access, visibility, and approval settings. |
| FileSubscription | Declares that an application consumes a file type, with consumer-side SFTP access. |
| ZoneServiceConfig | Per-zone SFTP API and service endpoint configuration. Must use the same name and namespace as the admin Zone it configures. |
Gateway
API Group: gateway.cp.ei.telekom.de/v1 · Architecture →
API gateway instances, routes, and consumer management.
| Kind | Description |
|---|---|
| Gateway | Represents a gateway instance with admin API access and connection settings. |
| Route | Defines a gateway route with upstreams, downstreams, traffic management, and security settings. |
| ConsumeRoute | Binds a consumer to a gateway route with optional security and rate limit configuration. |
| Consumer | Represents a gateway consumer identity with optional IP restrictions. |
| RouteListener | Lets a consumer application listen to traffic on a provider's Route in a zone. Created by the Spectre Listener controller. |
Identity
API Group: identity.cp.ei.telekom.de/v1 · Architecture →
Identity providers, realms, and OAuth2 clients.
| Kind | Description |
|---|---|
| IdentityProvider | Manages an identity provider instance (e.g. Keycloak) with admin access configuration. |
| Realm | Represents an identity realm within a provider, exposing issuer URLs and admin credentials. |
| Client | Represents an OAuth2 client within an identity realm. |
Notification
API Group: notification.cp.ei.telekom.de/v1 · Architecture →
Notification delivery across email, webhooks, and messaging platforms.
| Kind | Description |
|---|---|
| Notification | Triggers sending a notification using a template, with sender info and channel references. |
| NotificationChannel | Configures a notification delivery channel — email, MS Teams webhook, or generic webhook. |
| NotificationTemplate | Defines a notification template for a specific purpose and channel type. |
Organization
API Group: organization.cp.ei.telekom.de/v1 · Architecture →
Organizational structure — groups and teams.
| Kind | Description |
|---|---|
| Group | Represents an organizational group (top-level tenant) with display name and description. |
| Team | Represents a team within a group, with members, email, and optional category. |
Permission
API Group: permission.cp.ei.telekom.de/v1, pcp.ei.telekom.de/v1
Application permissions for an external permission service. Optional install component.
| Kind | Description |
|---|---|
PermissionSet (permission.cp.ei.telekom.de) | The internal permission configuration of an application, created by the Rover controller. |
PermissionSet (pcp.ei.telekom.de) | The external copy consumed by the permission service: a list of role-resource-action tuples. Created by the Permission operator; has no status. |
PubSub
API Group: pubsub.cp.ei.telekom.de/v1 · Architecture →
Low-level event infrastructure resources managed by controllers.
| Kind | Description |
|---|---|
| EventStore | Connection details for the event configuration backend, created by the EventConfig controller. |
| Publisher | An event publisher registration, created by the EventExposure controller. |
| Subscriber | An event subscription registration with delivery and trigger config, created by the EventSubscription controller. |
Rover
API Group: rover.cp.ei.telekom.de/v1 · Architecture →
The primary user-facing interface for declarative application configuration.
| Kind | Description |
|---|---|
| Rover | The primary user-facing resource — defines an application's complete API and event posture declaratively. |
| ApiSpecification | Stores an uploaded OpenAPI specification and creates the corresponding Api resource. |
| EventSpecification | Stores event type metadata and creates the corresponding EventType resource. |
| FileSpecification | Stores file type metadata and creates the corresponding file-domain FileType resource. |
| McpSpecification | Stores an uploaded MCP server specification and creates the corresponding McpServer resource. |
| AgentSpecification | Stores an uploaded A2A agent specification and creates the corresponding AgentCard resource. |
| ApiChangelog | References the changelog of an ApiSpecification. Named after the base path without its major version. |
| Roadmap | References the roadmap of an ApiSpecification or EventSpecification. Named after the base path without its major version. |
SFTP
API Group: sftp.cp.ei.telekom.de/v1 · Architecture →
SFTP service provisioning and SSH public key synchronization.
| Kind | Description |
|---|---|
| SFTPServiceConfig | Configures zone-specific SFTP Tardis API access and OAuth2 client credentials. |
| Instance | Represents an SFTP service instance and provisions a corresponding SFTP service user through the configured SFTPServiceConfig. |
| User | Declares SSH public keys for an SFTP user and attaches them to an Instance. |
Spectre
API Group: spectre.cp.ei.telekom.de/v1 · Architecture →
Listeners that forward API traffic between a consumer and a provider as events.
| Kind | Description |
|---|---|
| SpectreApplication | Groups all listeners of one application and creates its shared Publisher and, for SSE delivery, its SSE Routes. |
| Listener | A consumer-to-provider binding for one API path, created by the Rover controller from spec.listeners. |
REST API
In addition to the Kubernetes CRDs, the Control Plane exposes two REST APIs.
ControlPlane API
The ControlPlane API provides a read-only view over the resources managed by the Control Plane. It is primarily used by dashboards and internal tooling to query the current state of environments, APIs, subscriptions, and events without direct Kubernetes access.
Rover Server
The Rover Server is the main REST endpoint for external users. It accepts Rover file submissions, validates configurations, manages file uploads (OpenAPI specs, event schemas), and creates the corresponding Kubernetes resources. The command-line tool Rover-CTL communicates with this API.
For more details on how these components fit together, see the Architecture Overview.