API reference · Kubernetes / Kubernetes

Kubernetes

Managed Kubernetes clusters whose nodes are VMs in your account: create, scale, upgrade, stop, start and delete them, and download a kubeconfig.

View as Markdown Open in Claude Open in ChatGPT

A cluster's nodes, control and worker, are VMs of one node_plan in your account, each billed as a VM of that plan; there is no separate control-plane fee. Pick a version from GET /kubernetes-versions in the zone you want. In a VPC zone the nodes go in a subnet; in a standard zone leave subnet_id out. control_nodes is 1, or 3 where the version list's ha_zone_ids offers it.

Every change returns an operation to follow. Scale to 1 to 10 workers with PATCH, and upgrade one step at a time to one of the cluster's available_upgrades; upgrades never happen on their own and never go down. Download the kubeconfig once the cluster is running: it is a POST that needs a write key, because it grants cluster-admin. A 503 KUBERNETES_UNAVAILABLE means managed Kubernetes is not open on the platform yet. See the Kubernetes guide.

The Kubernetes cluster object

Fields

idstringrequired
e.g. k8s_....
namestringrequired
zone_idstringrequired
kubernetes_version_idstringrequired
kubernetes_versionstringrequired
network_idstring or nullrequired
The private network (VPC) the nodes are in; null in a standard zone.
subnet_idstring or nullrequired
node_plan_idstringrequired
nodeKubernetesNoderequired
Show 3 child fieldsHide child fields
- vcpuintegerrequired
- memory_mbintegerrequired
- disk_gbintegerrequired
control_nodesintegerrequired
workersintegerrequired
nodesintegerrequired
control_nodes plus workers: the VMs billed.
desired_statestringrequired
One of running, stopped, deleted.
observed_statestringrequired
updating while a scale or upgrade runs.
One of pending, provisioning, running, updating, stopping, stopped, retired, deleted, failed, unknown.
in_syncbooleanrequired
False while a scale or upgrade has not finished.
failure_codestring or nullrequired
failure_reasonstring or nullrequired
available_upgradesarray of KubernetesVersionrequired
Versions this cluster can be upgraded to now.
Show 6 child fieldsHide child fields
- idstringrequired
  e.g. k8sv_....
- zone_idstringrequired
- versionstringrequired
- statusstringrequired
  withdrawn versions take no new clusters.
  One of available, withdrawn.
- min_cpuintegerrequired
  The fewest vCPUs a node plan needs for this version.
- min_memory_mbintegerrequired
  The least memory, in MB, a node plan needs for this version.
autoscalingKubernetesAutoscalingrequired
The platform's autoscaler: about once a minute it adds a worker when a pod that a worker could run is waiting for room, and removes the newest worker once it has run nothing but DaemonSet pods for 10 minutes, one step at a time and always within min_workers and max_workers. You pay for the workers that run.
Show 3 child fieldsHide child fields
- enabledbooleanrequired
  The cluster autoscaler adds and removes workers within the range as pods need them.
- min_workersintegerrequired
  1 to 10 when enabled; 0 when not.
- max_workersintegerrequired
  min_workers to 10 when enabled; 0 when not. Billing and your account limits are checked for the maximum.
api_allowed_cidrsarray of stringrequired
Sources allowed to reach the API server; empty is any address.
endpointstring or nullrequired
The API server's URL, once the cluster has one: the public address when the endpoint is public or dual and one is routed, else the private one.
public_ipstring or null
The public address the API server is reachable on; null until one is routed, and for a private endpoint.
public_portinteger or null
The public port the API server is reachable on; null until one is routed, and for a private endpoint.
volume_storage_gbintegerrequired
Storage your workloads' persistent volume claims use, billed with the nodes' disks.
kindstringrequired
Cluster architecture kind, e.g. appliance.
cni_pluginstringrequired
CNI backend plugin (flannel, wireguard, or calico).
pod_cidrstringrequired
IPv4 CIDR range allocated for cluster pods.
service_cidrstringrequired
IPv4 CIDR range allocated for cluster services.
endpoint_accessstringrequired
API server endpoint network access mode (public, private, or dual).
One of public, private, dual.
created_atstring or nullrequired
updated_atstring or nullrequired

The Kubernetes version object

Fields

idstringrequired
e.g. k8sv_....
zone_idstringrequired
versionstringrequired
statusstringrequired
withdrawn versions take no new clusters.
One of available, withdrawn.
min_cpuintegerrequired
The fewest vCPUs a node plan needs for this version.
min_memory_mbintegerrequired
The least memory, in MB, a node plan needs for this version.

List Kubernetes versions

The Kubernetes versions you can create clusters with, newest first, each in one zone. ha_zone_ids are the zones where a highly available control plane (3 control nodes) can be created now. A version is withdrawn from new clusters before its upstream end of life; clusters already on it keep running it.

GET/public/v1/kubernetes-versions

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Query parameters

zone_idstring
Only versions in this zone.

Response 200

The versions.

dataarray of KubernetesVersionrequired
Show 6 child fieldsHide child fields
- idstringrequired
  e.g. k8sv_....
- zone_idstringrequired
- versionstringrequired
- statusstringrequired
  withdrawn versions take no new clusters.
  One of available, withdrawn.
- min_cpuintegerrequired
  The fewest vCPUs a node plan needs for this version.
- min_memory_mbintegerrequired
  The least memory, in MB, a node plan needs for this version.
ha_zone_idsarray of stringrequired
Zones where a cluster can have 3 control nodes.

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Query

zone_idOnly versions in this zone.

curl "https://api.pantechdynamics.com/public/v1/kubernetes-versions" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "data": [
    {
      "id": "k8sv_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "zone_id": "af-abj-2",
      "version": "1.31.2",
      "status": "available",
      "min_cpu": 2,
      "min_memory_mb": 2048
    }
  ],
  "ha_zone_ids": [
    "af-abj-2"
  ]
}

List Kubernetes clusters

Your Kubernetes clusters, newest first. Deleted and failed clusters are left out.

