> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Confirm a managed-service retirement by its digest (browser session) > Requires the applications rollout flag, applications.deploy, and on the service cluster clusters.operate, stacks.delete and clusters.read, plus clusters.read on every consumer cluster, all intersected with live token scopes. Accepts only the stored retirement and the digest its actor reviewed, resolves the plan again under the instance lock and enqueues one execution that removes the stack, waits for its members to be removed from the cluster, deletes the service's namespace once nothing else deploys into it, and releases the name only after the namespace is observed gone. Concurrent confirmations yield one execution; a retry returns the same receipt. The receipt is not proof of removal: follow the retirement's outcome. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json post /org/service-admission/instances/{instance_id}/retirements/{retirement_id}/confirm openapi: 3.1.0 info: title: Ankra Platform API version: v1 description: >- The Ankra platform HTTP contract. The /api/v1 surface is the public, bearer-authenticated API used by the Ankra CLI, MCP clients and automation; send a personal or service API token as `Authorization: Bearer `. Browser routes under /org and /chat are served on api.platform.ankra.app (each declares that server); they and /oauth/access authenticate with the ankra_session cookie, and mutations also require the X-Ankra-CSRF header. Every operation declares the credential it accepts, and no operation is served without one. This document is published deliberately: it describes the contract only and carries no organisation data or credentials. Report security issues to security@ankra.ai (see /.well-known/security.txt). servers: - url: https://platform.ankra.app security: - BearerAuth: [] tags: - name: Onboarding description: >- Generate a first website from a prompt and deploy it to a new organisation's cluster. - name: Access Gate description: >- Private service sign-in and membership checks for trusted Ankra proxy relays. - name: Canvas Datasets description: >- Read the fixed, named datasets canvas dashboards bind their charts, tables and stats to. - name: Canvases description: >- Keep dashboards and pages in the organisation's canvas library, with revision history, undo and pins. - name: Canvas Pages description: >- Publish a chat canvas artifact at a public pages address and take it down again. - name: Cloud Delegation description: >- Platform browser consent and organisation-bound connections for Ankra Cloud. - name: Organisation IAM description: >- Custom organisation roles and scoped role assignments for member and service-account identities. - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: Ankra Cloud Clusters description: >- Provision and manage self-managed kubeadm / k3s clusters on Ankra Cloud servers: a private network, a NAT router and a bastion per cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Pipelines description: >- Pipeline definitions, the approval of the authority they declare, and the caches pipelines keep between runs. - name: Workspaces description: >- Personal workspaces on the organisation's CI pool where a repository's heavy commands run, and the repository profiles they are built from. - name: Deploy Targets description: >- Environments, the hosts registered to receive deployments, and the releases deployed to them. - name: Deploy Provenance description: >- Whether an application's deploys verify signed provenance from the organisation's own pipeline, the keys that provenance is signed with, and a dry-run that verifies images without deploying. - name: Backups description: >- Backup vaults, restore points, protection posture and captures for stacks and application deployments; a completed capture is not a verified restore. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Management description: >- Customer agent lifecycle, authenticated identity and organisation automation controls. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: AI Memory description: >- What the assistant has learned about you: your cross-session memories and learned profile. - name: MCP Servers description: >- Register the MCP servers the organisation's AI agents can call, choose their tools and grant them to roles. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Decisions description: >- The decision ledger behind the Security and Cost queues: proposals a surface computed, the approve and set-aside decisions people took on them, and the receipts of running them. - name: Usage description: >- What your organisation used of Ankra - vCPU-hours, playgrounds, managed services, hosted logs and metrics, and AI - per meter and period, with how completely it was measured and whether a published rate applies. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account description: >- Your own account: the contact email Ankra mails when it differs from your sign-in address. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Ankra Cloud Credentials description: >- Ankra Cloud API tokens, shared by the self-managed and managed Ankra Cloud lanes. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: HPE Morpheus Credentials description: HPE Morpheus credentials and the capacity and quotas behind them. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Proxmox Credentials description: Proxmox VE credentials and the capacity and quotas behind them. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Avura description: >- The linked Avura organization, the domains it shares with Ankra Platform, and their DNS records. - name: Variables description: Organisation- and cluster-scoped variables. - name: Secret Slots description: >- Store secrets in Vault and reference them by ${SECRET_SLOT:} sentinel instead of by value. