> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create Ankra Cloud cluster (browser session) > Browser session authentication; RBAC permission `clusters. RBAC permission `clusters.create`. Creates a self-managed kubeadm / k3s cluster on Ankra Cloud servers: a private RFC 1918 network (`network_ip_range`, or an adopted `private_network_id`), a bastion and the cluster nodes on the private network only. By default (`network_mode` ipv6_only) the nodes reach IPv4 through the zone's NAT64 and the bastion holds only its public IPv6; `network_mode` ipv4_nat adds a router with NAT for IPv4 egress and gives the bastion a public IPv4. Plans replace instance types (`bastion_plan`, `control_plane_plan`, `worker_plan`, `etcd_plan`; node groups keep `instance_type`), `template` is the OS image (default debian-13). The preflight runs first and the first failing item is the refusal. kubeadm requires Cilium; the ankra-cloud-ccm is always installed. `bastion_port` is accepted for contract symmetry and ignored: the bastion listens on 22. Answers 404 while the organisation's `ankra_cloud_provider` feature flag is off. With no `credential_id`, the organisation's built-in Ankra Cloud credential is used, and the request answers 503 with Retry-After when it cannot be created or renewed right now. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json post /org/clusters/ankracloud openapi: 3.1.0 info: title: Ankra Platform API version: v1 description: >- The Ankra platform HTTP contract. The /api/v1 surface is the public, bearer-authenticated API used by the Ankra CLI, MCP clients and automation; send a personal or service API token as `Authorization: Bearer `. Browser routes under /org and /chat are served on api.platform.ankra.app (each declares that server); they and /oauth/access authenticate with the ankra_session cookie, and mutations also require the X-Ankra-CSRF header. Every operation declares the credential it accepts, and no operation is served without one. This document is published deliberately: it describes the contract only and carries no organisation data or credentials. Report security issues to security@ankra.ai (see /.well-known/security.txt). servers: - url: https://platform.ankra.app security: - BearerAuth: [] tags: - name: Onboarding description: >- Generate a first website from a prompt and deploy it to a new organisation's cluster. - name: Access Gate description: >- Private service sign-in and membership checks for trusted Ankra proxy relays. - name: Canvas Datasets description: >- Read the fixed, named datasets canvas dashboards bind their charts, tables and stats to. - name: Canvases description: >- Keep dashboards and pages in the organisation's canvas library, with revision history, undo and pins. - name: Canvas Pages description: >- Publish a chat canvas artifact at a public pages address and take it down again. - name: Cloud Delegation description: >- Platform browser consent and organisation-bound connections for Ankra Cloud. - name: Organisation IAM description: >- Custom organisation roles and scoped role assignments for member and service-account identities. - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: Ankra Cloud Clusters description: >- Provision and manage self-managed kubeadm / k3s clusters on Ankra Cloud servers: a private network, a NAT router and a bastion per cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Pipelines description: >- Pipeline definitions, the approval of the authority they declare, and the caches pipelines keep between runs. - name: Workspaces description: >- Personal workspaces on the organisation's CI pool where a repository's heavy commands run, and the repository profiles they are built from. - name: Deploy Targets description: >- Environments, the hosts registered to receive deployments, and the releases deployed to them. - name: Deploy Provenance description: >- Whether an application's deploys verify signed provenance from the organisation's own pipeline, the keys that provenance is signed with, and a dry-run that verifies images without deploying. - name: Backups description: >- Backup vaults, restore points, protection posture and captures for stacks and application deployments; a completed capture is not a verified restore. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Management description: >- Customer agent lifecycle, authenticated identity and organisation automation controls. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: AI Memory description: >- What the assistant has learned about you: your cross-session memories and learned profile. - name: MCP Servers description: >- Register the MCP servers the organisation's AI agents can call, choose their tools and grant them to roles. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Decisions description: >- The decision ledger behind the Security and Cost queues: proposals a surface computed, the approve and set-aside decisions people took on them, and the receipts of running them. - name: Usage description: >- What your organisation used of Ankra - vCPU-hours, playgrounds, managed services, hosted logs and metrics, and AI - per meter and period, with how completely it was measured and whether a published rate applies. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account description: >- Your own account: the contact email Ankra mails when it differs from your sign-in address. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Ankra Cloud Credentials description: >- Ankra Cloud API tokens, shared by the self-managed and managed Ankra Cloud lanes. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: HPE Morpheus Credentials description: HPE Morpheus credentials and the capacity and quotas behind them. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Proxmox Credentials description: Proxmox VE credentials and the capacity and quotas behind them. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Avura description: >- The linked Avura organization, the domains it shares with Ankra Platform, and their DNS records. - name: Variables description: Organisation- and cluster-scoped variables. - name: Secret Slots description: >- Store secrets in Vault and reference them by ${SECRET_SLOT:} sentinel instead of by value. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /org/clusters/ankracloud: post: tags: - Ankra Cloud Clusters summary: Create Ankra Cloud cluster (browser session) description: >- Browser session authentication; RBAC permission `clusters. RBAC permission `clusters.create`. Creates a self-managed kubeadm / k3s cluster on Ankra Cloud servers: a private RFC 1918 network (`network_ip_range`, or an adopted `private_network_id`), a bastion and the cluster nodes on the private network only. By default (`network_mode` ipv6_only) the nodes reach IPv4 through the zone's NAT64 and the bastion holds only its public IPv6; `network_mode` ipv4_nat adds a router with NAT for IPv4 egress and gives the bastion a public IPv4. Plans replace instance types (`bastion_plan`, `control_plane_plan`, `worker_plan`, `etcd_plan`; node groups keep `instance_type`), `template` is the OS image (default debian-13). The preflight runs first and the first failing item is the refusal. kubeadm requires Cilium; the ankra-cloud-ccm is always installed. `bastion_port` is accepted for contract symmetry and ignored: the bastion listens on 22. Answers 404 while the organisation's `ankra_cloud_provider` feature flag is off. With no `credential_id`, the organisation's built-in Ankra Cloud credential is used, and the request answers 503 with Retry-After when it cannot be created or renewed right now. operationId: create_ankracloud_cluster_browser parameters: - description: Must match the ankra_csrf browser cookie. in: header name: X-Ankra-CSRF required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateAnkraCloudClusterRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/AnkraCloudCreateClusterResponse' description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Invalid request '401': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Unauthenticated '403': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Permission or CSRF check failed '404': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Resource not found '409': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Conflicting or unsafe lifecycle state '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation failed '500': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Provider or internal failure '503': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: >- Ankra Cloud or the built-in Ankra Cloud credential is temporarily unavailable security: - SessionCookie: [] servers: - url: https://api.platform.ankra.app components: schemas: CreateAnkraCloudClusterRequest: example: bastion_allowed_ips: - 203.0.113.0/24 bastion_plan: c1-2 cni: cilium control_plane_count: 3 control_plane_plan: c2-4 credential_id: 11111111-2222-4333-8444-555555555555 distribution: kubeadm name: ankra-prod network_ip_range: 10.42.0.0/20 ssh_key_credential_id: 99999999-8888-4777-8666-555555555555 template: debian-13 worker_count: 2 worker_plan: c4-8 zone: de-fsn1 properties: bastion_allowed_ips: description: >- IPv4/IPv6 addresses or CIDRs allowed to SSH to the bastion; empty allows any source. items: type: string type: array bastion_disk_gibibytes: description: >- Root disk size of the bastion in GiB. Omit it for the plan's included disk; Ankra Cloud refuses a size below the plan's and the template's minimum. maximum: 4096 minimum: 1 type: integer bastion_disk_tier: description: >- Storage tier of the bastion's root disk. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers. enum: - local-nvme - standard - maxiops - hdd type: string bastion_plan: type: string bastion_port: default: 22 description: >- Accepted for contract symmetry with the managed-gateway providers and ignored: the bastion listens on 22. type: integer cni: default: cilium description: kubeadm supports only cilium on Ankra Cloud. enum: - flannel - calico - cilium type: string cni_features: $ref: '#/components/schemas/AnkraCloudCNIFeatures' control_plane_count: default: 1 maximum: 9 minimum: 1 type: integer control_plane_disk_gibibytes: description: >- Root disk size of each control plane in GiB. Omit it for the plan's included disk. maximum: 4096 minimum: 1 type: integer control_plane_disk_tier: description: >- Storage tier of each control plane's root disk. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers. enum: - local-nvme - standard - maxiops - hdd type: string control_plane_plan: type: string credential_id: type: string format: uuid criticality: anyOf: - type: string - type: 'null' description: anyOf: - type: string - type: 'null' distribution: type: string enum: - k3s - kubeadm default: kubeadm environment: anyOf: - type: string - type: 'null' etcd_disk_gibibytes: description: >- Root disk size of each external etcd node in GiB. Omit it for the plan's included disk. maximum: 4096 minimum: 1 type: integer etcd_disk_tier: description: >- Storage tier of each external etcd node's root disk. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers. enum: - local-nvme - standard - maxiops - hdd type: string etcd_node_count: type: integer default: 3 etcd_plan: default: '' description: Required for an external etcd topology. type: string etcd_topology: type: string enum: - stacked - external default: stacked external_cloud_provider: const: true default: true type: boolean gitops_branch: type: string default: master gitops_provider: type: string enum: - github - bitbucket_cloud default: github description: >- GitOps provider of the repository the cluster is bootstrapped onto. Omitted is github, where gitops_repository is owner/name. bitbucket_cloud names the repository by gitops_workspace and gitops_repo_slug (or gitops_repository as workspace/repo_slug) and binds it as a Bitbucket Cloud repository. gitops_workspace: anyOf: - type: string - type: 'null' description: >- Bitbucket Cloud workspace of the GitOps repository. Only with gitops_provider bitbucket_cloud; provided together with gitops_repo_slug. gitops_repo_slug: anyOf: - type: string - type: 'null' description: >- Bitbucket Cloud repository slug of the GitOps repository. Only with gitops_provider bitbucket_cloud; provided together with gitops_workspace. gitops_credential_name: default: '' type: string gitops_repository: default: '' type: string include_dns: type: boolean default: true include_networking: type: boolean default: true gateway_api: type: boolean default: false description: >- Install the Kubernetes Gateway API beside Traefik's Ingress: the Gateway API standard CRDs, Traefik's Gateway provider with the traefik GatewayClass and a shared traefik-gateway Gateway in the traefik namespace (a plain HTTP listener that accepts routes from every namespace), cert-manager's Gateway support, and external-dns publishing of HTTPRoute hostnames. Ingress keeps working; one Traefik serves both. Requires include_networking. k3s_disabled_components: anyOf: - type: array items: type: string - type: 'null' kubernetes_version: anyOf: - type: string - type: 'null' name: type: string network_ip_range: anyOf: - type: string - type: 'null' description: >- RFC 1918 CIDR (/16 through /29) of the private network Ankra creates; omitted derives one per cluster. network_mode: default: ipv6_only description: >- ipv6_only (default; the zone needs capabilities networking.nat64 and networking.port_forward): no router, the nodes reach IPv4 through the zone's NAT64, and the platform reaches the bastion's IPv6 through an Ankra Cloud port forward from the zone's gateway; the bastion admits SSH from