canonical: https://jentic.com/apis/api.cloudcraft.co/cloudcraft

# Cloudcraft API

Jentic publishes the only available OpenAPI specification for Cloudcraft API, keeping it validated and agent-ready. Cloudcraft turns AWS and Azure accounts into live, isometric architecture diagrams. The API lets you connect cloud accounts, snapshot them on demand to render a current-state diagram in PNG, SVG, JSON, or MxGraph, and manage blueprints, budgets, teams, and users that organise those diagrams. Snapshot exports are the most common entry point: you pass a region and format and Cloudcraft returns the rendered architecture ready for embedding in docs, runbooks, or compliance reports.

## For AI agents

Connect AWS and Azure accounts to Cloudcraft, snapshot them as isometric architecture diagrams in PNG/SVG/JSON, and manage blueprints, budgets, teams, and users.

## Scope

Does not handle infrastructure provisioning, drift remediation, or APM metrics - use for connecting AWS/Azure accounts and exporting their architecture as diagrams only.

## Capabilities

- Connect AWS or Azure accounts to Cloudcraft and retrieve the IAM parameters needed for read-only roles
- Snapshot a cloud account on demand and export the architecture diagram as PNG, SVG, JSON, or MxGraph
- Manage saved blueprint diagrams used as templates or reference architectures
- Read and update budget configurations attached to cloud accounts
- Manage Cloudcraft teams and users to control who sees which diagrams

## Use cases

### On-Demand Architecture Diagrams in Docs

Embed a live AWS or Azure architecture diagram in internal documentation by snapshotting Cloudcraft on demand. The agent calls GET `/aws/account/{account_id}/{region}/{format}` or the Azure equivalent and stores the returned PNG or SVG. Re-running the job nightly keeps the diagram in sync with the actual deployed infrastructure rather than a stale handcrafted picture.

Example prompt: Call GET `/aws/account/{account_id}/eu-west-1/png` and upload the response to a Confluence page on a nightly schedule.

### Compliance and Audit Evidence

Auditors regularly ask for an up-to-date architecture diagram. The agent snapshots each connected account on the first of the month using GET `/aws/account/{account_id}/{region}/{format}` with format='svg' and stores the SVG in an evidence locker. The same call can produce a JSON export for diff-friendly storage in git.

Example prompt: Call GET `/aws/account/{account_id}/{region}/svg` for every connected account on day 1 of the month and commit the SVGs to a compliance-evidence repo.

### Multi-Account Cost Visualisation

Pair Cloudcraft snapshots with their attached budgets to create a per-account cost overlay. The agent calls GET `/aws/account`/ to enumerate accounts, GET /budget/ to read the current budget, then snapshots the account in JSON to map costs onto specific resources. Useful for FinOps teams that need a visual cost map per account.

Example prompt: Call GET `/aws/account`/, then for each ID call GET /budget/ and GET `/aws/account/{account_id}/{region}/json`, and merge the cost data into the JSON export.

### Agent-Driven Architecture Lookups via Jentic

Connect Cloudcraft to an AI assistant through Jentic so an engineer can say 'show me the current architecture of the prod AWS account' in chat. The assistant searches Jentic for the right Cloudcraft operation, loads the schema, and calls the snapshot endpoint with the API key kept in your Jentic One instance. The assistant returns a PNG without ever seeing the raw API key.

Example prompt: Use the Jentic Python SDK to search for 'snapshot aws account', load GET `/aws/account/{account_id}/{region}/{format}`, and execute it with format='png' for the prod account.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/aws/account` | List all connected AWS accounts |
| POST | `/aws/account` | Add an AWS account |
| GET | `/aws/account/iamParameters` | Get IAM role parameters for an AWS account |
| GET | `/aws/account/{account_id}/{region}/{format}` | Snapshot an AWS account as PNG/SVG/JSON/MxGraph |
| GET | `/azure/account` | List all connected Azure accounts |
| POST | `/azure/account` | Add an Azure account |
| GET | `/azure/account/{account_id}/{region}/{format}` | Snapshot an Azure account |
| GET | `/blueprint` | List blueprint diagrams |

## Key resources

- **AWS Accounts** — Connect, list, update, delete, and snapshot AWS accounts.
- **Azure Accounts** — Connect, list, update, delete, and snapshot Azure accounts.
- **Blueprints** — Manage reusable diagram blueprints.
- **Budgets** — Read and update budgets attached to cloud accounts.
- **Users and Teams** — Manage Cloudcraft users and team membership.

## Why Jentic

- **Setup:** Wiring the Cloudcraft API by hand means handling its API key auth and mapping the AWS and Azure account, blueprint, and export routes yourself. Through Jentic you install once, import Cloudcraft from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** Cloudcraft puts the account id in the URL path (`/aws/account/{account_id}/{region}/{format}`), so a rule can pin your agent to one connected account: it can export that account's architecture and nothing else. You choose the operations it may call, so connecting new accounts is only included if you add it.
- **Credential handling:** Your Cloudcraft API key is stored once, encrypted, by your own Jentic One instance and injected into the Authorization header at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'snapshot an AWS account' or 'list Cloudcraft blueprints', and Jentic returns the matching Cloudcraft operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Miro** — Online whiteboard and diagramming API for hand-drawn or template-based architecture diagrams.
- **New Relic** — Adds runtime APM and infrastructure metrics to the static topology Cloudcraft renders.
- **Pingdom** — Synthetic uptime checks across the public endpoints visible in the Cloudcraft diagram.

## FAQ

### Why is there no official OpenAPI spec for Cloudcraft API?

Cloudcraft (now part of Datadog) publishes HTML reference docs but does not export a downloadable OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Cloudcraft API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Cloudcraft API use?

The API uses an API key passed in the Authorization header as 'Bearer {api_key}'. You generate the key in the Cloudcraft user settings. Through Jentic, the key is stored encrypted in the vault and only scoped tokens reach the agent's context.

### Can I export an architecture diagram as SVG with the Cloudcraft API?

Yes. Call GET `/aws/account/{account_id}/{region}/svg` or the equivalent `/azure/account` path with format='svg'. Cloudcraft also supports png, json, and mxgraph formats; pick svg or json when you need diff-friendly storage in git or programmatic post-processing.

### What are the rate limits for the Cloudcraft API?

Cloudcraft applies per-account throttling and snapshot endpoints are rate-limited more strictly because they trigger live cloud scans. Schedule snapshots and avoid running multiple per minute against the same account; through Jentic, monitor 429 responses and back off.

### How do I add an AWS account to Cloudcraft through Jentic?

First call GET `/aws/account/iamParameters` to retrieve the IAM role configuration. Create the role in AWS, then call POST `/aws/account` with the role ARN and external ID. Through Jentic, search for 'add aws account', load the operation, and execute. The standard quickstart is pip install jentic, search, load, execute.

### Is the Cloudcraft API free?

Cloudcraft offers a free tier with limited diagrams; full API access including live snapshots requires a paid plan or a Datadog subscription that includes Cloudcraft. There is no per-call API fee on top of the subscription.

### Can I limit what my agent is allowed to do with the Cloudcraft API?

Yes. Because you run Jentic One yourself, your own rules decide which Cloudcraft operations and credentials the agent may use. Since the Cloudcraft API carries the account id in the URL path (`/aws/account/{account_id}/{region}/{format}`), you can pin the agent to a single connected account so it can only export that account's architecture and nothing else. You also choose the operations it may call, so account-changing actions like POST `/aws/account` are reachable only if you explicitly allow them.