ENVIRONMENT_VARIABLE object type lets you create, update, and read environment variables managed by the Astro Environment Manager, with an optional secret value.SIGV4 auth type accepts an sigV4AssumeArn IAM role ARN and an sigV4StsRegion AWS STS region.drPodSubnetRange, drServiceSubnetRange, and drServicePeeringRange, and the existing DR fields are no longer scoped to AWS only.location field to ProviderRegion for multi-region DR compatibility.ENVIRONMENT_VARIABLE: added to the environment object type enum on CreateEnvironmentObjectRequest and EnvironmentObject, and to the type query parameter on GET /organizations/{organizationId}/environment-objects.SIGV4: added to the authType enum on the six metrics export schemas (CreateEnvironmentObjectMetricsExportRequest, CreateEnvironmentObjectMetricsExportOverridesRequest, UpdateEnvironmentObjectMetricsExportRequest, UpdateEnvironmentObjectMetricsExportOverridesRequest, EnvironmentObjectMetricsExport, and EnvironmentObjectMetricsExportOverrides).CreateEnvironmentObjectEnvironmentVariableRequest: isSecret (boolean) and value (string).CreateEnvironmentObjectEnvironmentVariableOverridesRequest: value (string).UpdateEnvironmentObjectEnvironmentVariableRequest: value (string).UpdateEnvironmentObjectEnvironmentVariableOverridesRequest: value (string).EnvironmentObjectEnvironmentVariable: isSecret (boolean, required) and value (string, required). value is returned empty when the variable is a secret.EnvironmentObjectEnvironmentVariableOverrides: value (string, required).environmentVariable: added to CreateEnvironmentObjectRequest, CreateEnvironmentObjectOverridesRequest, UpdateEnvironmentObjectRequest, UpdateEnvironmentObjectOverridesRequest, and EnvironmentObject.environmentVariableOverrides: added to EnvironmentObjectLink.sigV4AssumeArn (string) and sigV4StsRegion (string): added to all six metrics export schemas listed under Enum values.drPodSubnetRange, drServiceSubnetRange, and drServicePeeringRange (string, GCP clusters only): added to Cluster, CreateGcpClusterRequest, and UpdateDedicatedClusterRequest.enableReplicationTimeControl (boolean): added to CreateAzureClusterRequest, CreateGcpClusterRequest, and UpdateDedicatedClusterRequest.drRegion and drVpcSubnetRange: added to UpdateDedicatedClusterRequest.location (string): added to ProviderRegion. The multi-region location code for DR compatibility.enableReplicationTimeControl description updated from “S3 Replication Time Control” to “Bucket Storage Replication Time Control” on Cluster and CreateAwsClusterRequest.drRegion is no longer AWS-only: removed “For AWS clusters only” on CreateAwsClusterRequest, CreateAzureClusterRequest, and CreateGcpClusterRequest.drVpcSubnetRange is no longer AWS-only: removed “For AWS clusters only” on Cluster, CreateAwsClusterRequest, CreateAzureClusterRequest, and CreateGcpClusterRequest.drSecondaryVpcCidr description now notes it applies to AWS clusters only on CreateAwsClusterRequest.POST /organizations/{organizationId}/environment-objects (CreateEnvironmentObject) description updated to include environment variables alongside connections, Airflow variables, and metrics export resources.POST /organizations/{organizationId}/allowed-ip-address-ranges/bulk-create and POST /organizations/{organizationId}/allowed-ip-address-ranges/bulk-delete. Each request accepts up to 1,000 items and processes the batch atomically.Endpoints
POST /organizations/{organizationId}/allowed-ip-address-ranges/bulk-create: Create up to 1,000 allowed IP address ranges for an Organization in one request. The batch is created atomically: if any value fails validation or conflicts with an existing range, no ranges are created. The endpoint is not idempotent, so a retry after an unacknowledged 2xx response can return 409. On success, the endpoint returns the created ranges as an AllowedIpAddressRangesList. Requires the organization.allowedIpAddressRanges.create permission.POST /organizations/{organizationId}/allowed-ip-address-ranges/bulk-delete: Delete up to 1,000 allowed IP address ranges for an Organization in one request. The batch is deleted atomically. Unknown and duplicate IDs are accepted and ignored, and matching ranges for the Organization are deleted. The endpoint returns 204 with no response body. Requires the organization.allowedIpAddressRanges.delete permission.Schemas
