Reference

Message Broker HTTP Reference

Source-backed reference for Message Broker health, stream, record, cursor, queue, replication, audit, metrics, auth, and storage administration HTTP routes.

Current availability

Private Beta. Public beta is scheduled for November 9, 2026.

Private BetaConfirm First

Readiness Notes

Runtime Routes

Private Beta

The routes below are implemented in the current broker route classifier and handler modules, with local smoke coverage for the main stream, queue, and inspection workflows.

Product Boundary

Confirm First

Use this reference for private beta route behavior. Treat security, operations, replication, and external-commitment language as Confirm First unless the related limits and compatibility pages state the supported scope.

Reference Summary

ID	Type	Name	Method	Path	Maturity	Source scope
`smb-http-health`	api	Health readiness Public readiness route with storage, release, security, audit, and metrics exporter posture.	`GET`	`/health`	Private Beta	documented source scope, runtime_observability.rs
`smb-http-auth`	api	Runtime auth Classifies non-health routes before handlers run and maps them to tenant or stream permissions.	`mixed`	`all non-health routes`	Private Beta	documented source scope, runtime-authentication-middleware.md
`smb-http-stream-management`	api	Stream management Creates, lists, and describes tenant-visible runtime streams.	`PUT, GET`	`/v1/streams`	Private Beta	documented source scope, documented source scope, runtime_streams.rs
`smb-http-versioned-records`	api	Versioned records Publishes one native-shaped record or replays a bounded page by offset or time.	`POST, GET`	`/v1/streams/{stream}/records`	Private Beta	documented source scope, runtime_records.rs
`smb-http-cursors-and-inspection`	api	Cursors and inspection Inspects groups, cursors, leases, delayed retries, replay consumers, and audited cursor writes.	`GET, PUT, POST`	`/v1/streams/{stream}/consumer-groups/{group}`	Private Beta	documented source scope, runtime_cursors.rs, runtime_inspection.rs
`smb-http-shared-queue`	api	Shared queue Claims work, renews leases, acknowledges, nacks, retries, or dead-letters delivery state.	`POST`	`/claims and /deliveries/{delivery}/{action}`	Private Beta	documented source scope, runtime_queue.rs
`smb-http-replication`	api	Replication controls Inspects configured replication binding state and runs bounded worker control actions.	`GET, POST`	`/v1/replication/status and worker routes`	Private Beta	documented source scope, runtime_replication.rs
`smb-http-audit`	api	Audit query and export Reads parsed audit events or NDJSON exports from the reserved system audit stream.	`GET`	`/v1/audit/events, /v1/audit/export`	Private Beta	documented source scope, runtime_audit.rs
`smb-http-metrics`	api	Metrics scrape Returns text metrics when the broker starts with HTTP metrics exposure enabled.	`GET`	`/metrics`	Private Beta	documented source scope, runtime_observability.rs
`smb-http-storage-admin`	api	Storage admin Inspects catalog, retention, tiering readiness, archive manifests, and quarantine state.	`GET, POST`	`/streams/{stream} storage routes`	Private Beta	documented source scope, runtime_storage_admin.rs

Authentication Model

GET /health is public. Every other implemented route is protected in api-key, mtls, or external mode. The default insecure-local mode allows local protected requests without credentials and reports that posture in health.

Route family	Permission
GET /health	public readiness
GET /v1/audit/events and /v1/audit/export	tenant administer
GET /metrics and GET /v1/replication/status	tenant inspect
GET /v1/streams	tenant inspect
PUT /v1/streams/{stream}	create_stream
GET /v1/streams/{stream} and storage inspection routes	stream inspect
POST /v1/streams/{stream}/records	stream publish
GET /v1/streams/{stream}/records and queue routes	stream consume
Cursor commit and rewind routes	stream ack
Replication poll, pause, resume, and target apply	tenant administer

