> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a managed cluster (browser session) > Browser session authentication; RBAC permission `clusters.create`. For Kapsule, provider_cluster_id is the opaque region-qualified `regions/{region}/clusters/{id}` reference. CNI is immutable. Imported/unknown provenance is disconnect-only; provider deletion is allowed by default only for created clusters. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json post /org/clusters/managed/{provider} openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Organisation IAM description: >- Custom organisation roles and scoped role assignments for member and service-account identities. - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: Ankra Cloud Clusters description: >- Provision and manage self-managed kubeadm / k3s clusters on Ankra Cloud servers: a private network, a NAT router and a bastion per cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Pipelines description: Pipeline definitions and the approval of the authority they declare. - name: Backups description: >- Backup vaults, restore points, protection posture and captures for stacks and application deployments; a completed capture is not a verified restore. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Management description: >- Customer agent lifecycle, authenticated identity and organisation automation controls. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Decisions description: >- The decision ledger behind the Security and Cost queues: proposals a surface computed, the approve and set-aside decisions people took on them, and the receipts of running them. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Ankra Cloud Credentials description: >- Ankra Cloud API tokens, shared by the self-managed and managed Ankra Cloud lanes. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /org/clusters/managed/{provider}: post: tags: - Managed Clusters summary: Create a managed cluster (browser session) description: >- Browser session authentication; RBAC permission `clusters.create`. For Kapsule, provider_cluster_id is the opaque region-qualified `regions/{region}/clusters/{id}` reference. CNI is immutable. Imported/unknown provenance is disconnect-only; provider deletion is allowed by default only for created clusters. operationId: managed_create_browser parameters: - in: path name: provider required: true schema: $ref: '#/components/schemas/ManagedProvider' - description: Must match the ankra_csrf browser cookie. in: header name: X-Ankra-CSRF required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateManagedClusterRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/ManagedClusterCreateResponse' description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Invalid request '401': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Unauthenticated '403': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Permission or CSRF check failed '404': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Resource not found '409': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Conflicting or unsafe lifecycle state '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation failed '500': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Provider or internal failure security: - SessionCookie: [] components: schemas: ManagedProvider: enum: - doks - uks - gke - ovh_mks - aks - eks - kapsule - ankracloud_k8s example: kapsule type: string CreateManagedClusterRequest: example: cni: cilium credential_id: 11111111-2222-4333-8444-555555555555 kapsule: private_endpoint: true private_network_id: pn-1 kubernetes_version: '1.31' location: fr-par name: kapsule-prod node_pools: - autohealing: true count: 3 name: default public_ip: false root_volume_type: sbs-5k size: DEV1-M zone: fr-par-1 properties: cluster_plan: anyOf: - type: string - type: 'null' cni: anyOf: - enum: - cilium - cilium_native - calico type: string - type: 'null' credential_id: type: string format: uuid criticality: anyOf: - enum: - production - staging - development - disposable type: string - type: 'null' description: anyOf: - type: string - type: 'null' eks: anyOf: - $ref: '#/components/schemas/EksClusterOptions' - type: 'null' environment: anyOf: - maxLength: 50 minLength: 1 type: string - type: 'null' gitops_branch: type: string default: master gitops_credential_name: anyOf: - type: string - type: 'null' gitops_repository: anyOf: - type: string - type: 'null' gitops_provider: type: string enum: - github - bitbucket_cloud default: github description: >- GitOps provider of the repository the cluster is bootstrapped onto. Omitted is github, where gitops_repository is owner/name. bitbucket_cloud names the repository by gitops_workspace and gitops_repo_slug (or gitops_repository as workspace/repo_slug) and binds it as a Bitbucket Cloud repository. gitops_workspace: anyOf: - type: string - type: 'null' description: >- Bitbucket Cloud workspace of the GitOps repository. Only with gitops_provider bitbucket_cloud; provided together with gitops_repo_slug. gitops_repo_slug: anyOf: - type: string - type: 'null' description: >- Bitbucket Cloud repository slug of the GitOps repository. Only with gitops_provider bitbucket_cloud; provided together with gitops_workspace. gke: anyOf: - $ref: '#/components/schemas/GkeClusterOptions' - type: 'null' ha: anyOf: - type: boolean - type: 'null' kapsule: anyOf: - $ref: '#/components/schemas/KapsuleClusterOptions' - type: 