Skip to content

Enterprise Control Plane

The Enterprise Control Plane is the shared API at api.engineeringruntime.com plus the enterprise UI at app.engineeringruntime.com. Together they give an organization one place to publish policy, watch a fleet of runtimes, read audit history, and issue API keys.

Optional by design

The runtime is a local binary. It executes, evaluates policy and writes its audit log locally, and it keeps doing all three when the Control Plane is unreachable or was never configured. Nothing on this page is required to run a single command.

What it is

Piece Host Role
API api.engineeringruntime.com Serves both surfaces — /api/public (open, demo + Community) and /api/v1 (organization-scoped). Also publishes the OpenAPI contract and /metadata/*
Enterprise UI app.engineeringruntime.com Signed-in dashboards over /api/v1: Dashboard, Fleet, Providers, Capabilities, Policies, Audit, Organizations, API Keys, Settings
Demo UI demo.engineeringruntime.com The same shapes without an account, over /api/public — Static fixtures or Live Demo
Runtime client your machine / CI The portal: block in config.yaml and the runtime portal commands — documented here

Why it is a separate application

Because the two audiences need different front doors:

Path Entry Auth Why
Community demo. → /api/public None Evaluating, learning, or running the binary locally must never require an account
Enterprise app. → /api/v1 Sign-in, organization-scoped Policy publication, audit history and API keys belong to an organization, not to the public internet

Keeping them apart is what lets the public surface stay open without exposing anyone's organization data, and lets the runtime remain useful with no server at all.

How to get access

app.engineeringruntime.com is invitation-gated. There is no self-serve sign-up: credentials are issued after organization onboarding.

  1. Try the demo first — demo.engineeringruntime.com shows the same dashboards against the open surface, with no account.
  2. Explore the API — api.engineeringruntime.com is a public portal: /openapi.yaml, /swagger, /metadata.
  3. Request enterprise access — via the request link on the login page.

What works today

Read this table as the answer to "what can I actually do on app. right now?" It is written from the shipping API routes and UI pages, not from a plan.

Feature API (api.) App UI (app.) Status
Email/password login (JWT) POST /api/v1/auth/login, GET /api/v1/auth/me Login page Available
SSO / OIDC / SAML — — Not implemented — roadmap
Organizations GET /api/v1/organizations Organizations page (list) Available, single seeded org — no self-serve create or onboarding route
Multi-org tenancy / org switcher JWT carries the organization id; every query is org-scoped No switcher Partial — the data model is org-scoped, the experience is single-org
Users GET /api/v1/users Not surfaced as its own page yet Available on the API (list)
API keys GET / POST / DELETE /api/v1/api-keys API Keys page Available — plaintext key shown once on create
Policies GET/POST {prefix}/policies, GET {prefix}/policies/:version Policies page Available — publish, list, fetch a version
Providers & capabilities {prefix}/providers, {prefix}/provider-names, {prefix}/capabilities Providers / Capabilities pages Available — catalog generated from the runtime binary
Audit POST/GET {prefix}/audit Audit page Available — ingest from runtimes, query with filters
Fleet / runtime registration GET {prefix}/fleet, POST {prefix}/fleet/heartbeat, POST {prefix}/runtime/register Fleet page Available
Dashboard / settings GET {prefix}/dashboard, GET /api/v1/settings Dashboard / Settings pages Available
RBAC The JWT carries a role claim — Partial — roles are issued and readable, but routes do not restrict by role
AI Governance as its own surface — — Not implemented — roadmap

{prefix} is /api/public or /api/v1; both prefixes expose the same shapes, and the shared demo deployment answers on both. The canonical, always-current list of operations is the API's own contract — /openapi.yaml and /metadata/apis. This page does not restate it.

What is not implemented yet

Named plainly, because discovering these one at a time during an evaluation is worse than reading them here:

Not built What that means today
SSO / OIDC / SAML Sign-in is email and password only. The Settings page reports OIDC as planned; there is no identity-provider integration to configure
Self-serve multi-org onboarding Organizations can be listed, not created through the product. A new organization is a manual onboarding step
RBAC route enforcement A role claim rides in the token and the UI can read it, but no /api/v1 route refuses a request because of it. Do not treat roles as an authorization boundary
Durable multi-tenant storage The shared deployment runs SQLite inside the container. Data written there does not survive a new revision. Postgres is supported by the code (DATABASE_DRIVER=postgres) and is the path for anything that must persist
AI Governance product surface Governance of AI-driven operations happens today through the same policy and audit machinery as everything else. There is no separate AI Governance product area
Enforced auth on the shared deployment The public deployment runs with REQUIRE_AUTH=false so demos and Community runtimes work without credentials. See the note below

REQUIRE_AUTH=false is a demo posture, not a product guarantee

The shared api. deployment exists so anyone can evaluate the platform without an account, and it holds demo data only. A deployment that holds real organization data runs with REQUIRE_AUTH=true, which makes /api/v1 require a JWT or an API key. What a given deployment actually enforces is published live at /metadata/authentication — read from the running configuration, so it cannot claim a check the process does not perform.

Security model, briefly

Caller Credential Where
A person JWT from POST /api/v1/auth/login, sent as Authorization: Bearer … App UI sign-in
A runtime X-API-Key: erk_… issued on the API Keys page Runtime → API calls, when the deployment enforces auth
Anyone None /api/public, the portal pages, /openapi.yaml, /metadata/* — public on purpose

Two consequences worth stating:

  • The runtime client does not send credentials yet. It authenticates nothing and verifies the server no further than HTTPS — see the Security section of the portal page. Keep the surface a runtime points at one you trust.
  • Audit is local-first. logs/audit.log is written before anything is sent, and its failure is fatal to the command. The uplink is best-effort; losing it loses the copy, never the record.

Live posture: /metadata/authentication.

See also