Pantahub services

The Pantahub API (pantahub-base) is composed of small REST services, each mounted under its own path. These pages document every service the way you use it from the command line — what it is for, who authenticates to it, and the request flows that matter — complementing the endpoint-by-endpoint API Reference and the ideas explained in How the platform works.

All examples use https://api.pantahub.com; on a self-hosted Hub substitute your own API endpoint. Most calls need a JWT from auth:

TOKEN=$(curl -s -X POST https://api.pantahub.com/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"<nick>","password":"<password>"}' | jq -r .token)

The services

Service	Path	What it does
auth	/auth	Accounts, login, tokens, OAuth-style delegation
devices	/devices	The device registry: claiming, metadata, device tokens
trails	/trails	Per-device revision history that drives updates
objects	/objects	Content-addressed blob storage with signed URLs
logs	/logs	Device log ingestion and querying
apps	/apps	Third-party OAuth applications and scopes
profiles	/profiles	Public user profiles
subscriptions	/subscriptions	Plans and quotas (admin-managed)
dash	/dash	Per-account summary: quotas, top devices
metrics	/metrics	Prometheus metrics of the service itself
healthz	/healthz	Liveness/readiness for operators
cron	/cron	Recurring maintenance endpoints
callbacks	/callbacks	Change-propagation hooks

Identities and PRNs

Everything in Pantahub is addressed by a PRN (Pantahub Resource Name) — prn:::devices:/<id>, prn:::accounts:/<id>, prn:pantahub.com:objects:/<id>, and so on. Three account classes authenticate against the same auth service:

• USER — humans (and bots) with nick, email and password.
• DEVICE — devices, logging in with their PRN as username and their creds.secret as password.
• SERVICE — API services that can act on behalf of users via delegated tokens.

The last three services in the table (healthz, cron, callbacks) are operator endpoints: they use HTTP Basic auth as saadmin with the PANTAHUB_SA_ADMIN_SECRET configured on the server, not JWTs.