GET/public/v1/kubernetes-clusters

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Response 200

The clusters.

dataarray of KubernetesClusterrequired
Show 31 child fieldsHide child fields
- idstringrequired
  e.g. k8s_....
- namestringrequired
- zone_idstringrequired
- kubernetes_version_idstringrequired
- kubernetes_versionstringrequired
- network_idstring or nullrequired
  The private network (VPC) the nodes are in; null in a standard zone.
- subnet_idstring or nullrequired
- node_plan_idstringrequired
- nodeKubernetesNoderequired
  Show 3 child fieldsHide child fields
  - vcpuintegerrequired
  - memory_mbintegerrequired
  - disk_gbintegerrequired
- control_nodesintegerrequired
- workersintegerrequired
- nodesintegerrequired
  control_nodes plus workers: the VMs billed.
- desired_statestringrequired
  One of running, stopped, deleted.
- observed_statestringrequired
  updating while a scale or upgrade runs.
  One of pending, provisioning, running, updating, stopping, stopped, retired, deleted, failed, unknown.
- in_syncbooleanrequired
  False while a scale or upgrade has not finished.
- failure_codestring or nullrequired
- failure_reasonstring or nullrequired
- available_upgradesarray of KubernetesVersionrequired
  Versions this cluster can be upgraded to now.
  Show 6 child fieldsHide child fields
  - idstringrequired
    e.g. k8sv_....
  - zone_idstringrequired
  - versionstringrequired
  - statusstringrequired
    withdrawn versions take no new clusters.
    One of available, withdrawn.
  - min_cpuintegerrequired
    The fewest vCPUs a node plan needs for this version.
  - min_memory_mbintegerrequired
    The least memory, in MB, a node plan needs for this version.
- autoscalingKubernetesAutoscalingrequired
  The platform's autoscaler: about once a minute it adds a worker when a pod that a worker could run is waiting for room, and removes the newest worker once it has run nothing but DaemonSet pods for 10 minutes, one step at a time and always within min_workers and max_workers. You pay for the workers that run.
  Show 3 child fieldsHide child fields
  - enabledbooleanrequired
    The cluster autoscaler adds and removes workers within the range as pods need them.
  - min_workersintegerrequired
    1 to 10 when enabled; 0 when not.
  - max_workersintegerrequired
    min_workers to 10 when enabled; 0 when not. Billing and your account limits are checked for the maximum.
- api_allowed_cidrsarray of stringrequired
  Sources allowed to reach the API server; empty is any address.
- endpointstring or nullrequired
  The API server's URL, once the cluster has one: the public address when the endpoint is public or dual and one is routed, else the private one.
- public_ipstring or null
  The public address the API server is reachable on; null until one is routed, and for a private endpoint.
- public_portinteger or null
  The public port the API server is reachable on; null until one is routed, and for a private endpoint.
- volume_storage_gbintegerrequired
  Storage your workloads' persistent volume claims use, billed with the nodes' disks.
- kindstringrequired
  Cluster architecture kind, e.g. appliance.
- cni_pluginstringrequired
  CNI backend plugin (flannel, wireguard, or calico).
- pod_cidrstringrequired
  IPv4 CIDR range allocated for cluster pods.
- service_cidrstringrequired
  IPv4 CIDR range allocated for cluster services.
- endpoint_accessstringrequired
  API server endpoint network access mode (public, private, or dual).
  One of public, private, dual.
- created_atstring or nullrequired
- updated_atstring or nullrequired
next_cursorstring or nullrequired
Always null: this list is returned whole.

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

curl "https://api.pantechdynamics.com/public/v1/kubernetes-clusters" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "data": [
    {
      "id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "name": "prod-web",
      "zone_id": "af-abj-2",
      "kubernetes_version_id": "k8sv_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "kubernetes_version": "1.31.2",
      "network_id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "subnet_id": "snet_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "node_plan_id": "plan_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "node": {
        "vcpu": 2,
        "memory_mb": 4096,
        "disk_gb": 80
      },
      "control_nodes": 1,
      "workers": 2,
      "nodes": 3,
      "desired_state": "running",
      "observed_state": "running",
      "in_sync": true,
      "failure_code": null,
      "failure_reason": null,
      "available_upgrades": [
        {
          "id": "k8sv_07hm4y0ur8n3w9s5z2d6e1aq9x",
          "zone_id": "af-abj-2",
          "version": "1.32.0",
          "status": "available",
          "min_cpu": 2,
          "min_memory_mb": 2048
        }
      ],
      "autoscaling": {
        "enabled": true,
        "min_workers": 2,
        "max_workers": 5
      },
      "api_allowed_cidrs": [
        "api-allowed-cidrs"
      ],
      "endpoint": "endpoint",
      "public_ip": "203.0.113.20",
      "public_port": 6443,
      "volume_storage_gb": 1,
      "kind": "appliance",
      "cni_plugin": "flannel",
      "pod_cidr": "10.42.0.0/16",
      "service_cidr": "10.43.0.0/16",
      "endpoint_access": "public",
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": null
}

Create a Kubernetes cluster

Creates a managed Kubernetes cluster. Every node, control and worker, is a VM of node_plan in your account and is billed as one; there is no separate control-plane fee. In a VPC zone the nodes go in subnet_id; in a standard zone leave subnet_id out. control_nodes is 1, or 3 where the zone offers a highly available control plane (see ha_zone_ids on the versions list). Persistent volumes work out of the box. Download the kubeconfig once the cluster is running.

Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice. The cluster's id is the operation's resource_id.

