Auth
Cloud Owners create a token in Settings → API. The plaintext token starts with dvnt_ and is shown once; Duvento stores only a SHA-256 hash. Send it as:
Authorization: Bearer dvnt_…last_used_at updates on success. Blocked workspaces get 403. Missing or wrong tokens get 401. Delete the token in the same screen to revoke it.
Endpoints
GET /api/v1/health
GET /api/v1/clients
GET /api/v1/assets
GET /api/v1/assets/{id}GET /api/v1/health is unauthenticated Cloud health. Clients return id, name, contact, email, website. Assets return id, name, type, client, expiry, days left, and status.
The public API is read-only (MCP is a separate POST). There is no pagination, filtering, or token scopes, and no documented rate-limit middleware — do not treat any quota as a product guarantee.