Streams And Records

Versioned stream and record routes
Route	Request	Response	Errors	Source scope
`PUT /v1/streams/{stream}`	JSON body with optional default_durability, retention, and failure_policy.	201 Created with stream, created flag, and acknowledgement.	400 invalid_request; 409 stream_already_exists; 500 internal_error.	runtime_streams.rs
`GET /v1/streams`	No query string or body.	200 OK with tenant-visible stream descriptions.	400 invalid_query.	runtime_streams.rs
`GET /v1/streams/{stream}`	No query string or body.	200 OK with one stream description.	400 invalid_request; 404 stream_not_found.	runtime_streams.rs
`POST /v1/streams/{stream}/records`	JSON record with message_id plus payload or payload_hex, optional key, event_time_ms, headers, and durability_mode.	201 Created with offset, next_offset, payload bytes, durability acknowledgement, and optional replication receipt.	400 invalid_request or invalid_payload; 429 quota_exceeded; 503 replication_unavailable; 500 internal_error.	runtime_records.rs
`GET /v1/streams/{stream}/records`	Optional start_offset, event_time_ms, or ingest_time_ms; max_records; max_payload_bytes; optional consumer_group plus consumer_id.	200 OK with records encoded as payload_hex and diagnostics for the read page.	400 invalid_start, invalid_page_size, or invalid_query; 404 stream_not_found; 500 internal_error.	runtime_records.rs

Core request parameters

These parameters cover the create, publish, and replay operations used by the quickstart. Query parameters do not accept JSON null; omit an optional query parameter instead.

Core stream and record request parameters
Operation	Location	Name	Type	Requirement	Default or omission	Allowed values and constraints
Create stream	Path	`stream`	string	Required	None	Non-empty; no slash, leading or trailing whitespace, or control characters.
Create stream	JSON body	`default_durability`	string	Optional; null is treated as omitted	local-disk	memory, local-disk, local-quorum, or replication-policy:<name>. A policy name cannot be blank or contain control characters or a backslash.
Create stream	JSON body	`retention`	object	Optional; null is treated as omitted	No age, byte, or cursor floor	Recognized fields are listed below. An empty object uses the defaults.
Create stream	JSON body	`retention.max_age_millis`	unsigned integer	Optional; null is treated as omitted	No age cap	Non-negative duration in milliseconds.
Create stream	JSON body	`retention.max_bytes`	unsigned integer	Optional; null is treated as omitted	No byte cap	Non-negative byte count.
Create stream	JSON body	`retention.min_cursor_name`	string	Optional; null is treated as omitted	No cursor floor	Cannot be blank or contain control characters.
Create stream	JSON body	`failure_policy`	object	Optional; null is treated as omitted	No failure policy	When present, must include max_attempts and can include the fields listed below.
Create stream	JSON body	`failure_policy.max_attempts`	unsigned integer	Required when failure_policy is present	None	From 1 through 4,294,967,295 attempts.
Create stream	JSON body	`failure_policy.retry_delay_millis`	unsigned integer	Optional; null is treated as omitted	0 ms	Non-negative duration in milliseconds.
Create stream	JSON body	`failure_policy.dead_letter_stream`	string	Optional; null is treated as omitted	No dead-letter stream	Uses the same stream-name rules as the stream path. Creation does not require the target stream to exist.
Publish record	Path	`stream`	string	Required	None	Must name an existing tenant-visible stream.
Publish record	JSON body	`message_id`	string	Required; null is rejected	None	Cannot be blank or contain control characters.
Publish record	JSON body	`payload or payload_hex`	string	At least one is required	None	payload supplies UTF-8 bytes. payload_hex must contain an even number of hexadecimal characters. When both are present, payload_hex is used.
Publish record	JSON body	`key or key_hex`	string	Optional; null is treated as omitted	No key	key supplies UTF-8 bytes. key_hex must contain an even number of hexadecimal characters. When both are present, key_hex is used.
Publish record	JSON body	`event_time_ms`	unsigned integer	Optional; null is treated as omitted	Broker current time	Unix time in milliseconds.
Publish record	JSON body	`headers`	object of string values	Optional; null is treated as omitted	Empty object	Every value must be a JSON string. Header names cannot be blank or contain control characters.
Publish record	JSON body	`durability_mode`	string	Optional; null is treated as omitted	The stream default	volatile, local-append, or local-sync.
Replay records	Path	`stream`	string	Required	None	Must name an existing tenant-visible stream.
Replay records	Query	`start_offset`	unsigned integer	Optional; mutually exclusive with both time selectors	0 when no start selector is supplied	Starts at the first stored offset greater than or equal to this value.
Replay records	Query	`event_time_ms`	unsigned integer	Optional; mutually exclusive with the other start selectors	None	Unix time in milliseconds. Selects the first indexed event time greater than or equal to the value, then continues by increasing offset.
Replay records	Query	`ingest_time_ms`	unsigned integer	Optional; mutually exclusive with the other start selectors	None	Unix time in milliseconds. Selects the first indexed ingest time greater than or equal to the value, then continues by increasing offset.
Replay records	Query	`max_records`	positive integer	Optional	100 records	From 1 through 1,000 records.
Replay records	Query	`max_payload_bytes`	positive integer	Optional	No separate request byte cap	Greater than 0 bytes. The first matching record is returned even when it alone exceeds the cap; diagnostics report that condition.
Replay records	Query	`consumer_group`	string	Optional; required together with consumer_id	No replay observation	Cannot be blank or contain slashes or control characters.
Replay records	Query	`consumer_id`	string	Optional; required together with consumer_group	No replay observation	Cannot be blank or contain slashes or control characters.