POST/public/v1/kubernetes-clusters

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Body

application/json

namestringrequired
1 to 40 lowercase letters, digits and hyphens, starting with a letter.
zone_idstringrequired
kubernetes_version_idstringrequired
From the Kubernetes versions list, in zone_id.
subnet_idstring
Required in a VPC zone: the subnet the nodes go in. Leave out in a standard zone.
node_planstringrequired
The plan slug every node uses, from the plans list. In a zone where every node has one fixed size (af-abj-2: 2 vCPU, 4 GB), the plan must be that size: 422 KUBERNETES_PLAN_NOT_IN_ZONE on node_plan.
control_nodesinteger
1, or 3 for a highly available control plane where the zone offers it.
One of 1, 3. Defaults to 1.
workersinteger
Worker nodes, 1 to 10. Required unless autoscaling is enabled, when it defaults to min_workers and must lie within the range.
From 1 to 10.
autoscalingKubernetesAutoscaling
The platform's autoscaler: about once a minute it adds a worker when a pod that a worker could run is waiting for room, and removes the newest worker once it has run nothing but DaemonSet pods for 10 minutes, one step at a time and always within min_workers and max_workers. You pay for the workers that run.
Show 3 child fieldsHide child fields
- enabledbooleanrequired
  The cluster autoscaler adds and removes workers within the range as pods need them.
- min_workersintegerrequired
  1 to 10 when enabled; 0 when not.
- max_workersintegerrequired
  min_workers to 10 when enabled; 0 when not. Billing and your account limits are checked for the maximum.
api_allowed_cidrsarray of string
VPC zone only: the IPv4 CIDRs allowed to reach the API server (at most 20). Leave out for any address.
kindstring
Cluster architecture. Only appliance (the default) is offered: nodes are VMs in your account running k3s. Any other value is 422 INVALID_KUBERNETES_KIND.
One of appliance.
cni_pluginstring
CNI backend plugin (flannel, wireguard, or calico). Defaults to flannel.
pod_cidrstring
IPv4 CIDR range allocated for cluster pods. Defaults to 10.42.0.0/16.
service_cidrstring
IPv4 CIDR range allocated for cluster services. Defaults to 10.43.0.0/16.
endpoint_accessstring
Who can reach the API server. private (the default) is reachable only from inside the VPC. public and dual give the API server a public address of its own, billed as a VPC public IP for every hour it is held.
One of private, public, dual. Defaults to private.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
402INSUFFICIENT_CREDIT: your credit does not cover the first payment for every node. Top up or add a card, then try again.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
409KUBERNETES_CLUSTER_NAME_TAKEN: you already have a cluster with this name. KUBERNETES_CLUSTER_LIMIT: your organization has reached its cluster limit. Delete a cluster, or contact support to raise it. CONCURRENT_UPDATE: the cluster changed while this request was being processed. Retry the request; if it repeats, read the cluster first.
413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
422VALIDATION_FAILED: a field is invalid. Each entry of errors names the field and its code: name, zone_id, kubernetes_version_id, node_plan or workers REQUIRED: send them. name INVALID_KUBERNETES_CLUSTER_NAME: 1 to 40 lowercase letters, digits and hyphens, starting with a letter. zone_id INVALID_KUBERNETES_ZONE: a zone your organization can use. kubernetes_version_id INVALID_KUBERNETES_VERSION: a version offered in this zone. node_plan INVALID_KUBERNETES_NODE_PLAN: an active plan with at least the version's minimum vCPU and memory. workers INVALID_KUBERNETES_WORKER_COUNT: 1 to 10. control_nodes INVALID_KUBERNETES_CONTROL_NODES or KUBERNETES_HA_NOT_AVAILABLE: 1, or 3 where offered. autoscaling INVALID_KUBERNETES_AUTOSCALING: min_workers and max_workers 1 to 10, min no more than max, and workers within them. api_allowed_cidrs INVALID_API_ALLOWED_CIDRS (at most 20 IPv4 CIDRs) or API_ALLOWED_CIDRS_VPC_ONLY. subnet_id KUBERNETES_SUBNET_REQUIRED, KUBERNETES_SUBNET_NOT_ALLOWED or KUBERNETES_SUBNET_NOT_FOUND: an active subnet in a VPC zone, and none in a standard zone. UNKNOWN_FIELD: the body has a field this endpoint does not take (named in field).
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "prod-web",
    "zone_id": "af-abj-2",
    "kubernetes_version_id": "k8sv_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "subnet_id": "snet_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "node_plan": "s-2vcpu-4gb",
    "control_nodes": 1
  }'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Get a Kubernetes cluster

One cluster. in_sync is false while a change you made has not reached it yet; available_upgrades lists the versions it can move to now.

GET/public/v1/kubernetes-clusters/{cluster_id}

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Response 200

The cluster.

idstringrequired
e.g. k8s_....
namestringrequired
zone_idstringrequired
kubernetes_version_idstringrequired
kubernetes_versionstringrequired
network_idstring or nullrequired
The private network (VPC) the nodes are in; null in a standard zone.
subnet_idstring or nullrequired
node_plan_idstringrequired
nodeKubernetesNoderequired
Show 3 child fieldsHide child fields
- vcpuintegerrequired
- memory_mbintegerrequired
- disk_gbintegerrequired
control_nodesintegerrequired
workersintegerrequired
nodesintegerrequired
control_nodes plus workers: the VMs billed.
desired_statestringrequired
One of running, stopped, deleted.
observed_statestringrequired
updating while a scale or upgrade runs.
One of pending, provisioning, running, updating, stopping, stopped, retired, deleted, failed, unknown.
in_syncbooleanrequired
False while a scale or upgrade has not finished.
failure_codestring or nullrequired
failure_reasonstring or nullrequired
available_upgradesarray of KubernetesVersionrequired
Versions this cluster can be upgraded to now.
Show 6 child fieldsHide child fields
- idstringrequired
  e.g. k8sv_....
- zone_idstringrequired
- versionstringrequired
- statusstringrequired
  withdrawn versions take no new clusters.
  One of available, withdrawn.
- min_cpuintegerrequired
  The fewest vCPUs a node plan needs for this version.
- min_memory_mbintegerrequired
  The least memory, in MB, a node plan needs for this version.
autoscalingKubernetesAutoscalingrequired
The platform's autoscaler: about once a minute it adds a worker when a pod that a worker could run is waiting for room, and removes the newest worker once it has run nothing but DaemonSet pods for 10 minutes, one step at a time and always within min_workers and max_workers. You pay for the workers that run.
Show 3 child fieldsHide child fields
- enabledbooleanrequired
  The cluster autoscaler adds and removes workers within the range as pods need them.
- min_workersintegerrequired
  1 to 10 when enabled; 0 when not.
- max_workersintegerrequired
  min_workers to 10 when enabled; 0 when not. Billing and your account limits are checked for the maximum.
api_allowed_cidrsarray of stringrequired
Sources allowed to reach the API server; empty is any address.
endpointstring or nullrequired
The API server's URL, once the cluster has one: the public address when the endpoint is public or dual and one is routed, else the private one.
public_ipstring or null
The public address the API server is reachable on; null until one is routed, and for a private endpoint.
public_portinteger or null
The public port the API server is reachable on; null until one is routed, and for a private endpoint.
volume_storage_gbintegerrequired
Storage your workloads' persistent volume claims use, billed with the nodes' disks.
kindstringrequired
Cluster architecture kind, e.g. appliance.
cni_pluginstringrequired
CNI backend plugin (flannel, wireguard, or calico).
pod_cidrstringrequired
IPv4 CIDR range allocated for cluster pods.
service_cidrstringrequired
IPv4 CIDR range allocated for cluster services.
endpoint_accessstringrequired
API server endpoint network access mode (public, private, or dual).
One of public, private, dual.
created_atstring or nullrequired
updated_atstring or nullrequired