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /org/service-admission/instances/{instance_id}/retirements/{retirement_id}/confirm: post: tags: - Services summary: Confirm a managed-service retirement by its digest (browser session) description: >- Requires the applications rollout flag, applications.deploy, and on the service cluster clusters.operate, stacks.delete and clusters.read, plus clusters.read on every consumer cluster, all intersected with live token scopes. Accepts only the stored retirement and the digest its actor reviewed, resolves the plan again under the instance lock and enqueues one execution that removes the stack, waits for its members to be removed from the cluster, deletes the service's namespace once nothing else deploys into it, and releases the name only after the namespace is observed gone. Concurrent confirmations yield one execution; a retry returns the same receipt. The receipt is not proof of removal: follow the retirement's outcome. operationId: confirmServiceRetirementSession parameters: - name: instance_id in: path required: true schema: type: string format: uuid - name: retirement_id in: path required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ServiceReviewConfirmRequest' responses: '200': description: The retirement with its execution receipt. content: application/json: schema: $ref: '#/components/schemas/ServiceRetirement' '307': description: Redirect to login '401': description: Authentication required '403': description: Insufficient permission or missing browser CSRF '404': description: Not accessible, absent, or rollout disabled '409': description: >- The retirement was refused: the service is installing, already retiring or retired, changed generation, its stack or consumers changed, the digest is stale, or the review expired '422': description: Invalid or ambiguous request, or the data loss was not acknowledged '500': description: Internal error '503': description: Rollout availability could not be verified security: - SessionCookie: [] servers: - url: https://api.platform.ankra.app components: schemas: ServiceReviewConfirmRequest: type: object additionalProperties: false required: - digest properties: digest: type: string pattern: ^sha256:[a-f0-9]{64}$ ServiceRetirement: type: object additionalProperties: false required: - id - instance_id - plan - digest - state - created_at - expires_at - execution_id - confirmed_at - phase - settled_at - outcome - reason - volume_disposal - data_disposal - kept_data properties: id: type: string format: uuid instance_id: type: string format: uuid plan: $ref: '#/components/schemas/ServiceRetirementPlan' digest: type: string pattern: ^sha256:[a-f0-9]{64}$ state: type: string enum: - pending - expired - in_progress - settled description: >- pending and expired describe an unconfirmed review's window; in_progress and settled a confirmed retirement. created_at: type: string format: date-time expires_at: type: string format: date-time execution_id: type: string format: uuid nullable: true description: >- The confirmation's receipt: the execution carrying out the retirement. confirmed_at: type: string format: date-time nullable: true phase: type: string enum: - retire_stack - await_teardown - dispose_data nullable: true settled_at: type: string format: date-time nullable: true outcome: type: string enum: - retired - removal_failed - disposal_unknown - refused - interrupted nullable: true description: >- Only retired releases the service's name; every other outcome keeps it reserved and reason says why. Whether a retired service's data may remain is data_disposal, beside it. reason: type: string nullable: true description: >- Why the retirement ended other than retired. A retired outcome carries one only when a reviewed volume still holds the service's data or could not be confirmed gone. volume_disposal: type: object nullable: true additionalProperties: false description: >- What the retirement lane observed of the reviewed volumes once the namespace was gone: deleting a claim releases its volume, and the volume's reclaim policy decides its data. Each reviewed volume is read live; retained_volumes names exactly the persistent volumes that still hold the service's data, which Ankra does not delete (deleting a retained PersistentVolume would leave its disk behind). Null until the retirement settles retired, and for one that deleted no namespace or was reviewed before the namespace contents were read. required: - observed_at - volumes - retained_volumes - complete properties: observed_at: type: string format: date-time volumes: type: array items: type: object additionalProperties: false required: - claim_name - volume_name - state - reclaim_policy - phase properties: claim_name: type: string volume_name: type: string nullable: true state: type: string enum: - deleted - retained - reassigned - unbound - unknown description: >- deleted: a live read answered that the volume is gone. retained: it is still on the cluster for the reviewed claim (or for none), so it still holds the data. reassigned: a volume of that name now names another claim. unbound: the claim had no volume at review. unknown: the volume could not be read; never read as deleted. reclaim_policy: type: string nullable: true description: >- As the live read reported it, or as reviewed when the volume was not read. phase: type: string nullable: true retained_volumes: type: array items: type: string description: >- The persistent volumes in state retained: they still hold the service's data on the storage backend until someone removes them. complete: type: boolean description: >- The review listed every claim in the namespace and every reviewed volume was observed. False means a volume not named