Core response and behavior contract

Core stream and record response and behavior contract
Operation	Access	Success response	Completion and side effects	Pagination, ordering, and limits	Retry and idempotency
`PUT /v1/streams/{stream}`	create_stream permission on the requested stream	201 Created, application/json. The body contains api_version, stream, created:true, and acknowledgement.	The response means stream metadata was persisted. Creation adds the tenant-visible stream and records a stream-configuration audit event.	Not paginated or asynchronous. No separate route rate limit is defined.	A repeat create returns 409 stream_already_exists. After an ambiguous response, describe the stream and compare its configuration before deciding whether to retry.
`POST /v1/streams/{stream}/records`	stream publish permission	201 Created, application/json. The body contains api_version, stream, offset, next_offset, message_id, ingest_time_ms, payload_bytes, and acknowledgement.	The response means the record reached the durability mode in acknowledgement. Publish appends one record, assigns its offset and ingest time, and can require synchronous replication for the stream default.	Each append receives a stream offset. Configured tenant publish quotas can return 429 quota_exceeded; no separate route rate limit is defined.	Duplicate message_id values are not suppressed and receive distinct offsets. Do not automatically retry an ambiguous publish; first use application state or replay results to decide whether another append is acceptable.
`GET /v1/streams/{stream}/records`	stream consume permission	200 OK, application/json. The body contains api_version, stream, records, next_offset, end_of_stream, and diagnostics.	The response completes the bounded read and does not claim queue work or advance a durable cursor. Supplying consumer_group and consumer_id records a replay-consumer observation.	Records are returned by increasing offset after the selected start. Continue with start_offset=next_offset until end_of_stream is true. A later read can include records appended after the earlier response.	The bounded read can be retried. Reuse the same selector to repeat a page, or use the prior next_offset to continue without intentionally rereading returned offsets.

Cursors And Inspection

Cursor and consumer group inspection routes
Route	Request	Response	Errors	Source scope
`GET /v1/streams/{stream}/consumer-groups/{group}`	No body.	Payload-free group description with cursors, in-flight work, delayed retries, and lag.	400 invalid_request; 404 stream_not_found; 500 internal_error.	runtime_inspection.rs
`GET /v1/streams/{stream}/consumer-groups/{group}/leases`	Optional include_completed=true\|false.	Payload-free delivery lease entries.	400 invalid_query; 404 stream_not_found.	runtime_inspection.rs
`GET /v1/streams/{stream}/consumer-groups/{group}/delayed`	No body.	Payload-free delayed retry entries.	400 invalid_query; 404 stream_not_found.	runtime_inspection.rs
`GET /v1/streams/{stream}/consumer-groups/{group}/replay-consumers`	No body; populated by fetch requests that include consumer_group and consumer_id.	Payload-free replay consumer activity observations.	400 invalid_query; 404 stream_not_found.	runtime_inspection.rs
`GET /v1/streams/{stream}/consumer-groups/{group}/cursors`	No body.	Cursor count and cursor state entries.	400 invalid_query; 404 stream_not_found.	runtime_inspection.rs
`PUT /v1/streams/{stream}/consumer-groups/{group}/cursors/{cursor}`	JSON body with offset.	Cursor commit acknowledgement.	400 invalid_request; 409 write_not_allowed; 500 internal_error.	runtime_cursors.rs
`POST /v1/streams/{stream}/consumer-groups/{group}/cursors/{cursor}/rewind`	JSON body with offset and non-empty reason.	Cursor rewind response and audit support details.	400 invalid_request; 409 write_not_allowed; 500 internal_error.	runtime_cursors.rs

