Accounts API

The Accounts API allows you to manage accounts in Quave ONE. You can create, retrieve, list, and delete accounts.

Make sure to read the Get Started document to understand how the API works.

Note: account endpoints require a user-delegated credential: either a legacy user token or a Public API OAuth Bearer token. See Get Started for OAuth discovery and scopes.

Create Account

To create a new account, send a POST request to the /api/public/v1/account endpoint. Below are the fields you can provide:

Field	Type	Description	Required
`name`	String	The name of the account to be created.	Yes

For agent automation tests, account names that begin with agent-test create internal test accounts with a 100 zCloud limit, default access to the us-5 region in production, access to all st-* regions in staging, and Agent Sandboxes, Shared Storage and object storage volumes enabled.

Example:

curl -X POST \
    -H 'Authorization: YOUR_TOKEN' \
    -H 'Content-Type: application/json' \
    -d '{
        "name": "My New Account"
    }' \
      https://api.quave.cloud/api/public/v1/account

Example Response:

{
  "accountId": "5f7b1b7b7b7b7b7b7b7b7b7b"
}

The response contains the accountId of the newly created account.

To add container registry credentials to your account, see the Credentials API.

Get Account

To retrieve an account, send a GET request to the /api/public/v1/account endpoint. You need to provide the accountId as a query parameter.

Example:

curl -X GET \
-H 'Authorization: YOUR_TOKEN' \
https://api.quave.cloud/api/public/v1/account?accountId=5f7b1b7b7b7b7b7b7b7b7b7b

Example Response:

{
"accountId": "5f7b1b7b7b7b7b7b7b7b7b7b",
"name": "My Account",
"slug": "my-account",
"isVerified": true,
"allowAutoScaling": true,
"automationAuthenticationPolicy": "LEGACY_AND_OAUTH",
"isCurrent": true
}

The response contains the following fields:

Field	Type	Description
`accountId`	String	The account ID.
`name`	String	The account name.
`slug`	String	The account slug.
`isVerified`	Boolean	Whether the account is verified.
`allowAutoScaling`	Boolean	Whether autoscaling is allowed for this account.
`automationAuthenticationPolicy`	String	`LEGACY_AND_OAUTH` (default) or `OAUTH_ONLY`, the automated API/MCP credential policy for this account.
`isCurrent`	Boolean	Whether this account is currently selected by the user.

List Accounts

To list all accounts that the authenticated user has access to, send a GET request to the /api/public/v1/accounts endpoint.

This endpoint returns all accounts where the user is a member, based on their account memberships.

Example:

curl -X GET \
-H 'Authorization: YOUR_TOKEN' \
https://api.quave.cloud/api/public/v1/accounts

Example Response:

{
  "accounts": [
    {
      "accountId": "5f7b1b7b7b7b7b7b7b7b7b7b",
      "name": "My Account",
      "slug": "my-account",
      "isVerified": true,
      "allowAutoScaling": true,
      "automationAuthenticationPolicy": "LEGACY_AND_OAUTH",
      "isCurrent": true
    },
    {
      "accountId": "5f7b1b7b7b7b7b7b7b7b7b7c",
      "name": "Another Account",
      "slug": "another-account",
      "isVerified": false,
      "allowAutoScaling": false,
      "isCurrent": false
    }
  ]
}

The response contains an array of accounts, where each account has the following fields:

Field	Type	Description
`accountId`	String	The account ID.
`name`	String	The account name.
`slug`	String	The account slug.
`isVerified`	Boolean	Whether the account is verified.
`allowAutoScaling`	Boolean	Whether autoscaling is allowed for this account.
`automationAuthenticationPolicy`	String	`LEGACY_AND_OAUTH` (default) or `OAUTH_ONLY`, the automated API/MCP credential policy for this account.
`isCurrent`	Boolean	Whether this account is currently selected by the user.

Delete Account

To delete an account, send a DELETE request to the /api/public/v1/account endpoint. You need to provide the accountId as a query parameter.