BulkCreateAllowedIpAddressRangesRequest: Request body for bulk create. Required: allowedIpAddressRanges, a non-empty array of up to 1,000 CIDR-format strings.BulkDeleteAllowedIpAddressRangesRequest: Request body for bulk delete. Required: allowedIpAddressRangeIds, a non-empty array of up to 1,000 allowed IP address range IDs.AllowedIpAddressRangesList: Response body for bulk create. Required: allowedIpAddressRanges, an array of AllowedIpAddressRange.podEphemeralStorage to the worker queue schemas so callers can set the ephemeral storage limit for each worker Pod.WorkerQueue: podEphemeralStorage (string). The ephemeral storage limit for each worker Pod. Units are in Gibibytes or Gi. Example: 10Gi.WorkerQueueRequest: podEphemeralStorage (string). The ephemeral storage limit for each worker Pod. Must be a valid Kubernetes resource string, for example 10Gi.UpdateWorkerQueueRequest: podEphemeralStorage (string). The ephemeral storage limit for each worker Pod. Must be a valid Kubernetes resource string, for example 10Gi.lastRotatedAt to ApiToken so callers can see when a token was last rotated.git object (CreateDeployGitRequest on requests, DeployGit on responses) on CreateDeployRequest and Deploy for attaching git commit metadata to a deploy. A new GENERIC provider value (alongside GITHUB) supports non-GitHub remotes such as GitLab, Bitbucket, and self-hosted git via a remoteUrl field.IBM_ENTERPRISE as a value on OrganizationProductPlan.productPlanName.Workspace.defaultCloudProvider from a free-form string to the enum AWS, AZURE, GCP.Schemas
CreateDeployGitRequest and DeployGit: Git commit metadata associated with a deploy. Required: commitSha, provider. Optional: account, authorName, authorUrl, authorUsername, beforeCommitSha, branch, commitUrl, path, remoteUrl, repo. provider accepts GITHUB or GENERIC. For GITHUB, supply account and repo and leave remoteUrl empty. For GENERIC, supply remoteUrl and leave account and repo empty.Properties
ApiToken: lastRotatedAt (string, date-time). The time when the API token was last rotated.CreateDeployRequest, Deploy: git (object). Git commit metadata for the deploy. See CreateDeployGitRequest and DeployGit.Enum values
OrganizationProductPlan.productPlanName: IBM_ENTERPRISE.Workspace.defaultCloudProvider: Now restricted to the enum AWS, AZURE, GCP (previously a free-form string).name and workspaceId. The server resolves infrastructure from Workspace defaults (or auto-selects when the Organization has a single non-shared cluster), infers the Deployment type from the resolved cluster, and applies defaults for runtime version, executor, scheduler size, and related fields. This reduces the create Deployment API from roughly 15 required fields down to 2.defaultClusterId, defaultCloudProvider, and defaultRegion on Workspace so Workspace admins can pre-configure target infrastructure for new Deployments. defaultClusterId is mutually exclusive with defaultCloudProvider and defaultRegion.GET /organizations/{organizationId}/deployments/{deploymentId}/logs and GET /users/self endpoints.hasAllowedIpAddressRanges and shouldEnforceDedicatedClusters as required properties on the Organization schema.workspaceId and deploymentId filters to GET /organizations/{organizationId}/teams.Endpoints
GET /organizations/{organizationId}/deployments/{deploymentId}/logs: Get logs for an Astro Deployment. Supports filtering by log source (scheduler, triggerer, worker, webserver, dag-processor, apiserver), time range, text search, and pagination.GET /users/self: Get the authenticated user’s profile, roles, invites, and feature flags. Supports an optional createIfNotExist query parameter.Schemas
CreateDeploymentInstanceSpecRequest
au: Integer. Astro unit allocation for the Deployment pod. Minimum 5, maximum 24. Optional.replicas: Integer. Number of pod replicas. Minimum 1, maximum 4. Optional.UpdateDeploymentInstanceSpecRequest
au: Integer. Astro unit allocation for the Deployment pod. Minimum 5, maximum 24. Required.replicas: Integer. Number of pod replicas. Minimum 1, maximum 4. Required.DeploymentLog
limit, maxNumResults, offset, resultCount, results, searchId.results: Array of DeploymentLogEntry.DeploymentLogEntry
raw (string), source (enum: scheduler, webserver, triggerer, worker, dag-processor, apiserver), timestamp (number).SelfUser
avatarUrl, createdAt, fullName, id, status, updatedAt, username.featureFlags, invites, isIdpManaged, organizationId, and roles.SelfUserFeatureFlag, SelfUserInvite, SelfUserRole, SelfUserRoleScope: Supporting schemas for SelfUser.UpdateWorkerQueueRequest: Used by the workerQueues array on UpdateDedicatedDeploymentRequest, UpdateHybridDeploymentRequest, and UpdateStandardDeploymentRequest. Required fields: isDefault, maxWorkerCount, minWorkerCount, name, workerConcurrency.Properties
CreateWorkspaceRequest and UpdateWorkspaceRequest: defaultCloudProvider (enum: AWS, AZURE, GCP), defaultClusterId, and defaultRegion. Workspace admins use these fields to pre-configure target infrastructure for new Deployments. When a create Deployment request omits clusterId, cloudProvider, and region, the server uses these Workspace defaults. defaultClusterId is mutually exclusive with defaultCloudProvider and defaultRegion.Organization: hasAllowedIpAddressRanges (boolean, required) indicating whether the Organization has at least one allowed IP address range configured, and shouldEnforceDedicatedClusters (boolean, required).UpdateOrganizationRequest: shouldEnforceDedicatedClusters (boolean).Workspace: defaultCloudProvider, defaultClusterId, and defaultRegion (strings) reflecting the configured defaults.Query parameters