Shared Queue

Shared queue claim and delivery mutation routes
Route	Request	Response	Errors	Source scope
`POST /v1/streams/{stream}/consumer-groups/{group}/claims`	Optional start_offset, max_messages, and lease_timeout_millis.	Claim result with subscription id, deliveries, next_offset, and delivery_count.	400 invalid_request; 404 missing_stream; 429 quota_exceeded; 500 queue_state_persistence_failed.	runtime_queue.rs
`POST /v1/streams/{stream}/subscriptions/{subscription}/deliveries/{delivery}/ack`	Optional empty JSON object.	Acknowledged offset, attempt, timestamp, and local queue-state acknowledgement.	404 delivery_not_found; 409 lease_expired or lease_not_active; 500 queue_state_persistence_failed.	runtime_queue.rs
`POST /v1/streams/{stream}/subscriptions/{subscription}/deliveries/{delivery}/nack`	reason and requeue.	Policy action, redelivery decision, optional retry time, and optional dead-letter target.	400 invalid_request; 404 delivery_not_found; 409 lease_expired or lease_not_active; 500 queue_state_persistence_failed.	runtime_queue.rs
`POST /v1/streams/{stream}/subscriptions/{subscription}/deliveries/{delivery}/renew`	Positive extend_by_millis.	Renewed lease body.	400 invalid_request; 404 delivery_not_found; 409 lease_expired or lease_not_active; 500 queue_state_persistence_failed.	runtime_queue.rs
`POST /v1/streams/{stream}/subscriptions/{subscription}/deliveries/{delivery}/retry`	reason and delay_millis.	Retry availability timestamp.	400 invalid_request; 404 delivery_not_found; 409 lease_expired or lease_not_active; 500 queue_state_persistence_failed.	runtime_queue.rs
`POST /v1/streams/{stream}/subscriptions/{subscription}/deliveries/{delivery}/dead-letter`	dead_letter_stream and reason.	Source offset and dead-letter offset.	400 invalid_request; 404 missing_stream or delivery_not_found; 409 lease_expired or lease_not_active; 500 queue_state_persistence_failed.	runtime_queue.rs

Queue request parameters

Claim accepts an omitted body or a JSON object. Ack accepts an omitted body or an empty JSON object. Nack, renew, retry, and dead-letter require a JSON body. Optional claim fields treat JSON null as omission; required fields reject null as missing. These routes do not accept query parameters.