Example:

curl -X DELETE \
    -H 'Authorization: YOUR_TOKEN' \
    https://api.quave.cloud/api/public/v1/account?accountId=5f7b1b7b7b7b7b7b7b7b7b7b

Example Response:

{
  "message": "Account deleted successfully"
}

Note: Deleting an account requires admin permissions. If any app environment in the account has preventDestroy enabled, Quave ONE blocks the account delete because it would also destroy that protected environment.

Get Current Account

To retrieve the current active account for the authenticated user, send a GET request to the /api/public/v1/current-account endpoint.

This endpoint returns the account that is currently set as the user's active account (stored in the lastAccountId field).

Example:

curl -X GET \
-H 'Authorization: YOUR_TOKEN' \
https://api.quave.cloud/api/public/v1/current-account

Example Response:

{
  "accountId": "5f7b1b7b7b7b7b7b7b7b7b7b",
  "name": "My Current Account",
  "slug": "my-current-account",
  "isVerified": true,
  "allowAutoScaling": true,
  "automationAuthenticationPolicy": "LEGACY_AND_OAUTH",
  "isCurrent": true
}

The response contains the following fields:

Field	Type	Description
`accountId`	String	The current account ID.
`name`	String	The current account name.
`slug`	String	The current account slug.
`isVerified`	Boolean	Whether the current account is verified.
`allowAutoScaling`	Boolean	Whether autoscaling is allowed for this account.
`automationAuthenticationPolicy`	String	`LEGACY_AND_OAUTH` (default) or `OAUTH_ONLY`, the automated API/MCP credential policy for this account.
`isCurrent`	Boolean	Always `true` for this endpoint since it returns the current account.

Error Responses:

401 - User not authenticated
403 - Access denied to current account
404 - No current account set or account not found

Set Current Account

To change the user's current active account, send a PUT request to the /api/public/v1/current-account endpoint.

The user must have access to the account they want to set as current. This updates the lastAccountId field for the user.

Example:

curl -X PUT \
-H 'Authorization: YOUR_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
  "accountId": "5f7b1b7b7b7b7b7b7b7b7b7b"
}' \
https://api.quave.cloud/api/public/v1/current-account

Request Body:

Field	Type	Description	Required
`accountId`	String	The ID of the account to set as current.	Yes

Example Response:

{
  "accountId": "5f7b1b7b7b7b7b7b7b7b7b7b",
  "name": "My New Current Account",
  "slug": "my-new-current-account",
  "isVerified": true,
  "allowAutoScaling": true,
  "automationAuthenticationPolicy": "LEGACY_AND_OAUTH",
  "isCurrent": true,
  "message": "Current account updated successfully"
}

The response contains the following fields:

Field	Type	Description
`accountId`	String	The new current account ID.
`name`	String	The new current account name.
`slug`	String	The new current account slug.
`isVerified`	Boolean	Whether the new current account is verified.
`allowAutoScaling`	Boolean	Whether autoscaling is allowed for this account.
`automationAuthenticationPolicy`	String	`LEGACY_AND_OAUTH` (default) or `OAUTH_ONLY`, the automated API/MCP credential policy for this account.
`isCurrent`	Boolean	Always `true` for this endpoint since it returns the newly set current account.
`message`	String	Success confirmation message.

Error Responses:

400 - Invalid request body (validation error)
401 - User not authenticated
403 - Account not found or access denied
404 - Account not found

Set Automated Authentication Policy

An account administrator can choose whether the account accepts its existing legacy API/MCP credentials as well as OAuth, or requires OAuth for automated access. This policy applies only to resources in the target account: it does not delete any token or MCP key, does not change dashboard access, and can be reversed in the dashboard Settings page. Enabling OAUTH_ONLY requires the acting user to have TOTP two-factor authentication enabled.