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND: no cluster with this id in your organization. Check the id. RESOURCE_NOT_FOUND: the id is not a cluster id (k8s_…).
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

curl "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "name": "prod-web",
  "zone_id": "af-abj-2",
  "kubernetes_version_id": "k8sv_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "kubernetes_version": "1.31.2",
  "network_id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "subnet_id": "snet_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "node_plan_id": "plan_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "node": {
    "vcpu": 2,
    "memory_mb": 4096,
    "disk_gb": 80
  },
  "control_nodes": 1,
  "workers": 2,
  "nodes": 3,
  "desired_state": "running",
  "observed_state": "running",
  "in_sync": true,
  "failure_code": null,
  "failure_reason": null,
  "available_upgrades": [
    {
      "id": "k8sv_07hm4y0ur8n3w9s5z2d6e1aq9x",
      "zone_id": "af-abj-2",
      "version": "1.32.0",
      "status": "available",
      "min_cpu": 2,
      "min_memory_mb": 2048
    }
  ],
  "autoscaling": {
    "enabled": true,
    "min_workers": 2,
    "max_workers": 5
  },
  "api_allowed_cidrs": [
    "api-allowed-cidrs"
  ],
  "endpoint": "endpoint",
  "public_ip": "203.0.113.20",
  "public_port": 6443,
  "volume_storage_gb": 1,
  "kind": "appliance",
  "cni_plugin": "flannel",
  "pod_cidr": "10.42.0.0/16",
  "service_cidr": "10.43.0.0/16",
  "endpoint_access": "public",
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z"
}

Change a Kubernetes cluster

Sets a fixed number of worker nodes (1 to 10), turns the cluster autoscaler on or off and sets its range, or replaces the list of addresses allowed to reach the API server (VPC zone). Send any of them; the rest stay as they are. The cluster must be running. The operation finishes once every added worker has joined the cluster and is ready. Added workers, and an autoscaler maximum above today's count, are checked against your credit and account limits; workers are billed as VMs of the node plan while they run. A change that changes nothing returns an empty operation_id.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

PATCH/public/v1/kubernetes-clusters/{cluster_id}

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Body

application/json

workersinteger
A fixed worker count, 1 to 10. Not with autoscaling enabled: the autoscaler sets it.
From 1 to 10.
autoscalingKubernetesAutoscaling
The platform's autoscaler: about once a minute it adds a worker when a pod that a worker could run is waiting for room, and removes the newest worker once it has run nothing but DaemonSet pods for 10 minutes, one step at a time and always within min_workers and max_workers. You pay for the workers that run.
Show 3 child fieldsHide child fields
- enabledbooleanrequired
  The cluster autoscaler adds and removes workers within the range as pods need them.
- min_workersintegerrequired
  1 to 10 when enabled; 0 when not.
- max_workersintegerrequired
  min_workers to 10 when enabled; 0 when not. Billing and your account limits are checked for the maximum.
api_allowed_cidrsarray of string
VPC zone only: the whole new list of IPv4 CIDRs allowed to reach the API server. Send [] to allow any address.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
402INSUFFICIENT_CREDIT: your credit does not cover the added nodes.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND: no cluster with this id in your organization. Check the id. RESOURCE_NOT_FOUND: the id is not a cluster id (k8s_…).
409KUBERNETES_CLUSTER_NOT_RUNNING: start the cluster first. KUBERNETES_CLUSTER_BUSY: the cluster is already changing. Wait until it is running or stopped. KUBERNETES_CLUSTER_NOT_CHANGEABLE: the cluster cannot make this change now (stopped, being deleted, or failed). CONCURRENT_UPDATE: the cluster changed while this request was being processed. Retry the request; if it repeats, read the cluster first.
413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
422VALIDATION_FAILED: workers REQUIRED (send at least one field) or INVALID_KUBERNETES_WORKER_COUNT (1 to 10); autoscaling INVALID_KUBERNETES_AUTOSCALING; api_allowed_cidrs INVALID_API_ALLOWED_CIDRS or API_ALLOWED_CIDRS_VPC_ONLY.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X PATCH "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Delete a Kubernetes cluster

Deletes the cluster. It disappears from your lists and stops billing at once, and no longer counts toward your cluster limit; its nodes are stopped and destroyed with their disks within minutes and cannot be recovered. Volumes your workloads created through persistent volume claims are deleted with it. Deleting a cluster already being deleted returns an empty operation_id.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

Scope: write. Destructive: an AI app's key also needs delete.

DELETE/public/v1/kubernetes-clusters/{cluster_id}

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND: no cluster with this id in your organization. Check the id. RESOURCE_NOT_FOUND: the id is not a cluster id (k8s_…).
409CONCURRENT_UPDATE: the cluster changed while this request was being processed. Retry the request; if it repeats, read the cluster first.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account and deletes what it names.

curl -X DELETE "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Upgrade a Kubernetes cluster

Moves the cluster to a newer Kubernetes version: one of its available_upgrades (the next patch, or the next minor version). Upgrades never happen on their own and never go down. The cluster must be running; nodes are replaced one at a time.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

POST/public/v1/kubernetes-clusters/{cluster_id}/upgrade

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Body

application/json

kubernetes_version_idstringrequired
One of the cluster's available_upgrades.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND: no cluster with this id in your organization. Check the id. RESOURCE_NOT_FOUND: the id is not a cluster id (k8s_…).
409KUBERNETES_CLUSTER_NOT_RUNNING: start the cluster first. KUBERNETES_CLUSTER_BUSY: the cluster is already changing. Wait until it is running or stopped. KUBERNETES_CLUSTER_NOT_CHANGEABLE: the cluster cannot make this change now (stopped, being deleted, or failed). CONCURRENT_UPDATE: the cluster changed while this request was being processed. Retry the request; if it repeats, read the cluster first.
413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
422VALIDATION_FAILED: kubernetes_version_id REQUIRED, INVALID_KUBERNETES_VERSION or KUBERNETES_UPGRADE_NOT_ALLOWED (pick one of available_upgrades).
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/upgrade" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "kubernetes_version_id": "k8sv_07hm4y0ur8n3w9s5z2d6e1aq9x"
  }'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Resize worker node compute plan

Resizes the compute plan of worker nodes in the cluster via zero-downtime rolling replacement. A new worker node with the updated plan is provisioned, joins the cluster, workloads migrate, and the old node is retired.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

POST/public/v1/kubernetes-clusters/{cluster_id}/resize-plan

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Body

application/json

node_planstringrequired
The new node plan slug, from the plans list. In a zone with one fixed node size the plan must be that size (422 KUBERNETES_PLAN_NOT_IN_ZONE).