Shared-queue request parameters
Operation	Location	Name	Type	Requirement	Default or omission	Allowed values and constraints
Claim queue work	Path	`stream`	string	Required	None	Must name an existing tenant-visible stream.
Claim queue work	Path	`consumer_group`	string	Required	None	Cannot be blank or contain a slash, tab, or control character.
Claim queue work	JSON body	`start_offset`	unsigned integer	Optional; null is treated as omitted	0	Cannot exceed the stream's highest next offset. This is a scan start, not a committed queue cursor.
Claim queue work	JSON body	`max_messages`	positive integer	Optional; null is treated as omitted	1 message	From 1 through 1,000 messages.
Claim queue work	JSON body	`lease_timeout_millis`	positive integer	Optional; null is treated as omitted	30,000 ms	Greater than 0 milliseconds. Choose a bounded interval appropriate for the worker task.
Acknowledge delivery	Path	`stream`	string	Required	None	Must name the stream from the active delivery.
Acknowledge delivery	Path	`subscription_id`	string	Required	None	Use the broker-returned subscription id for the active delivery; no slash, tab, or control character.
Acknowledge delivery	Path	`delivery_id`	string	Required	None	Use the active broker-returned delivery id; replay-only ids cannot mutate queue state.
Reject delivery	Path	`stream`	string	Required	None	Must name the stream from the active delivery.
Reject delivery	Path	`subscription_id`	string	Required	None	Use the broker-returned subscription id for the active delivery; no slash, tab, or control character.
Reject delivery	Path	`delivery_id`	string	Required	None	Use the active broker-returned delivery id.
Reject delivery	JSON body	`reason`	string	Required; null is rejected as missing	None	Cannot be blank or contain control characters.
Reject delivery	JSON body	`requeue`	boolean	Required; null is rejected as missing	None	true applies the stream failure policy or immediate redelivery; false stops redelivery for this consumer group and offset.
Renew delivery lease	Path	`stream`	string	Required	None	Must name the stream from the active delivery.
Renew delivery lease	Path	`subscription_id`	string	Required	None	Use the broker-returned subscription id for the active delivery; no slash, tab, or control character.
Renew delivery lease	Path	`delivery_id`	string	Required	None	Use the active broker-returned delivery id.
Renew delivery lease	JSON body	`extend_by_millis`	positive integer	Required; null is rejected as missing	None	Greater than 0 milliseconds. The duration is added to the current lease expiry, not the request time.
Schedule delivery retry	Path	`stream`	string	Required	None	Must name the stream from the active delivery.
Schedule delivery retry	Path	`subscription_id`	string	Required	None	Use the broker-returned subscription id for the active delivery; no slash, tab, or control character.
Schedule delivery retry	Path	`delivery_id`	string	Required	None	Use the active broker-returned delivery id.
Schedule delivery retry	JSON body	`reason`	string	Required; null is rejected as missing	None	Cannot be blank or contain control characters.
Schedule delivery retry	JSON body	`delay_millis`	unsigned integer	Required; null is rejected as missing	None	Non-negative milliseconds. 0 releases the record for immediate redelivery without evaluating the stream failure policy.
Dead-letter delivery	Path	`stream`	string	Required	None	Must name the source stream from the active delivery.
Dead-letter delivery	Path	`subscription_id`	string	Required	None	Use the broker-returned subscription id for the active delivery; no slash, tab, or control character.
Dead-letter delivery	Path	`delivery_id`	string	Required	None	Use the active broker-returned delivery id.
Dead-letter delivery	JSON body	`dead_letter_stream`	string	Required; null is rejected as missing	None	Must name an existing tenant-visible stream and follow the stream-name rules.
Dead-letter delivery	JSON body	`reason`	string	Required; null is rejected as missing	None	Cannot be blank or contain control characters.

Queue response and behavior contract

Every successful operation writes queue metadata under the configured storage root. A persistence error can follow an in-memory mutation, so inspect queue state before retrying an ambiguous request.

