# LXD REST API

**Canonical:** https://apis.io/apis/canonical/lxd-rest-api/  
**Provider:** Canonical — https://apis.io/providers/canonical/  
**Base URL:** https://<lxd-host>:8443  
**Documentation:** https://documentation.ubuntu.com/lxd/latest/rest-api/

LXD REST API is one of 22 APIs that [Canonical](https://apis.io/providers/canonical/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Containers, Virtualization, and Infrastructure. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

The REST API used by every LXD client. LXD is Canonical's system container and virtual machine manager; the API is available over a local unix+http socket and over remote https, authenticated by TLS client certificate, OIDC identity, or unix group membership for local users. Canonical publishes the full contract as a Swagger 2.0 document with 169 paths, 333 operations and 236 schema definitions — the largest and most complete API contract in the Canonical portfolio. Capability discovery is through the api_extensions[] array on GET /1.0 rather than a path version bump; the path has been /1.0 since 2016.

## Operations (60 of 334)

| Method | Path | Summary |
|---|---|---|
| GET | `/` | Get the supported API endpoints |
| GET | `/1.0` | Get the server environment and configuration |
| PATCH | `/1.0` | Partially update the server configuration |
| PUT | `/1.0` | Update the server configuration |
| GET | `/1.0/auth/groups` | Get the groups |
| POST | `/1.0/auth/groups` | Create a new authorization group |
| DELETE | `/1.0/auth/groups/{groupName}` | Delete the authorization group |
| GET | `/1.0/auth/groups/{groupName}` | Get the authorization group |
| PATCH | `/1.0/auth/groups/{groupName}` | Partially update the authorization group |
| POST | `/1.0/auth/groups/{groupName}` | Rename the authorization group |
| PUT | `/1.0/auth/groups/{groupName}` | Update the authorization group |
| GET | `/1.0/auth/groups?recursion=1` | Get the groups |
| GET | `/1.0/auth/identities` | Get the identities |
| GET | `/1.0/auth/identities/bearer` | Get the bearer identities |
| POST | `/1.0/auth/identities/bearer` | Add a bearer identity. |
| DELETE | `/1.0/auth/identities/bearer/{nameOrID}/token` | Revoke a bearer identity token. |
| POST | `/1.0/auth/identities/bearer/{nameOrID}/token` | Issue a token for a bearer identity. |
| DELETE | `/1.0/auth/identities/bearer/{nameOrIdentifier}` | Delete the bearer identity |
| GET | `/1.0/auth/identities/bearer/{nameOrIdentifier}` | Get the bearer identity |
| PATCH | `/1.0/auth/identities/bearer/{nameOrIdentifier}` | Partially update the bearer identity |
| PUT | `/1.0/auth/identities/bearer/{nameOrIdentifier}` | Update the bearer identity |
| GET | `/1.0/auth/identities/bearer?recursion=1` | Get the bearer identities |
| GET | `/1.0/auth/identities/current` | Get the current identity |
| GET | `/1.0/auth/identities/oidc` | Get the OIDC identities |
| DELETE | `/1.0/auth/identities/oidc/{nameOrIdentifier}` | Delete the OIDC identity |
| GET | `/1.0/auth/identities/oidc/{nameOrIdentifier}` | Get the OIDC identity |
| PATCH | `/1.0/auth/identities/oidc/{nameOrIdentifier}` | Partially update the OIDC identity |
| PUT | `/1.0/auth/identities/oidc/{nameOrIdentifier}` | Update the OIDC identity |
| GET | `/1.0/auth/identities/oidc?recursion=1` | Get the OIDC identities |
| GET | `/1.0/auth/identities/tls` | Get the TLS identities |
| POST | `/1.0/auth/identities/tls` | Add a TLS identity. |
| DELETE | `/1.0/auth/identities/tls/{nameOrIdentifier}` | Delete the TLS identity |
| GET | `/1.0/auth/identities/tls/{nameOrIdentifier}` | Get the TLS identity |
| PATCH | `/1.0/auth/identities/tls/{nameOrIdentifier}` | Partially update the TLS identity |
| PUT | `/1.0/auth/identities/tls/{nameOrIdentifier}` | Update the TLS identity |
| POST | `/1.0/auth/identities/tls?public` | Add a TLS identity |
| GET | `/1.0/auth/identities/tls?recursion=1` | Get the TLS identities |
| GET | `/1.0/auth/identities?recursion=1` | Get the identities |
| GET | `/1.0/auth/identity-provider-groups` | Get the identity provider groups |
| POST | `/1.0/auth/identity-provider-groups` | Create a new identity provider group |
| DELETE | `/1.0/auth/identity-provider-groups/{idpGroupName}` | Delete the identity provider group |
| GET | `/1.0/auth/identity-provider-groups/{idpGroupName}` | Get the identity provider group |
| PATCH | `/1.0/auth/identity-provider-groups/{idpGroupName}` | Partially update the identity provider group |
| POST | `/1.0/auth/identity-provider-groups/{idpGroupName}` | Rename the identity provider group |
| PUT | `/1.0/auth/identity-provider-groups/{idpGroupName}` | Update the identity provider group |
| GET | `/1.0/auth/identity-provider-groups?recursion=1` | Get the groups |
| GET | `/1.0/auth/oidc-sessions` | Get OIDC session URLs |
| DELETE | `/1.0/auth/oidc-sessions/{id}` | Delete an OIDC session |
| GET | `/1.0/auth/oidc-sessions/{id}` | Get the OIDC session |
| GET | `/1.0/auth/oidc-sessions?recursion=1` | Get the OIDC sessions |
| GET | `/1.0/auth/permissions` | Get the permissions |
| GET | `/1.0/auth/permissions?recursion=1` | Get the permissions |
| GET | `/1.0/certificates` | Get the trusted certificates |
| POST | `/1.0/certificates` | Add a trusted certificate |
| DELETE | `/1.0/certificates/{fingerprint}` | Delete the trusted certificate |
| GET | `/1.0/certificates/{fingerprint}` | Get the trusted certificate |
| PATCH | `/1.0/certificates/{fingerprint}` | Partially update the trusted certificate |
| PUT | `/1.0/certificates/{fingerprint}` | Update the trusted certificate |
| POST | `/1.0/certificates?public` | Add a trusted certificate |
| GET | `/1.0/certificates?recursion=1` | Get the trusted certificates |