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND: no cluster with this id in your organization. Check the id. RESOURCE_NOT_FOUND: the id is not a cluster id (k8s_…).
409KUBERNETES_CLUSTER_NOT_RUNNING: start the cluster first. KUBERNETES_CLUSTER_BUSY: the cluster is already changing. Wait until it is running or stopped. KUBERNETES_CLUSTER_NOT_CHANGEABLE: the cluster cannot make this change now (stopped, being deleted, or failed). CONCURRENT_UPDATE: the cluster changed while this request was being processed. Retry the request; if it repeats, read the cluster first.
413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
422VALIDATION_FAILED: node_plan REQUIRED or INVALID_KUBERNETES_NODE_PLAN.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/resize-plan" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "node_plan": "s-2vcpu-4gb"
  }'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Start a Kubernetes cluster

Starts a stopped cluster. Its nodes are billed for compute again once it runs.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

POST/public/v1/kubernetes-clusters/{cluster_id}/start

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND: no cluster with this id in your organization. Check the id. RESOURCE_NOT_FOUND: the id is not a cluster id (k8s_…).
409KUBERNETES_CLUSTER_BUSY: the cluster is already changing. Wait until it is running or stopped. KUBERNETES_CLUSTER_NOT_CHANGEABLE: the cluster cannot make this change now (stopped, being deleted, or failed). CONCURRENT_UPDATE: the cluster changed while this request was being processed. Retry the request; if it repeats, read the cluster first.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/start" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Upgrade Kubernetes cluster networking

Reconfigures the CNI plugin (flannel, wireguard, calico), Pod CIDR, Service CIDR, or API allowed CIDR ranges for the cluster.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

POST/public/v1/kubernetes-clusters/{cluster_id}/upgrade-network

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Body

application/json

cni_pluginstring
The new CNI plugin (flannel, wireguard, or calico).
pod_cidrstring
The new IPv4 CIDR range allocated for cluster pods.
service_cidrstring
The new IPv4 CIDR range allocated for cluster services.
api_allowed_cidrsarray of string
The new allowed IPv4 CIDRs reaching the API server.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND: no cluster with this id in your organization. Check the id. RESOURCE_NOT_FOUND: the id is not a cluster id (k8s_…).
409KUBERNETES_CLUSTER_NOT_RUNNING: start the cluster first. KUBERNETES_CLUSTER_BUSY: the cluster is already changing. Wait until it is running or stopped. KUBERNETES_CLUSTER_NOT_CHANGEABLE: the cluster cannot make this change now (stopped, being deleted, or failed). CONCURRENT_UPDATE: the cluster changed while this request was being processed. Retry the request; if it repeats, read the cluster first.
413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
422VALIDATION_FAILED: INVALID_KUBERNETES_CNI_PLUGIN or INVALID_KUBERNETES_CIDR.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/upgrade-network" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Stop a Kubernetes cluster

Stops a running cluster. While stopped only its disks are billed.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

POST/public/v1/kubernetes-clusters/{cluster_id}/stop

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND: no cluster with this id in your organization. Check the id. RESOURCE_NOT_FOUND: the id is not a cluster id (k8s_…).
409KUBERNETES_CLUSTER_BUSY: the cluster is already changing. Wait until it is running or stopped. KUBERNETES_CLUSTER_NOT_CHANGEABLE: the cluster cannot make this change now (stopped, being deleted, or failed). CONCURRENT_UPDATE: the cluster changed while this request was being processed. Retry the request; if it repeats, read the cluster first.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/stop" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Download a kubeconfig

The cluster's admin kubeconfig, for kubectl. It holds a long-lived cluster-admin credential: store it like a password. It is fetched fresh on each call and is not kept by the platform. Available while the cluster is running. It is a POST that needs a write key so that a read-only key can never fetch a cluster-admin credential; the response is Cache-Control: no-store.

POST/public/v1/kubernetes-clusters/{cluster_id}/kubeconfig

Write keyNeeds Idempotency-KeyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Response 200

The kubeconfig.

kubeconfigstringrequired
A kubeconfig file (YAML). Secret: it grants cluster-admin.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND: no cluster with this id in your organization. Check the id. RESOURCE_NOT_FOUND: the id is not a cluster id (k8s_…).
409KUBECONFIG_UNAVAILABLE: the cluster is not running yet. Wait until it is, then try again.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. KUBERNETES_UNAVAILABLE: managed Kubernetes is not open on this platform yet.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/kubeconfig" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 200

{
  "kubeconfig": "apiVersion: v1\nkind: Config\nclusters:\n- name: prod-web\n  cluster:\n    server: https://…:6443\n    certificate-authority-data: …\n…"
}

List a cluster's nodes

The cluster's nodes as Kubernetes reports them right now, read from the cluster's own API server. vcpu and memory_mb are each node's capacity; disk_gb is the cluster's node plan.

Errors: 404 KUBERNETES_CLUSTER_NOT_FOUND; 409 KUBERNETES_CLUSTER_NOT_RUNNING (start the cluster first); 503 KUBERNETES_API_UNREACHABLE (the API server did not answer: it may still be starting, or its endpoint may be private; retry).

GET/public/v1/kubernetes-clusters/{cluster_id}/nodes

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

cluster_idstringrequired

Response 200

The cluster's nodes.

nodesarray of objectrequired
Show 10 child fieldsHide child fields
- idstringrequired
  The node's name, which is its id inside Kubernetes.
- namestringrequired
- rolestringrequired
  One of control, worker.
- statusstringrequired
  One of Ready, NotReady.
- ip_addressstringrequired
  The node's internal address.
- vcpuintegerrequired
- memory_mbintegerrequired
- disk_gbintegerrequired
- kubelet_versionstringrequired
- created_atstring or nullrequired

Errors

403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND.
409KUBERNETES_CLUSTER_NOT_RUNNING.
503KUBERNETES_API_UNREACHABLE: retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequired

curl "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/nodes" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "nodes": [
    {
      "id": "id",
      "name": "web-1",
      "role": "control",
      "status": "Ready",
      "ip_address": "ip-address",
      "vcpu": 2,
      "memory_mb": 4096,
      "disk_gb": 80,
      "kubelet_version": "v1.31.2+k3s1",
      "created_at": "2026-10-03T09:30:00Z"
    }
  ]
}

Get a cluster's services and pods

Every Service and pod in the cluster, in every namespace, read live from its API server. A cluster you have not deployed anything to shows only what Kubernetes itself runs. A service you exposed (see Expose a Kubernetes service) has public_port and external_url, the address it is reached on from the internet.