here may still hold data. data_disposal: type: string enum: - complete - data_kept - unconfirmed nullable: true description: >- What became of the service's data once the retirement settled retired. complete only when Ankra can show the data is gone: nothing was ever deployed, or every claim of the deleted namespace was listed and every volume behind them was read gone. data_kept: a persistent volume was observed still holding the data after the namespace was gone. unconfirmed: every uncertain case - a volume could not be read or named another claim, a Retain volume's object was gone (its disk may remain), a claim had no volume when reviewed, the review was incomplete, the volumes were never read or their record is damaged, the service had no namespace of its own, or its cluster was recorded deleted in Ankra (which does not show its storage was destroyed). Null for every other outcome and until the retirement settles. data_kept and unconfirmed carry kept_data. kept_data: allOf: - $ref: '#/components/schemas/ServiceRetirementKeptData' nullable: true description: >- What a retirement that released the name left of the service's data, or could not rule out, with the next step. Null unless data_disposal is data_kept or unconfirmed. ServiceRetirementPlan: type: object additionalProperties: false description: >- The server-resolved statement of what the retirement removes and keeps. The digest covers all of it; nothing in it is supplied by the client. required: - schema_version - instance_id - organisation_id - actor_id - name - cluster_id - generation - namespace - stack - nothing_deployed - owned_draft_id - consumers_to_disconnect - shared_kept - data - expires_at properties: schema_version: type: integer enum: - 1 instance_id: type: string format: uuid organisation_id: type: string format: uuid actor_id: type: string format: uuid name: type: string cluster_id: type: string format: uuid generation: type: integer format: int64 minimum: 1 namespace: type: string nullable: true description: >- The service's own namespace, deleted once the stack is gone. Null when the service owns none (its profile is not a first-party engine) or nothing was deployed; then no namespace is deleted. namespace_contents: type: object additionalProperties: false description: >- What the platform's synced resource index held in the namespace when the plan was resolved: the objects the service's own releases did not create, which the namespace deletion removes too, and every volume claim with the reclaim policy of its volume. The digest covers it, so an object or volume that appears or changes between review and confirmation is a changed retirement (409). Absent when no namespace is deleted, and on a plan reviewed before the contents were read. The index is an observation with an age: complete false means the lists may be short, never that nothing else exists, and kinds the platform does not index (most custom resources) are deleted without being listed. required: - observed_at - complete - incomplete_reason - items - volumes properties: observed_at: type: string format: date-time nullable: true description: >- The oldest latest-sync time among the namespaced resource types the answer rests on: the index was at least this current. Null when the cluster's index was never synced. A confirmation keeps the reviewed value. complete: type: boolean description: >- Every namespaced kind the platform indexes on every cluster was synced within the last 15 minutes and no list was cut, so items is everything of those kinds the service did not create. False is unknown: incomplete_reason says why. incomplete_reason: type: string nullable: true description: >- Why the lists may be short: a resource type not synced recently, a list cut at its cap, or an index never synced. Null when complete. items: type: array nullable: true description: >- Objects in the namespace the service's own releases did not create, by resource type and name; at most 100. Objects a controller created for a listed object are not listed separately. Null when the cluster's index was never synced, so nothing can be said. items: type: object additionalProperties: false required: - resource_type - kind - name - created_at - owner properties: resource_type: type: string description: >- The plural resource type, as indexed (for example deployments). kind: type: string nullable: true description: >- The kind, when the platform's vocabulary knows the resource type; null for a custom resource it does not. name: type: string created_at: type: string format: date-time nullable: true owner: type: object nullable: true additionalProperties: false description: >- The controller that created the object, when that owner is a kind the index does not hold. required: - kind - name properties: kind: type: string name: type: string volumes: type: array nullable: true description: >- Every volume claim in the namespace, the service's own and others, by claim name; at most 50. Null when the claims were never synced. items: type: object additionalProperties: false required: - claim_name - claim_uid - created_by_service - storage_class - volume_name - reclaim_policy properties: claim_name: type: string claim_uid: type: string nullable: true created_by_service: type: boolean description: The service's own releases created the claim. storage_class: type: string nullable: true volume_name: type: string nullable: true description: >- The persistent volume bound to the claim; null while it is not bound. reclaim_policy: type: string nullable: true description: >- The bound volume's reclaim policy as indexed: Delete erases the volume and its data once the claim is deleted, Retain keeps the released volume and its data on the storage backend, which the settled retirement then reports in volume_disposal. Null