…and 274 more operations. The page lists the first 250; the full set of 334 is in the OpenAPI linked below.

## Machine-readable artifacts (7)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/canonical/refs/heads/main/openapi/canonical-lxd-rest-api-openapi.yml
- **Overlay** — https://raw.githubusercontent.com/api-evangelist/canonical/refs/heads/main/overlays/canonical-lxd-rest-api-overlay.yaml
- **AgentSkill** — https://raw.githubusercontent.com/api-evangelist/canonical/refs/heads/main/skills/canonical-lxd-provision-instance.md
- **Documentation** — https://documentation.ubuntu.com/lxd/latest/rest-api/
- **APIReference** — https://documentation.ubuntu.com/lxd/latest/api-extensions/
- **SourceCode** — https://github.com/canonical/lxd
- **Portal** — https://canonical.com/lxd

## Other Canonical APIs (12)

- [Snap Store API](https://apis.io/apis/canonical/snap-store-api/)
- [Charmhub API](https://apis.io/apis/canonical/charmhub-api/)
- [snapd REST API](https://apis.io/apis/canonical/snapd-rest-api/)
- [MAAS API](https://apis.io/apis/canonical/maas-api/)
- [Juju Client / Controller API](https://apis.io/apis/canonical/juju-api/)
- [Launchpad Web Services API](https://apis.io/apis/canonical/launchpad-api/)
- [Ubuntu Pro Client API](https://apis.io/apis/canonical/ubuntu-pro-api/)
- [Landscape API](https://apis.io/apis/canonical/landscape-api/)
- [Canonical Assertions API](https://apis.io/apis/canonical/canonical-assertions-api/)
- [Canonical Search API](https://apis.io/apis/canonical/canonical-search-api/)
- [Canonical Snaps API](https://apis.io/apis/canonical/canonical-snaps-api/)
- [Ubuntu Security API](https://apis.io/apis/canonical/ubuntu-security-api/)

## Tags

Containers, Virtualization, Infrastructure

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/canonical/lxd-rest-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/canonical/.