Errors: 404 KUBERNETES_CLUSTER_NOT_FOUND; 409 KUBERNETES_CLUSTER_NOT_RUNNING; 503 KUBERNETES_API_UNREACHABLE (retry).

GET/public/v1/kubernetes-clusters/{cluster_id}/workloads

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

cluster_idstringrequired

Response 200

The cluster's services and pods.

cluster_idstringrequired
public_ipstring or nullrequired
The public address exposed services and the API server are reached on; null until routing has been synced.
api_portinteger or nullrequired
The cluster's API server port on public_ip; null for a private endpoint or before routing is synced.
servicesarray of objectrequired
Show 9 child fieldsHide child fields
- namestringrequired
- namespacestringrequired
- typestringrequired
- cluster_ipstringrequired
- external_ipstring or nullrequired
- portsarray of objectrequired
  Show 5 child fieldsHide child fields
  - namestringrequired
  - protocolstringrequired
  - portintegerrequired
  - target_portinteger
    Left out when the target is a named container port.
  - node_portinteger
- public_portinteger or nullrequired
  The public port routed to this service; null when it is not exposed.
- external_urlstring or nullrequired
- created_atstring or nullrequired
podsarray of objectrequired
Show 9 child fieldsHide child fields
- namestringrequired
- namespacestringrequired
- statusstringrequired
- readystringrequired
  Ready containers over all containers.
- restartsintegerrequired
- node_namestringrequired
- pod_ipstringrequired
- agestringrequired
  As kubectl's AGE column.
- created_atstring or nullrequired

Errors

403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND.
409KUBERNETES_CLUSTER_NOT_RUNNING.
503KUBERNETES_API_UNREACHABLE: retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequired

curl "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/workloads" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "cluster_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "public_ip": "public-ip",
  "api_port": 1,
  "services": [
    {
      "name": "web-1",
      "namespace": "namespace",
      "type": "ClusterIP",
      "cluster_ip": "cluster-ip",
      "external_ip": "external-ip",
      "ports": [
        {
          "name": "web-1",
          "protocol": "protocol",
          "port": 22,
          "target_port": 1,
          "node_port": 1
        }
      ],
      "public_port": 1,
      "external_url": "http://203.0.113.10:8088",
      "created_at": "2026-10-03T09:30:00Z"
    }
  ],
  "pods": [
    {
      "name": "web-1",
      "namespace": "namespace",
      "status": "Running",
      "ready": "1/1",
      "restarts": 1,
      "node_name": "node-name",
      "pod_ip": "pod-ip",
      "age": "3h",
      "created_at": "2026-10-03T09:30:00Z"
    }
  ]
}

Apply a manifest to a cluster

Applies a YAML manifest (one or more documents, up to 512 KB and 100 objects) to the cluster with server-side apply, as kubectl apply --server-side --force-conflicts would, in order. Namespaced objects without a namespace go in namespace (default default). Applying the same manifest again changes nothing, so a retry is safe. If the cluster refuses an object, the objects before it stay applied and the error names the one it refused.

Errors: 422 VALIDATION_FAILED with errors[].field = manifest and code INVALID_KUBERNETES_MANIFEST, whose message is the cluster's own reason (for example a missing field); 404 KUBERNETES_CLUSTER_NOT_FOUND; 409 KUBERNETES_CLUSTER_NOT_RUNNING; 503 KUBERNETES_API_UNREACHABLE (retry).

POST/public/v1/kubernetes-clusters/{cluster_id}/apply-manifest

Write keyNeeds Idempotency-KeyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired

Body

application/json

manifeststringrequired
At most 524288 characters.
namespacestring
Where namespaced objects without one go; default default.

Response 200

What was applied.

appliedbooleanrequired
cluster_idstringrequired
outputstringrequired
One line per object, as kubectl prints it.
resourcesarray of objectrequired
Show 4 child fieldsHide child fields
- kindstringrequired
- namestringrequired
- namespacestringrequired
  Empty for a cluster-wide object.
- statusstringrequired
  One of created, configured, unchanged.

Errors

403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND.
409KUBERNETES_CLUSTER_NOT_RUNNING.
422VALIDATION_FAILED: INVALID_KUBERNETES_MANIFEST on manifest, or REQUIRED.
503KUBERNETES_API_UNREACHABLE: retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequired

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/apply-manifest" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "manifest": "manifest"
  }'

Response 200

{
  "applied": true,
  "cluster_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "output": "deployment.apps/web created",
  "resources": [
    {
      "kind": "create_instance",
      "name": "web-1",
      "namespace": "namespace",
      "status": "created"
    }
  ]
}

Export a cluster's workloads as YAML

Your objects as they run in the cluster now, as one multi-document YAML stream you can edit and apply back: Namespaces, ConfigMaps, Services, Deployments, StatefulSets, DaemonSets, CronJobs and Ingresses outside the kube-* namespaces. Fields the cluster fills in (status, resource versions, cluster IPs) are left out. Objects a controller made (a Deployment's ReplicaSets and pods) are left out, since their owner is exported. Secrets are never exported.

Errors: 404 KUBERNETES_CLUSTER_NOT_FOUND; 409 KUBERNETES_CLUSTER_NOT_RUNNING; 503 KUBERNETES_API_UNREACHABLE (retry).

GET/public/v1/kubernetes-clusters/{cluster_id}/live-manifests

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

cluster_idstringrequired

Response 200

The exported objects.

cluster_idstringrequired
manifeststringrequired
Empty when you have deployed nothing.
resource_countintegerrequired
retrieved_atstringrequired

Errors

403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND.
409KUBERNETES_CLUSTER_NOT_RUNNING.
503KUBERNETES_API_UNREACHABLE: retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequired

curl "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/live-manifests" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "cluster_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "manifest": "manifest",
  "resource_count": 1,
  "retrieved_at": "2026-10-03T09:30:00Z"
}

Expose a Kubernetes service

Routes public_port on the cluster's public address to a Service. The Service's port becomes a NodePort (node_port, or the one it has, or one the cluster picks), the Service records the public port in its pantechdynamics.com/public-port annotation, and routing is synced. The cluster is the record of what is exposed: removing the annotation with kubectl and syncing routing takes the route away. Your subnet's firewall rules must allow the public port.