GET /organizations/{organizationId}/teams: workspaceId and deploymentId filter the response to Teams with a role in the specified Workspace or Deployment.name and workspaceId.UserTeamMembership and UserTeamsPaginated to manage team memberships and pagination.Cluster schema with new properties for Disaster Recovery (DR) support, including drRegion, isDrEnabled, and others.astroRuntimeVersion property from deployment update requests.Schemas:
UserTeamMembership
dagRoles: Array of DAG roles.deploymentRoles: Array of deployment roles.description: String, example: ‘My Team description’.id: String, example: ‘clma5ftgk000008mhgev00k7d’.isIdpManaged: Boolean, example: False.name: String, example: ‘My Team’.organizationRole: Enum with values like ‘ORGANIZATION_OWNER’, ‘ORGANIZATION_MEMBER’, etc.rolesCount: Integer, example: 1.workspaceRoles: Array of workspace roles.UserTeamsPaginated
limit: Integer, example: 10.offset: Integer, example: 0.teams: Array of UserTeamMembership.totalCount: Integer, example: 100.Cluster
drRegion: String, example: ‘us-east-1’.drSecondaryVpcCidr: String.drVpcSubnetRange: String.enableReplicationTimeControl: Boolean.failoverInProgress: Boolean.isDrEnabled: Boolean.isFailedOver: Boolean.CreateAwsClusterRequest, CreateAzureClusterRequest, CreateGcpClusterRequest
drRegion: String, example: ‘us-west-2’.drSecondaryVpcCidr: String, example: ‘100.64.0.0/19’.drVpcSubnetRange: String, example: ‘172.20.0.0/22’.enableReplicationTimeControl: Boolean.CreateDedicatedDeploymentRequest, CreateHybridDeploymentRequest, CreateStandardDeploymentRequest
drWorkloadIdentity: String, example: ‘arn:aws:iam::123456789:role/AirflowS3Logs-clmk2qqia000008mhff3ndjr0’.Deployment
drExternalIPs: Array of strings.drOidcIssuerUrl: String, example: ‘https://westus2.oic.prod-aks.azure.com/…’.effectiveDRWorkloadIdentity: String.UpdateDedicatedClusterRequest
enableDr: Boolean.isFailedOver: Boolean.UpdateDedicatedDeploymentRequest, UpdateHybridDeploymentRequest, UpdateStandardDeploymentRequest
drWorkloadIdentity: String.environmentVariables: List of environment variables.Permissions:
/organizations/{organizationId}/environment-objects and related endpoints: organization.envObjects.access./organizations/{organizationId}/tokens and related endpoints: organization.apiTokens.access./organizations/{organizationId}/users/{userId}/roles: organization.userRoles.access.Schemas:
Cluster
secondaryVpcCidr description updated to “The secondary VPC CIDR. For AWS clusters only.”drRegion, isDrEnabled, and name to required fields.OrganizationProductPlan
ENTERPRISE_BUSINESS_CRITICAL to productPlanName enum.Endpoints:
/organizations/{organizationId}/users/{userId}/teams
TeamsPaginated to UserTeamsPaginated.organization.users.get to organization.teams.get.Removed:
astroRuntimeVersion from UpdateDedicatedDeploymentRequest, UpdateHybridDeploymentRequest, and UpdateStandardDeploymentRequest.GET /organizations/{organizationId}/users/{userId}/teams: List all Teams that a user belongs to within an Organization. Supports pagination with offset and limit query parameters, and sorting with the sorts query parameter.CreateClusterRequest, CreateDeploymentRequest, UpdateClusterRequest, and UpdateDeploymentRequest schemas. Discriminators remove ambiguity when creating or updating resources by mapping requests to the correct cloud provider or Deployment type.ApiTokenRole and API token listing parameters.cloudProvider with mappings for AWS, AZURE, and GCP.type with mappings for DEDICATED, HYBRID, and STANDARD.clusterType with mappings for DEDICATED and HYBRID.type with mappings for DEDICATED, HYBRID, and STANDARD.environmentVariables.entityId.DagRole, Deployment, and Team schemas to enhance DAG access management./organizations/{organizationId}/tokens and /organizations/{organizationId}/users endpoints.DagRole
dagTag: DAG tag, required if DagId is not specified.DeploymentEnvironmentVariable
updatedAt: Format set to date-time.Invite
expiresAt: Format set to date-time.Role
createdAt and updatedAt: Examples and format set to date-time.RoleWithPermission
createdAt and updatedAt: Examples and format set to date-time.Team
dagRoles: Array of DAG roles./organizations/{organizationId}/tokens
limit: Limit for pagination.sorts: Sorting criteria./organizations/{organizationId}/users
limit: Limit for pagination.sorts: Sorting criteria.ApiTokenRole
entityType: Added DAG_TAG.Initial release of the v1 Astro API.
See Migrate to v1 for key changes and migration steps.