Shared-queue response and behavior contract
Operation	Access	Success response	Completion and side effects	Ordering, timing, and limits	Retry and idempotency
`POST /v1/streams/{stream}/consumer-groups/{consumer_group}/claims`	stream consume permission	200 OK, application/json. The body contains api_version, stream, consumer_group, subscription_id, deliveries, next_offset, and delivery_count. Each delivery includes ids, attempt, lease times, and the record.	A 200 response means the subscription and selected delivery leases were written to durable queue metadata. Claim increments each selected record's attempt; delivery_count can be 0 when no work is available.	Scans by increasing offset from start_offset and selects available work, up to max_messages. next_offset follows the highest selected offset, or stays at start_offset when none is selected; it is not a committed queue cursor. Tenant consumer-count quota can return 429.	Claim is not idempotent. After an ambiguous response, inspect the consumer group and leases before claiming again because the first request may have created active leases. An expired lease is redelivered under a fresh delivery id with a higher attempt.
`POST /v1/streams/{stream}/subscriptions/{subscription_id}/deliveries/{delivery_id}/ack`	stream consume permission	200 OK, application/json. The body contains api_version, stream, subscription_id, delivery_id, offset, attempt, acknowledged_at_ms, and acknowledgement.	A 200 response marks the consumer-group offset acknowledged and writes the terminal outcome to durable queue metadata. The acknowledgement reports local-disk queue-state durability.	Not paginated. The delivery must still be active and match the stream and subscription in the path.	A duplicate successful ack returns 409 lease_not_active. After an ambiguous response or queue_state_persistence_failed, inspect queue state before retrying because the in-memory ack may already have succeeded.
`POST /v1/streams/{stream}/subscriptions/{subscription_id}/deliveries/{delivery_id}/nack`	stream consume permission	200 OK, application/json. The body contains api_version, delivery identity, offset, attempt, will_redeliver, policy_action, and optional availability or dead-letter fields.	With requeue:false, the offset becomes terminal for the group. With requeue:true, the stream failure policy can release now, schedule a retry, dead-letter at max attempts, or stop; the durable queue snapshot records the result.	Not paginated. policy_action is redeliver_now, scheduled_retry, dead_lettered, or stopped. available_at_ms is present for redelivery, and dead-letter fields are present only when the policy routes the record.	The delivery id becomes non-active after success, so a duplicate returns 409 lease_not_active. Inspect the group, lease, delayed work, and dead-letter target before resolving an ambiguous response.
`POST /v1/streams/{stream}/subscriptions/{subscription_id}/deliveries/{delivery_id}/renew`	stream consume permission	200 OK, application/json. The body contains api_version, delivery identity, and a lease with consumer_group, offset, attempt, lease timestamps, and active state.	A 200 response adds extend_by_millis to the current active lease expiry and writes the renewed lease to durable queue metadata. It does not change the delivery attempt.	Not paginated. Renewal must arrive while the lease is active; an expired lease must be claimed again with a fresh delivery id.	Renewal is not idempotent: repeating a successful request extends from the already-renewed expiry. After an ambiguous response, inspect the current lease_expires_at_ms before deciding whether to renew again.
`POST /v1/streams/{stream}/subscriptions/{subscription_id}/deliveries/{delivery_id}/retry`	stream consume permission	200 OK, application/json. The body contains api_version, delivery identity, offset, attempt, and available_at_ms.	A 200 response releases the current delivery and records when its offset becomes available to the same consumer group. This explicit delay does not evaluate the stream failure policy.	Not paginated. delay_millis:0 makes the offset immediately available; a positive delay hides it from claims until available_at_ms. A later claim increments the attempt and returns a fresh delivery id.	The original delivery id becomes non-active after success, so a duplicate returns 409 lease_not_active. Inspect delayed and lease state before resolving an ambiguous response.
`POST /v1/streams/{stream}/subscriptions/{subscription_id}/deliveries/{delivery_id}/dead-letter`	stream consume permission	200 OK, application/json. The body contains api_version, delivery identity, source_offset, dead_letter_stream, dead_letter_offset, and attempt.	A 200 response copies the record payload, key, event time, durability mode, and headers to the existing dead-letter stream; adds source-stream, source-offset, and reason headers; and makes the source offset terminal for the group.	Not paginated. The dead-letter record receives the next offset in the target stream. The target must already exist and be visible to the tenant.	The original delivery id becomes non-active after success. Do not automatically retry an ambiguous response or queue_state_persistence_failed; inspect both queue state and the dead-letter stream because a copy may already exist.

Replication

Replication status, worker, and target apply routes
Route	Request	Response	Errors	Source scope
`GET /v1/replication/status`	No query string or body.	Scheduler, transport, managed worker, checkpoint, target state, and operator controls.	400 invalid_query.	runtime_replication.rs
`POST /v1/replication/workers/poll`	Empty POST; requires runtime binding.	Bounded poll report and transport status.	400 invalid_payload; 409 replication_not_configured; runtime poll errors.	runtime_replication.rs
`POST /v1/replication/workers/pause`	stream, source_site, target_site, optional tenant, optional reason.	Paused control and operator control summary.	400 invalid_request; 404 replication_worker_not_found; 409 replication_not_configured.	runtime_replication.rs
`POST /v1/replication/workers/resume`	stream, source_site, target_site, optional tenant, optional reason.	Resumed control and operator control summary.	400 invalid_request; 404 replication_worker_not_found; 409 replication_not_configured.	runtime_replication.rs
`POST /v1/replication/target/apply`	Bounded source-record metadata batch with source/target sites and policy metadata.	Apply counts, next expected offset, target watermark, and newly applied origin offsets.	400, 409, 413, or 500 replica_apply errors.	runtime_replication.rs

