canonical: https://jentic.com/apis/cloudamqp.com/cloudamqp

# CloudAMQP Instance API

CloudAMQP Instance API manages a single CloudAMQP-hosted RabbitMQ or LavinMQ instance, including alarms, integrations, plugins, firewall rules, VPC peering, VPC Connect, EventBridge mirrors, webhooks, custom domains, custom certificates, and node-level actions. The API exposes 111 endpoints scoped to one instance - authentication uses HTTP basic with the instance API key as the password and an empty username, which means each instance is administered by its own credential. Sensitive operations such as upgrades, restarts, and rotations are exposed through the actions tree and can be driven from CI or operator scripts without using the CloudAMQP web console.

## For AI agents

Configure alarms, integrations, plugins, firewall, VPC peering, and node-level actions on a CloudAMQP RabbitMQ or LavinMQ instance.

## Scope

Does not handle publishing or consuming messages, account-level billing, or non-CloudAMQP-managed brokers - use for managing one CloudAMQP RabbitMQ or LavinMQ instance only.

## Capabilities

- Configure CPU, memory, queue, and connection alarms with email or third-party integrations
- Enable and configure third-party integrations such as Datadog, Slack, Splunk, and PagerDuty
- Manage RabbitMQ and LavinMQ plugins on the instance
- Set firewall rules and VPC peering or VPC Connect for private network access
- Configure EventBridge or webhook mirrors that ship messages off the broker
- Trigger actions like upgrade, restart, rotate password, and node failover
- Attach a custom domain or custom TLS certificate to the instance

## Use cases

### Production Alarm Coverage

Provision a complete alarm set on a new CloudAMQP instance - CPU, memory, queue length, connection count - and wire each alarm to a paging integration. The /alarms endpoints create and update alarms, and the /integrations endpoints attach Datadog, Slack, PagerDuty, or webhook receivers. This replaces hand-clicking through the CloudAMQP console for every new environment.

Example prompt: Create CPU, memory, and queue-length alarms on the instance and attach them to a Slack integration via /integrations

### Network Isolation for Compliance

Lock a CloudAMQP instance down to a private network by configuring firewall rules, VPC peering, and VPC Connect. The /security endpoint sets the firewall, /vpc-peering manages peer connections, and /vpc-connect manages CloudAMQP's VPC Connect option. This is the standard pattern for healthcare, fintech, and any team that needs the broker off the public internet.

Example prompt: Add a /24 CIDR allowlist via /security and create a VPC peering connection to the customer's AWS VPC

### Scheduled Maintenance Windows

Drive routine RabbitMQ maintenance - upgrade nodes, rotate passwords, restart brokers - from a scheduled script using the /actions and /maintenance endpoints. Each action returns a job reference so the calling system can poll for completion before declaring the window finished. This is the preferred approach for teams that maintain dozens of CloudAMQP instances across environments.

Example prompt: POST against /actions to upgrade the broker version and poll the resulting action ID until status is completed

### Streaming to External Sinks

Mirror messages off the broker into AWS EventBridge or a generic webhook for downstream analytics or audit. /eventbridges configures EventBridge mirrors and /webhooks configures HTTP webhook mirrors, which avoids writing custom consumer services for every downstream system that needs a copy of broker traffic.

Example prompt: Create an EventBridge mirror via /eventbridges that forwards messages from a specific exchange to a customer EventBridge bus

### Agent-Driven Broker Operations via Jentic

AI assistants used by SREs can answer 'silence the queue alarm and restart node 2' by searching Jentic for an intent, loading the matching alarm or action operation, and executing it. The instance API key is held in your Jentic One instance, so the agent never sees raw broker credentials, which matters when the same agent serves multiple environments.