when unknown: the volume is not indexed, or it names another claim. stack: type: object nullable: true additionalProperties: false description: >- The stack Services installed, found by its resource id, with the members the retirement removes. Null when nothing was deployed. required: - resource_id - name - state - members - member_digest properties: resource_id: type: string format: uuid name: type: string state: type: string enum: - deployed - removal_in_progress - removed_outside_services members: type: array items: type: object additionalProperties: false required: - id - kind - name - namespace properties: id: type: string format: uuid kind: type: string enum: - addon - manifest - application - stack_description name: type: string namespace: type: string nullable: true description: >- Where the member deploys, rendered with the stack's variables; null when that is not knowable from its definition. member_digest: type: string description: >- Pins the member set; the retirement lane refuses a stack whose members differ. cluster_deleted: type: boolean description: >- The platform recorded the service cluster deleted, so the stack, namespace and data went with it: the retirement removes nothing and only releases the name. Omitted when false. nothing_deployed: type: boolean description: >- The installation never submitted a deployment: the retirement releases the name and deletes nothing on the cluster beyond the installation's own unfinished draft. owned_draft_id: type: string format: uuid nullable: true consumers_to_disconnect: type: array items: type: object additionalProperties: false required: - id - application_id - cluster_id - namespace properties: id: type: string format: uuid application_id: type: string format: uuid cluster_id: type: string format: uuid namespace: type: string description: >- The service's consumers. Credentials were never delivered into their namespaces, so nothing is removed there. shared_kept: type: array items: type: object additionalProperties: false required: - stack_name - title properties: stack_name: type: string title: type: string description: >- Shared, cluster-wide stacks the service needed (for example the CloudNativePG operator). A retirement never removes them. data: type: object additionalProperties: false description: >- What happens to the service's data, as a statement of what the retirement does. required: - namespace_deleted - volumes_deleted - secrets_deleted - export_offered - restore_points - statement properties: namespace_deleted: type: boolean volumes_deleted: type: boolean secrets_deleted: type: boolean export_offered: type: boolean description: 'Always false: no export runs before deletion.' restore_points: type: string enum: - kept_per_vault_retention statement: type: string expires_at: type: string format: date-time ServiceRetirementKeptData: type: object additionalProperties: false description: >- The service's data a retirement that released the name left behind or could not confirm gone: which persistent volumes, on which cluster, and the Ankra CLI commands to inspect and erase them. Deleting the namespace released the volumes; their reclaim policy decides the data, and Ankra does not delete a retained volume itself. required: - cluster_id - namespace - observed_at - retained_volumes - unconfirmed_volumes - unbound_claims - complete - next_step - commands properties: cluster_id: type: string format: uuid nullable: true description: >- The service's cluster. Null when its record could not be read; then commands is empty. namespace: type: string nullable: true description: >- The deleted namespace the volumes' claims lived in; null when the service had no namespace of its own. observed_at: type: string format: date-time nullable: true description: >- When Ankra last read the volumes, once, after the namespace was gone. Never re-checked: a volume named here may have been removed since. Null when the volumes were never read. retained_volumes: type: array items: type: string description: >- Persistent volumes observed still holding the service's data when Ankra last looked (observed_at). unconfirmed_volumes: type: array items: type: string description: >- Reviewed volumes Ankra cannot confirm are gone: it could not read them, or they named another claim by the time it looked. Offered for inspection only, never for erasing. unbound_claims: type: array items: type: string description: >- Volume claims that had no volume when the retirement was reviewed; one may have bound a volume before the namespace was deleted, which nobody read. complete: type: boolean description: >- Every volume claim in the namespace was listed at review and every volume behind them was read. False means a volume not named here may still hold the data. next_step: type: string description: What to do, in words. commands: type: array items: type: object additionalProperties: false required: - purpose - volume - command properties: purpose: type: string enum: - inspect - erase - find description: >- inspect shows one volume; erase is a JSON patch that first tests the volume still names the service's claim (namespace, and the reviewed claim's name and uid when known) and then sets its reclaim policy to Delete, so its provisioner deletes the volume and the disk behind it, which cannot be undone; it is offered only for a volume observed retained for the service's claims; find lists the cluster's persistent volumes to find one Ankra could not name. volume: type: string nullable: true command: type: string description: The Ankra CLI command. securitySchemes: BearerAuth: bearerFormat: PAT scheme: bearer type: http SessionCookie: description: Browser session. Mutations also require X-Ankra-CSRF. in: cookie name: ankra_session type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.