Manage Deployments with the Atlas Administration API¶

Atlas Administration API Features¶

The Atlas Administration API follows the principles of the REST architectural style to expose a number of internal resources which enable programmatic access to Atlas's features.

As with changes made through the Atlas web interface, changes made through the API are subject to Atlas billing. If you incur charges, you must have a valid credit card on file with Atlas or risk having your account locked.

The API has the following features:

JSON entities

All entities are expressed in JSON.

Key-based access

Each Atlas user or application needing to connect to Atlas must generate an API key before accessing the Atlas Administration API.

Digest authentication

To ensure that your API key is never sent over the network, API requests are authenticated using HTTP Digest Authentication.

Browsable interface

Using a consistent linking mechanism, you can browse the entire API by starting at the root resource and following links to related resources.

HTTPS-Only

You can only access the API via HTTPS, ensuring all data sent over the network is fully encrypted using TLS.

User Access Control

Each Atlas user's API capabilities match the permissions granted by their Atlas Atlas User Roles.

Example

A user with the Project Read Only in a Atlas project can't modify any resource within that project whether through the Atlas user interface or the API.

API Network Access List

The Atlas secures access to its API through an access list. This list restricts access to the API to specific IP or CIDR addresses. Each Programmatic API Key has its own API access list. Each API Key must make any API requests from an IP address on the API access list.

Tip

See also:

HTTP Methods¶

All resources support a subset of these common HTTP Methods:

JSON¶

All entities are represented in JSON. The following rules and conventions apply:

• Content Type Request Header

  When sending JSON to the server via POST or PUT, make sure to specify the correct content type request header: Content-Type: application/json

• Invalid Fields

  Invalid fields are rejected rather than ignored. For example, if you attempt to create a new entity and misspell one of the fields, or attempt to update an existing entity and include a field that can't be modified, the server responds with a 400 status code and an error message stating which field is invalid.

• ISO-8601-Formatted Dates

  All dates are returned as ISO-8601-formatted strings designated in UTC. When sending dates to the server (i.e., as query parameters or fields in POST or PATCH request entities), use ISO-8601-formatted dates. If you do not specify a time zone, UTC is assumed. However, it is highly recommended that you include a time zone designator to avoid any ambiguity.

• BSON Timestamps

  In some cases, a timestamp is returned as a BSON timestamp, most notably in the backup resources. These are represented in JSON documents as an object with two fields: date, which is an ISO-8601-formatted date string in UTC with granularity to the second, and increment a 32-bit integer.

• Field Names for Fields with Numbers

  Fields that contain numeric values in a particular unit will be named so as to disambiguate the unit being used.

• Empty Fields

  Fields that do not have a current value are returned with an appropriate default value.

  Fields that do not have a sensible default value are omitted from the entity.

• Field Order

  The fields in the JSON documents returned by the server are in no particular order, and the order may change. Do not depend on the order of the fields.

Linking¶

Each resource includes one or more links to sub-resources and/or related resources. Links are placed in the links field of an entity, which is an array of link relation objects. Each link relation has two fields:

All entities include at least one link relation called self, which is simply its own URL. When an entity is part of a list, then it only includes the self link relation.

For more information, refer to the Web Linking Specification. Note that although the specification describes a format for including links in the HTTP response headers, doing so is not a requirement. To make the API easily browsable, it includes the links in the response body rather than in the response headers.

Lists¶

Some resources return a list of entities. When a list of entities is expected in a response, the results are returned in batches bounded by the following query parameters:

The response entity contains three fields:

If you make a request for a list of entities and there are no results, then the API responds with a 200 status code and the results array is empty. It does not respond with a 404 in this case, since the list of entities may not be empty at some point in the future. However, if you request a list of entities in a context that does not exist (e.g., the list of hosts for a non-existent project), then this does result in a 404 response status.

Envelopes¶

Some clients might not be able to access the HTTP response headers and/or status code. In that case, you can request that the response include an "envelope," which is simply an extra layer of information in the JSON document and contains any relevant details that would normally be in the response headers. By default, the API does not include the response in an envelope. To request one, simply add the query parameter envelope=true.

For responses that contain a single entity, the envelope contains two fields:

For responses that contain a list of entities, there is already an envelope that wraps the results, so specifying envelope=true only adds the status field to the existing envelope.

Pretty Printing¶

By default, extraneous whitespace is stripped from the JSON returned by the server. To ask for pretty-printed JSON, simply append the pretty=true query parameter to any request:

curl --user '{USERNAME}:{APIKEY}' --digest \
  --header 'Accept: application/json' \
  --include \
  --request GET "https://cloud.mongodb.com/api/atlas/v1.0?pretty=true"

Response Codes¶

Responses use the standard HTTP response codes, including:

Errors¶

When a request returns an error, the response body contains a JSON document. This document includes details about why the API request failed. The document contains five parameters:

1
{
2
  "detail" : "Cannot find resource /api/atlas/v1.0/softwareComponents/version.",
3
  "error" : 404,
4
  "errorCode" : "RESOURCE_NOT_FOUND",
5
  "parameters" : [ "/api/atlas/v1.0/softwareComponents/version" ],
6
  "reason" : "Not Found"
7
}

Project ID¶

Your Project ID is a string value that uniquely identifies a Atlas project.

Atlas projects were previously identified as "groups". Some Atlas endpoints reference group or {GROUP-ID} as part of the request path, query, or body parameters. For any endpoint that requires your {GROUP-ID}, specify your Project ID instead.

To retrieve your project ID:

Authentication¶

As previously mentioned, the Atlas Administration API uses HTTP Digest Authentication. The details of digest authentication are beyond the scope of this document. Digest authentication requires a username and a password. The Atlas hashes these values using a unique value called a nonce. The API public key serves as the username. Its corresponding API private key serves as the password.

Keep the following points in mind:

• The Atlas-generated nonce is used by the client to hash the username and password before sending them back to the Atlas to authenticate a request. The nonce is only valid for a short amount of time as per the digest authentication specification. This is to prevent replay attacks, so you can't cache a nonce and use it forever.
• Using digest authentication with HTTPS adds an extra layer of security. The API request never sends the password to the Atlas.
• Some resource require additional security. These resources deny access to any request not made from an IP address on an API access list. Each organization may have one or more API keys, each with their own API access list. An API key can access an API resource only from an IP address on its API access list.
• Atlas roles limit which operations an API key can perform. The API resources enforce the same privileges. The resources and methods that an API key use the same roles as an Atlas user.
• Atlas binds many resources to a project. Many API resource URLs follow the format of /api/atlas/v1.0/groups/<GROUP-ID>/. For these resources, the API key must be a member of the organization that hosts the project. Otherwise, the Atlas responds with a 401 error.

Rate Limiting¶

Certain resources limit how many requests they can process per minute.

For these resources, Atlas allows up to 100 requests per minute per project. API keys belong to an organization, but can be granted access multiple projects.

If you exceed the rate limit, the API returns a 429 (Too Many Requests) HTTP status code.