Public routing needs a cluster in a VPC subnet: it uses the VPC's public address. Port 22 and the cluster's API port are reserved.

Errors: 404 KUBERNETES_CLUSTER_NOT_FOUND; 404 KUBERNETES_SERVICE_NOT_FOUND (apply the Service first); 409 PORT_IN_USE (another service, cluster or resource uses that public port; choose another); 409 KUBERNETES_ROUTING_UNAVAILABLE (a cluster with no VPC address); 409 KUBERNETES_CLUSTER_NOT_RUNNING; 422 VALIDATION_FAILED (service_name, public_port or node_port; or INVALID_KUBERNETES_MANIFEST when the cluster refused the change); 503 KUBERNETES_API_UNREACHABLE (retry).

POST/public/v1/kubernetes-clusters/{cluster_id}/expose-service

Write keyNeeds Idempotency-KeyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired

Body

application/json

service_namestringrequired
namespacestring
Default default.
public_portintegerrequired
From 1 to 65535.
node_portinteger
Leave out to keep the Service's own NodePort, or let the cluster choose one.
From 30000 to 32767.
protocolstring
One of TCP, UDP. Defaults to TCP.

Response 200

The service is routed.

successbooleanrequired
cluster_idstringrequired
service_namestringrequired
namespacestringrequired
public_ipstringrequired
public_portintegerrequired
node_portintegerrequired
protocolstringrequired
external_urlstringrequired
statusstringrequired
One of active.

Errors

403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND or KUBERNETES_SERVICE_NOT_FOUND.
409PORT_IN_USE, KUBERNETES_ROUTING_UNAVAILABLE or KUBERNETES_CLUSTER_NOT_RUNNING.
422VALIDATION_FAILED.
503KUBERNETES_API_UNREACHABLE: retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequired

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/expose-service" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "service_name": "service-name",
    "public_port": 1
  }'

Response 200

{
  "success": true,
  "cluster_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "service_name": "service-name",
  "namespace": "namespace",
  "public_ip": "public-ip",
  "public_port": 1,
  "node_port": 1,
  "protocol": "protocol",
  "external_url": "http://203.0.113.10:8088",
  "status": "active"
}

Sync a cluster's public routing

Reconciles the port forwards on the cluster's public address with what the cluster exposes now: its API server (unless its endpoint is private), on the cluster's own API port, and every Service carrying the pantechdynamics.com/public-port annotation. Routes to services no longer exposed are removed. Only the cluster's own routes are ever changed: other clusters and your own port forwards on the same address are left alone.

Every cluster on a shared address gets its own API port: the first 6443, the next 6444, and so on. A new cluster's API port is routed automatically once it is running; call this after exposing or unexposing services with kubectl. If the API server does not answer, only its own route is ensured and no service route is removed.

Errors: 404 KUBERNETES_CLUSTER_NOT_FOUND; 409 PORT_IN_USE; 409 KUBERNETES_ROUTING_UNAVAILABLE (a cluster with no VPC address); 409 KUBERNETES_CLUSTER_NOT_RUNNING.

POST/public/v1/kubernetes-clusters/{cluster_id}/sync-routing

Write keyNeeds Idempotency-KeyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired

Response 200

The routes now in place.

successbooleanrequired
cluster_idstringrequired
public_ipstringrequired
api_portinteger or nullrequired
Null for a private endpoint.
synced_portsarray of objectrequired
Show 6 child fieldsHide child fields
- purposestringrequired
  One of kubernetes-api, service.
- public_portintegerrequired
- private_portintegerrequired
- protocolstringrequired
- targetstringrequired
  control node, or the service as namespace/name.
- statusstringrequired
  One of active.
messagestringrequired

Errors

403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404KUBERNETES_CLUSTER_NOT_FOUND.
409PORT_IN_USE, KUBERNETES_ROUTING_UNAVAILABLE or KUBERNETES_CLUSTER_NOT_RUNNING.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequired

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/sync-routing" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 200

{
  "success": true,
  "cluster_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "public_ip": "public-ip",
  "api_port": 1,
  "synced_ports": [
    {
      "purpose": "kubernetes-api",
      "public_port": 1,
      "private_port": 1,
      "protocol": "protocol",
      "target": "target",
      "status": "active"
    }
  ],
  "message": "message"
}

List node pools

Lists the cluster's node pools.

GET/public/v1/kubernetes-clusters/{cluster_id}/node-pools

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Response 200

The node pools.

dataarray of KubernetesNodePoolrequired
Show 14 child fieldsHide child fields
- statusstringrequired
  provisioning (workers being built), ready (every worker has joined), updating (a scale in progress), deleting, or unavailable (a pool made while node pools were a preview, with no node size: delete it and create it again).
  One of provisioning, ready, updating, deleting, unavailable.
- observed_workersintegerrequired
  The pool's workers that have joined the cluster. This is what is billed, never workers alone.
- idstringrequired
  e.g. k8spool_....
- cluster_idstringrequired
- namestringrequired
- node_plan_idstringrequired
- workersintegerrequired
- autoscaling_enabledbooleanrequired
- min_workersintegerrequired
- max_workersintegerrequired
- labelsobjectrequired
- taintsarray of KubernetesNodePoolTaintrequired
  Show 3 child fieldsHide child fields
  - keystringrequired
  - valuestringrequired
  - effectstringrequired
    One of NoSchedule, PreferNoSchedule, NoExecute.
- created_atstring or nullrequired
- updated_atstring or nullrequired
next_cursorstring or nullrequired

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404Cluster not found.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503Service unavailable.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

curl "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/node-pools" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "data": [
    {
      "status": "provisioning",
      "observed_workers": 1,
      "id": "id",
      "cluster_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "name": "web-1",
      "node_plan_id": "plan_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "workers": 1,
      "autoscaling_enabled": true,
      "min_workers": 1,
      "max_workers": 1,
      "labels": {},
      "taints": [
        {
          "key": "key",
          "value": "value",
          "effect": "NoSchedule"
        }
      ],
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": "eyJhdCI6IjIwMjYtMTAtMDNUMDk6MzA6MDBaIiwiaWQiOiJ2bV8wNmdrIn0"
}

Create a node pool

Adds a node pool: workers of their own plan, joined with the pool's labels, the label pantech.io/node-pool=<name> and the pool's taints, so workloads choose it with a nodeSelector and tolerations. Each worker is billed as a VM of the pool's plan once it has joined (observed_workers). With autoscaling on, the platform adds a worker when a pod the pool could run is waiting for room, and removes the newest one after 10 idle minutes. A pool's name is unique in its cluster: sending the same pool again is answered as a replay, another pool under a taken name is 409 NODE_POOL_NAME_TAKEN. In a zone with one fixed node size (af-abj-2), the plan must be that size (422 KUBERNETES_PLAN_NOT_IN_ZONE).