'null' ankracloud_k8s: anyOf: - $ref: '#/components/schemas/AnkraCloudK8sClusterOptions' - type: 'null' description: >- Ankra Cloud Kubernetes networking: an existing private network the nodes join (Ankra creates and owns ankra- otherwise), the RFC 1918 range of that created network, and the IPv4 API endpoint add-on (on unless refused). kubernetes_version: anyOf: - type: string - type: 'null' location: type: string name: type: string node_pools: items: $ref: '#/components/schemas/ManagedNodePoolRequest' minItems: 1 type: array aks: anyOf: - $ref: '#/components/schemas/AksClusterOptions' - type: 'null' required: - name - credential_id - location - node_pools type: object ManagedClusterCreateResponse: properties: cluster_id: type: string format: uuid name: type: string provenance: $ref: '#/components/schemas/ManagedProvenance' required: - cluster_id - name - provenance type: object ContractDetailError: example: detail: Cluster not found properties: detail: oneOf: - type: string - additionalProperties: true properties: {} type: object required: - detail type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object EksClusterOptions: properties: enable_control_plane_logging: anyOf: - type: boolean - type: 'null' security_group_ids: type: array items: type: string subnet_ids: type: array items: type: string vpc_id: anyOf: - type: string - type: 'null' type: object GkeClusterOptions: properties: mode: type: string enum: - standard - autopilot default: standard network: anyOf: - type: string - type: 'null' release_channel: anyOf: - type: string enum: - RAPID - REGULAR - STABLE - type: 'null' subnetwork: anyOf: - type: string - type: 'null' type: object KapsuleClusterOptions: properties: private_endpoint: anyOf: - type: boolean - type: 'null' private_network_id: type: string required: - private_network_id type: object AnkraCloudK8sClusterOptions: description: Ankra Cloud Kubernetes networking options; every member optional. properties: network_cidr: anyOf: - type: string - type: 'null' description: >- RFC 1918 range (/16 to /29) of the private network Ankra creates when private_network_id is omitted; default 10.100.0.0/24. private_network_id: anyOf: - type: string - type: 'null' description: >- Existing Ankra Cloud private network the nodes join; omit to let Ankra create and own ankra-. public_ipv4: anyOf: - type: boolean - type: 'null' description: >- Serve the API endpoint on IPv4 too (paid add-on). Default true: the platform installs its agent over it. type: object ManagedNodePoolRequest: properties: autohealing: anyOf: - type: boolean - type: 'null' autoscaling: anyOf: - $ref: '#/components/schemas/ManagedAutoscaling' - type: 'null' count: default: 1 minimum: 1 type: integer labels: additionalProperties: type: string type: object name: type: string provider_id: anyOf: - type: string - type: 'null' public_ip: anyOf: - type: boolean - type: 'null' root_volume_size_gb: anyOf: - type: integer minimum: 1 - type: 'null' root_volume_type: anyOf: - type: string - type: 'null' security_group_id: anyOf: - type: string - type: 'null' size: type: string status: anyOf: - type: string - type: 'null' taints: items: $ref: '#/components/schemas/ScalewayNodeTaint' type: array upgrade_policy: anyOf: - type: string - type: 'null' zone: anyOf: - type: string - type: 'null' spot: anyOf: - $ref: '#/components/schemas/ManagedSpot' - type: 'null' required: - name - size type: object AksClusterOptions: properties: resource_group: anyOf: - type: string - type: 'null' network_plugin: default: azure enum: - azure - kubenet type: string private_cluster: default: false type: boolean sku_tier: anyOf: - enum: - Free - Standard - Premium type: string - type: 'null' vnet_subnet_id: anyOf: - type: string - type: 'null' description: >- ARM id of the subnet every agent pool joins (azure network plugin). Omit for an AKS-managed VNet. maintenance_window: anyOf: - $ref: '#/components/schemas/ManagedMaintenanceWindow' - type: 'null' type: object ManagedProvenance: enum: - created - imported - unknown type: string ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object ManagedAutoscaling: properties: enabled: type: boolean default: true max_count: type: integer minimum: 1 min_count: type: integer minimum: 1 required: - min_count - max_count type: object ScalewayNodeTaint: properties: effect: enum: - NoSchedule - PreferNoSchedule - NoExecute type: string key: type: string value: default: '' type: string required: - key - effect type: object ManagedSpot: description: >- Spot / preemptible capacity for a node pool (AKS scaleSetPriority Spot). max_price is the hourly cap in the provider's currency; null means up to the on-demand price. properties: enabled: type: boolean max_price: anyOf: - type: number exclusiveMinimum: 0 - type: 'null' required: - enabled type: object ManagedMaintenanceWindow: description: >- When the provider may run control-plane and node upgrades (AKS planned maintenance): an English weekday, a 0-23 UTC start hour and a 4-24 hour duration. properties: day: enum: - Monday - Tuesday - Wednesday - Thursday - Friday - Saturday - Sunday type: string start_hour: maximum: 23 minimum: 0 type: integer duration_hours: maximum: 24 minimum: 4 type: integer required: - day - start_hour - duration_hours type: object securitySchemes: SessionCookie: description: Browser session. Mutations also require X-Ankra-CSRF. in: cookie name: ankra_session type: apiKey ````