that gateway, the private network and IPv6 bastion_allowed_ips only. ipv4_nat, only when asked for: a NAT router for the nodes' IPv4 egress and a bastion with a public IPv4 (a paid add-on counted against the account's public IPv4 quota) the platform dials. enum: - ipv4_nat - ipv6_only type: string node_groups: items: $ref: '#/components/schemas/AnkraCloudCreateNodeGroupRequest' type: array private_network_id: anyOf: - type: string - type: 'null' description: >- Adopts an existing private network in the zone; mutually exclusive with network_ip_range. An adopted network is never deleted by the cluster. retention_policy: type: string enum: - delete - retain default: retain runtime_credential_id: anyOf: - type: string format: uuid - type: 'null' description: >- Credential the running cluster's cloud-controller-manager and CSI use; omitted reuses credential_id. ssh_key_credential_id: format: uuid type: string description: >- Optional customer SSH key. When omitted, Ankra uses the cluster-specific managed key, stored encrypted server-side. template: default: debian-13 description: Public OS template id (GET /clusters/ankracloud/templates). type: string worker_count: default: 1 maximum: 100 minimum: 0 type: integer worker_disk_gibibytes: description: >- Root disk size of each worker in GiB, and of each node group that names no disk_gibibytes of its own. Omit it for the plan's included disk. maximum: 4096 minimum: 1 type: integer worker_disk_tier: description: >- Storage tier of each worker's root disk, and of each node group that names no disk_tier of its own. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers. enum: - local-nvme - standard - maxiops - hdd type: string worker_plan: default: '' description: >- Required when worker_count is above zero and no node_groups are given. type: string zone: description: >- Ankra Cloud zone (GET /clusters/ankracloud/zones); every server of the cluster is placed there. type: string required: - name - zone - bastion_plan - control_plane_plan type: object AnkraCloudCreateClusterResponse: example: cluster_id: 11111111-2222-4333-8444-555555555555 name: ankra-prod properties: cluster_id: type: string format: uuid name: type: string required: - cluster_id - name type: object ContractDetailError: example: detail: Cluster not found properties: detail: oneOf: - type: string - additionalProperties: true properties: {} type: object required: - detail type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object AnkraCloudCNIFeatures: properties: ebpf_dataplane: type: boolean default: false hubble: type: boolean default: false kube_proxy_replacement: type: boolean default: false wireguard_encryption: type: boolean default: false type: object AnkraCloudCreateNodeGroupRequest: properties: autoscaling: anyOf: - properties: enabled: type: boolean max_count: type: integer min_count: type: integer required: - enabled - min_count - max_count type: object - type: 'null' count: default: 1 maximum: 100 minimum: 0 type: integer cpu_pool: description: >- Ankra Cloud CPU pool of the zone every server of the group is pinned to, scale-ups included, for example a pool of x86-64 level 3 for workloads that need AVX2. Omit it to let the Cloud place each server. Must be one of the zone's pools (GET /api/v1/clusters/ankracloud/{cluster_id}/cpu-pools). pattern: ^[a-z0-9]{1,16}-f[0-9]{1,4}-[0-9a-f]{10}$ type: string disk_gibibytes: description: >- Root disk size of every server of the group in GiB, scale-ups included. Omit it for the plan's included disk; Ankra Cloud refuses a size below the plan's and the template's minimum. maximum: 4096 minimum: 1 type: integer disk_tier: description: >- Storage tier of the root disk of every server of the group, scale-ups included. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers. enum: - local-nvme - standard - maxiops - hdd type: string instance_type: type: string labels: type: object additionalProperties: type: string name: type: string taints: items: $ref: '#/components/schemas/AnkraCloudNodeTaint' type: array required: - name - instance_type type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object AnkraCloudNodeTaint: properties: effect: enum: - NoSchedule - PreferNoSchedule - NoExecute type: string key: type: string value: default: '' type: string required: - key - effect type: object securitySchemes: BearerAuth: bearerFormat: PAT scheme: bearer type: http SessionCookie: description: Browser session. Mutations also require X-Ankra-CSRF. in: cookie name: ankra_session type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.