POST/public/v1/kubernetes-clusters/{cluster_id}/node-pools

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Body

application/json

namestringrequired
Unique name for the node pool.
plan_idstringrequired
Compute plan ID or slug for the worker VMs.
workersinteger
Worker nodes, 1 to 10. Required unless autoscaling_enabled, when it defaults to min_workers.
autoscaling_enabledboolean
Defaults to false.
min_workersinteger
With autoscaling_enabled: fewest workers, 1 to 10.
max_workersinteger
With autoscaling_enabled: most workers, min_workers to 10. Your credit and limits are checked for this many.
labelsobject
taintsarray of KubernetesNodePoolTaint
Show 3 child fieldsHide child fields
- keystringrequired
- valuestringrequired
- effectstringrequired
  One of NoSchedule, PreferNoSchedule, NoExecute.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400Bad request.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404Cluster not found.
409Cluster busy or duplicate node pool name.
422Validation error.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503Service unavailable.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/node-pools" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "cpu-workers",
    "plan_id": "standard-2"
  }'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Scale a node pool

Changes a node pool's worker count and autoscaling. The body is the pool's whole size.

PATCH/public/v1/kubernetes-clusters/{cluster_id}/node-pools/{pool_id}

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).
pool_idstringrequired
The node pool's id (k8spool_…).

Body

application/json

workersinteger
Worker nodes, 1 to 10. Always send the pool's whole size: autoscaling_enabled left out turns autoscaling off.
autoscaling_enabledboolean
min_workersinteger
max_workersinteger

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400Bad request.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404Cluster or node pool not found.
409Cluster busy.
422Validation error.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503Service unavailable.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

pool_idrequiredThe node pool's id (`k8spool_…`).

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X PATCH "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/node-pools/id_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "id_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Delete a node pool

Removes a node pool: its workers leave the cluster (their pods move to other nodes that can run them) and are destroyed, then the pool goes. Scope: write. Destructive: an AI app's key also needs delete.

DELETE/public/v1/kubernetes-clusters/{cluster_id}/node-pools/{pool_id}

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).
pool_idstringrequired
The node pool's id (k8spool_…).

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400Bad request.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404Cluster or node pool not found.
409Cluster busy.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503Service unavailable.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

pool_idrequiredThe node pool's id (`k8spool_…`).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account and deletes what it names.

curl -X DELETE "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/node-pools/id_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "id_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

List cluster add-ons

Lists the cluster's managed add-ons and what the cluster runs of each: status is active, installing, removing, disabled or unavailable. metrics-server gives kubectl top and the Horizontal Pod Autoscaler; csi-driver is persistent volumes on the node's own disk (StorageClass local-path; the data stays on that node); ingress-controller is ingress-nginx, the default IngressClass, served on 80 and 443 of the cluster's public address in a VPC zone. A cluster starts with metrics-server and csi-driver on.

GET/public/v1/kubernetes-clusters/{cluster_id}/addons

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Response 200

The cluster add-ons.

dataarray of KubernetesClusterAddonrequired
Show 9 child fieldsHide child fields
- idstringrequired
  e.g. k8saddon_....
- cluster_idstringrequired
- namestringrequired
- versionstringrequired
- statusstringrequired
- enabledbooleanrequired
- configurationstringrequired
  JSON-encoded add-on configuration.
- created_atstring or nullrequired
- updated_atstring or nullrequired
next_cursorstring or nullrequired

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404Cluster not found.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503Service unavailable.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

curl "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/addons" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "data": [
    {
      "id": "id",
      "cluster_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "name": "web-1",
      "version": "version",
      "status": "active",
      "enabled": true,
      "configuration": "configuration",
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": "eyJhdCI6IjIwMjYtMTAtMDNUMDk6MzA6MDBaIiwiaWQiOiJ2bV8wNmdrIn0"
}

Toggle a cluster add-on

Turns a managed add-on on or off: metrics-server, csi-driver or ingress-controller. The platform applies it within moments and keeps it that way (a change made with kubectl is put back); the add-on's status shows when it has taken effect. Asking for the state it is already in changes nothing (empty operation_id).

POST/public/v1/kubernetes-clusters/{cluster_id}/addons/{addon_name}/toggle

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).
addon_namestringrequired
The add-on: metrics-server, csi-driver or ingress-controller. Any other name is 422 INVALID_CLUSTER_ADDON.

Body

application/json

enabledbooleanrequired
Whether the add-on should be enabled or disabled.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400Bad request.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404Cluster or add-on not found.
409Cluster busy.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503Service unavailable.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

addon_namerequiredThe add-on: `metrics-server`, `csi-driver` or `ingress-controller`. Any other name is `422 INVALID_CLUSTER_ADDON`.

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/addons/id_06gk3x9tq7m2v8r4y1c5d0zp8w/toggle" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true
  }'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "id_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Configure API server endpoint access

Changes where the API server can be reached from: private (your VPC only, no public address), public (the internet) or dual (both), and optionally replaces the allow-list. A new cluster is private unless you send endpoint_access when you create it. A public or dual cluster holds a public address of its own (public_ip, with the API server on public_port), billed as a static IP for every hour it holds it. Switching to private releases it: the operation finishes only once the API server and the exposed services are no longer reachable from the internet. The allow-list is enforced on the cluster's control node against the address a connection comes from; traffic from inside the VPC always gets through. Clusters created before 22 October 2026 cannot take an allow-list.

POST/public/v1/kubernetes-clusters/{cluster_id}/endpoint-access

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

cluster_idstringrequired
The cluster's id (k8s_…).

Body

application/json

endpoint_accessstringrequired
Endpoint access mode.
One of public, private, dual.
api_allowed_cidrsarray of string
IPv4 CIDRs allowed to connect to the cluster API.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400Bad request.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404Cluster not found.
409Cluster busy.
422Validation error.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503Service unavailable.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

cluster_idrequiredThe cluster's id (`k8s_…`).

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/kubernetes-clusters/k8s_06gk3x9tq7m2v8r4y1c5d0zp8w/endpoint-access" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "endpoint_access": "public"
  }'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "k8s_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}