Remote Execution
Authentication
Protected endpoints require a Bearer token (issued by Keycloak or a
compatible identity provider) passed in the Authorization HTTP header.
Bearer Token Scheme
Authorization: Bearer <your-token>How token validation works
Both Rexec Deploy API and NDP Endpoint API do
not validate tokens directly. Instead, each service is configured with an
AUTH_API_URL pointing to an endpoint on the identity service (Keycloak).
On every protected request the service forwards the token to that endpoint:
GET <AUTH_API_URL>
Authorization: Bearer <your-token>Keycloak validates and decodes the token and returns the user's identity claims:
// AUTH_API_URL response
{
"sub": "a1b2c3d4-...", // user ID
"username": "alice",
"roles": ["user", "admin"],
"groups": ["/ndp_ep/ep-<id>", "researchers"]
}Group-based access control
Each service can be configured with an allowed group
(GROUP_NAMES). When enabled, the service checks whether any of the
groups returned by Keycloak match the configured allowed group. If none match,
the request is rejected with 403 Forbidden.
GROUP_NAMES
environment variable in each service's Helm values.
Rexec Server Deployment API
FastAPI service that provisions and destroys per-user rexec-server pods
in Kubernetes. By default served at your configured Ingress host under path /rexec.
Interactive Swagger UI: https://<your-host>/rexec/docs
NDP Endpoint API
FastAPI service providing authentication integration and Rexec spawn API address
to client libraries. Served at /api by default.
Interactive Swagger UI: https://<your-host>/api/docs
HTTP Error Codes
| Code | Meaning | Common Cause |
|---|---|---|
| 200 | OK | Request succeeded. |
| 400 | Bad Request | Malformed request body or missing required field. |
| 401 | Unauthorized | Missing or expired Bearer token. |
| 403 | Forbidden | Token is valid but the user's groups are not in the ACL allow-list. |
| 404 | Not Found | Resource (e.g., server pod) does not exist. |
| 409 | Conflict | A server pod already exists for this user. |
| 500 | Internal Server Error | Kubernetes API error or misconfiguration. Check pod logs. |
| 503 | Service Unavailable | Auth API or Kubernetes cluster not reachable. |
/docs (Swagger UI) and
/redoc (ReDoc). These are the authoritative API references for
the running version of each service.