When OAUTH_ONLY is active, migrate unattended work to the Public API OAuth Bearer flow before using the account. Legacy CLI endpoints remain legacy-token endpoints and are deliberately rejected alongside legacy API/MCP credentials.

curl -X PATCH \
  -H 'Authorization: Bearer YOUR_PUBLIC_API_OAUTH_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "accountId": "5f7b1b7b7b7b7b7b7b7b7b7b",
    "automationAuthenticationPolicy": "OAUTH_ONLY"
  }' \
  https://api.quave.cloud/api/public/v1/account/automation-authentication-policy

Request Body:

Field	Type	Description	Required
`accountId`	String	The account to update.	Yes
`automationAuthenticationPolicy`	String	`LEGACY_AND_OAUTH` or `OAUTH_ONLY`.	Yes

This endpoint requires account-admin permission and the quave:admin OAuth scope when called with OAuth. A legacy credential cannot disable an active OAuth-only policy; use the dashboard or an OAuth connection instead.

Get Account Security Posture

To review the security posture of an account and of the environments you consider production or critical, send a GET request to /api/public/v1/account/security-posture. The review is read-only and deterministic: Quave ONE owns the check catalog, decides where each check applies, and never returns secrets. Production is never inferred from environment names; only the environments you pass are evaluated.

Example:

curl -X GET \
-H 'Authorization: YOUR_TOKEN' \
'https://api.quave.cloud/api/public/v1/account/security-posture?accountId=5f7b1b7b7b7b7b7b7b7b7b7b&appEnvIds=ENV_ID_1,ENV_ID_2'

Query Parameters:

Parameter	Type	Description	Required
`accountId`	String	The account to review.	Yes
`appEnvIds`	String	Comma-separated IDs (1-50) of the environments you consider production or critical.	Yes

Account checks are account-wide: two-factor requirement and member coverage, pending invitations, per-environment member access, and OAuth-only automated API/MCP access. Environment checks cover only the selected environments you can see: Prevent destroy, public TLS, blocking traffic from other accounts (app-level), network restriction for data services, WAF and rate limit for public HTTP services, non-root runtime user, HTTP probes (resilience), alert coverage, scheduled backup configuration, and database TLS.

Example Response (truncated):

{
  "catalogVersion": 1,
  "evaluatedAt": "2026-10-17T12:00:00.000Z",
  "account": { "accountId": "5f7b1b7b7b7b7b7b7b7b7b7b", "name": "Acme" },
  "scope": {
    "requestedAppEnvCount": 2,
    "visibleAppEnvCount": 1,
    "evaluatedAppEnvCount": 1,
    "notVisibleAppEnvIds": ["ENV_ID_2"],
    "accountChecksAreAccountWide": true
  },
  "partialVisibility": true,
  "unavailableChecks": [],
  "notEvaluatedChecks": [
    { "checkId": "app-env.backup-freshness", "reason": "..." }
  ],
  "summary": {
    "byStatus": { "critical": 1, "recommended": 4, "unknown": 1, "compliant": 6, "notApplicable": 5 },
    "affectedResources": { "critical": 1, "recommended": 3 }
  },
  "findings": [
    {
      "fingerprint": "app-env.prevent-destroy:ENV_ID_1:5994f8158f09",
      "checkId": "app-env.prevent-destroy",
      "title": "Critical environment is protected from deletion",
      "resource": { "type": "appEnv", "id": "ENV_ID_1", "name": "shop/live", "appId": "APP_ID", "workloadKind": "webService", "isBranchPreview": false },
      "applicability": "applicable",
      "status": "critical",
      "evidence": { "preventDestroy": false },
      "whyItMatters": "Without Prevent destroy, one mistaken or automated delete removes the environment and its data.",
      "dashboardDestination": "Environment → Settings → Prevent destroy",
      "compatibility": "Deleting the environment, its app, or the account requires turning protection off first.",
      "remediationKind": "manualSetting",
      "configurationFingerprint": "5994f8158f09"
    }
  ]
}