Example prompt: Search Jentic for 'restart cloudamqp node', load the matching /actions operation, and execute it for the named instance

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/nodes` | List broker nodes in the cluster |
| GET | `/alarms` | List alarms on the instance |
| GET | `/integrations` | List configured integrations |
| POST | `/actions` | Trigger a lifecycle action |
| GET | `/security` | Get firewall configuration |
| GET | `/plugins` | List enabled plugins |
| GET | `/vpc-peering` | List VPC peering connections |
| GET | `/webhooks` | List webhook mirrors |

## Key resources

- **alarms** — CPU, memory, queue, and connection alarms on the instance
- **integrations** — Third-party log and metric receivers (Datadog, Slack, PagerDuty, webhook)
- **actions** — Restart, upgrade, rotate, and other lifecycle operations
- **plugins** — RabbitMQ and LavinMQ plugins on the broker
- **security** — Firewall rules for the instance
- **vpc-peering** — VPC peering connections
- **vpc-connect** — CloudAMQP VPC Connect endpoints
- **eventbridges** — EventBridge mirrors
- **webhooks** — HTTP webhook mirrors
- **maintenance** — Maintenance window configuration
- **nodes** — Node-level inspection of the broker cluster

## Why Jentic

- **Setup:** Wiring the CloudAMQP Instance API by hand means setting up HTTP basic auth with the instance key as the password and pointing every call at api.cloudamqp.com/api yourself. Through Jentic you install once, import the CloudAMQP Instance API from the API Directory, store the instance key once, and your agent calls it.
- **Permission scoping:** The CloudAMQP instance API identifies one instance by its key rather than a resource id in the URL path, so scope the agent by the operations it needs, such as listing nodes, reading alarms, or checking security. You choose that set, so state-changing calls like posting an action are only in reach if you include them.
- **Credential handling:** Your CloudAMQP instance key is stored once, encrypted, by your own Jentic One instance and injected as the basic-auth password at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'add a CloudAMQP alarm' or 'list broker nodes', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without browsing docs.cloudamqp.com.

## Related APIs

- **Confluent Cloud** — Hosted Apache Kafka platform with managed clusters and Kafka Connect.
- **Ably** — Pub/sub messaging platform optimised for client-side realtime delivery.
- **Pusher** — Realtime messaging platform for in-app channels and presence.

## FAQ

### What authentication does the CloudAMQP Instance API use?

The API uses HTTP basic auth with the instance API key as the password and an empty username. Each instance has its own key, retrievable from the Customer API or the CloudAMQP console. Through Jentic, the instance key is stored in the vault and injected per call so it never enters the agent's context.

### Can I configure alarms with this API?

Yes. The /alarms endpoints create, list, update, and delete CPU, memory, queue-length, and connection alarms on the instance, and /integrations attaches the receiver (email, Datadog, Slack, PagerDuty, or generic webhook) that fires when the alarm trips.

### What are the rate limits for the CloudAMQP Instance API?

CloudAMQP applies a soft rate limit of around 60 requests per minute per instance API key for the management plane. Operational actions (restart, upgrade) are throttled separately. Back off on 429 responses.

### How do I add a Datadog integration through Jentic?

Run pip install jentic, search for 'add datadog integration to cloudamqp', load the POST /integrations operation, then execute with the integration type and Datadog API key. The integration starts shipping metrics immediately.

### Can I lock the broker down to a private network?

Yes. /security manages the firewall allowlist, /vpc-peering creates VPC peering connections to AWS, GCP, or Azure VPCs, and /vpc-connect manages CloudAMQP's private endpoint option. Combine the three to remove public-internet exposure.

### Does this API trigger broker upgrades and restarts?

Yes. POST /actions triggers lifecycle operations including upgrade, restart, password rotation, and node failover, returning a job reference that callers can poll until the action completes.

### Can I limit what my agent is allowed to do with the CloudAMQP Instance API?

Yes. Because you self-host Jentic One, your own rules decide which of the instance's operations the agent may call, so you can grant read-only access like listing nodes, reading alarms, or checking the /security firewall while withholding everything else. State-changing calls such as POST /actions to restart or upgrade the broker are only in reach if you explicitly include them in the set the agent is given. The instance API key is held and injected by your own Jentic One instance at call time, so the agent never sees the raw credential.