The response contains the following fields:

Field	Type	Description
`catalogVersion`	Number	Version of the check catalog. Check IDs are stable; new checks bump the version.
`scope.notVisibleAppEnvIds`	String[]	Requested IDs that are not in the account, were removed, or are outside your per-environment access. No data about them is returned.
`partialVisibility`	Boolean	`true` when some environments were not visible or some checks were unavailable. Never read a partial result as full compliance.
`unavailableChecks`	Object[]	Checks you lack permission for (member checks need the Manage members role). They are reported with status `unknown`.
`notEvaluatedChecks`	Object[]	Catalog rows this version does not evaluate yet (for example backup freshness and certificate state).
`findings[].status`	String	`critical`, `recommended`, `unknown`, `compliant`, or `notApplicable`.
`findings[].fingerprint`	String	`<checkId>:<resourceId>:<configurationFingerprint>`; it changes when the evaluated status or evidence changes.

The endpoint requires account read access and the quave:read scope. Per-environment member access applies to every source.

Error Responses:

400 - Missing accountId, missing appEnvIds, or more than 50 environments
401 - User not authenticated
403 - No access to the account

Set Account MFA Requirement

To enable or disable the account-wide two-factor authentication (MFA) requirement, send a PATCH request to the /api/public/v1/account/require-mfa endpoint. Requires admin permission on the account.

When enabled, every member must have TOTP two-factor authentication enabled on their Quave ONE user before accessing the account, regardless of how they log in (SSO logins do not count as coverage). Members without it keep their login but are prompted to set up MFA before reaching account content — nobody is logged out. To enable the requirement, the authenticated user must already have TOTP enabled themselves.

Example:

curl -X PATCH \
-H 'Authorization: YOUR_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
  "accountId": "5f7b1b7b7b7b7b7b7b7b7b7b",
  "requireMfa": true
}' \
https://api.quave.cloud/api/public/v1/account/require-mfa

Request Body:

Field	Type	Description	Required
`accountId`	String	The ID of the account to update.	Yes
`requireMfa`	Boolean	`true` to require two-factor authentication for all members, `false` to stop requiring it.	Yes

Example Response:

{
  "success": true,
  "accountId": "5f7b1b7b7b7b7b7b7b7b7b7b",
  "requireMfa": true,
  "members": 8,
  "coveredMembers": 3,
  "message": "Two-factor authentication is now required for this account."
}

The response contains the following fields:

Field	Type	Description
`success`	Boolean	Always `true` on success.
`accountId`	String	The account ID that was updated.
`requireMfa`	Boolean	The resulting requirement state.
`members`	Number	Total members in the account at the time of the change.
`coveredMembers`	Number	Members with TOTP enabled at the time of the change.
`message`	String	Success confirmation message.

Error Responses:

400 - Missing accountId or requireMfa, or (when enabling) the authenticated user does not have MFA enabled themselves
401 - User not authenticated
403 - Admin permission required
404 - Account not found

Disaster Readiness cleanup on deletion

Deleting an owner with Disaster Readiness also retires its owned recovery VM, boot disk and allocated public IP resources. Deletion remains pending until the provider confirms cleanup; retry the same delete if it reports pending. Cleanup continues asynchronously and its ownership journal is preserved. The regional pool and other targets are unchanged. Recovery data disks are retained separately, so compute cleanup does not mean all storage charges have stopped. Deleting only the original source preserves an independently recovered Live environment; deleting that recovered environment itself or its account retires its VM.

Create Account​

Get Account​

List Accounts​

Delete Account​

Get Current Account​

Set Current Account​

Set Automated Authentication Policy​

Get Account Security Posture​

Set Account MFA Requirement​

Disaster Readiness cleanup on deletion​

Create Account

Get Account

List Accounts

Delete Account

Get Current Account

Set Current Account

Set Automated Authentication Policy

Get Account Security Posture

Set Account MFA Requirement

Disaster Readiness cleanup on deletion