Audit, Metrics, And Storage Admin

Operational and storage administration routes
Route	Request	Response	Errors	Source scope
`GET /v1/audit/events`	Optional start_offset and max_records.	JSON page of parsed audit event records.	400 invalid_request, invalid_query, invalid_start_offset, or invalid_page_size; 500 internal_error.	runtime_audit.rs
`GET /v1/audit/export`	Optional start_offset and max_records.	application/x-ndjson audit export.	400 invalid_request, invalid_query, invalid_start_offset, or invalid_page_size; 500 internal_error.	runtime_audit.rs
`GET /metrics`	No query or body; requires --metrics-exposure http.	text/plain metrics with OpenTelemetry names and Prometheus-safe aliases.	400 invalid_query; 404 metrics_disabled; auth errors in protected modes.	runtime_observability.rs
`GET /streams/{stream}/retention/dry-run`	Optional max_bytes and max_age_ms.	Non-mutating retention plan.	400 invalid_retention_policy or invalid_query; 404 missing_stream.	runtime_storage_admin.rs
`GET /streams/{stream}/tiering/readiness`	Optional max_bytes and max_age_ms.	Payload-free tiering readiness manifest.	400 invalid_tiering_policy or invalid_query; 404 missing_stream; 500 tiering_manifest_failed.	runtime_storage_admin.rs
`GET /streams/{stream}/tiering/archive-manifest`	Optional max_bytes and max_age_ms.	Archive-manifest JSON with storage-tiering content type.	400 invalid_tiering_policy or invalid_query; 404 missing_stream; 500 tiering_manifest_failed.	runtime_storage_admin.rs
`GET /streams/{stream}/quarantine`	No query or body.	Payload-free quarantine incident list.	400 invalid_query; 404 missing_stream; 500 quarantine storage errors.	runtime_storage_admin.rs
`POST /streams/{stream}/quarantine/{incident}/acknowledge`	Optional acknowledged_by and note.	Acknowledged quarantine incident.	400 invalid_request; 404 quarantine_not_found; 409 write_not_allowed; 500 quarantine storage errors.	runtime_storage_admin.rs

Limits

Limit	Value	Applies To
Default fetch page size	100 records	Versioned fetch, legacy fetch, audit events, audit export
Maximum fetch page size	1000 records	Versioned fetch, legacy fetch, audit events, audit export
Default queue claim count	1 message	Queue claim route
Maximum queue claim count	1000 messages	Queue claim route
Default queue lease timeout	30000 ms	Queue claim route
Replica apply records	1000 records	/v1/replication/target/apply
Replica apply payload bytes	64 MiB	/v1/replication/target/apply aggregate payload_bytes metadata
Route token shape	No slash, tab, or control chars	consumer group, cursor, subscription, and delivery path tokens
Metrics exposure	opt-in	--metrics-exposure http

Errors

Status	Error Code	Meaning	Recovery
`400`	invalid_request	Body, route token, offset, or route-specific validation failed.	Fix request fields and retry.
`400`	invalid_query	Query string is unsupported or malformed.	Remove or correct the query string.
`401`	authentication_required / authentication_failed	Protected route credentials are missing or invalid.	Supply configured credentials or use insecure-local intentionally.
`403`	authorization_denied	Authenticated caller lacks the required permission.	Check tenant, stream, role grants, and auth mode.
`404`	stream_not_found / missing_stream / not_found	Stream or route is not visible to the caller.	Create the stream, check tenant context, or use a documented route.
`409`	lease_expired / lease_not_active	Queue mutation targeted stale or terminal delivery state.	Claim work again or inspect queue state.
`409`	replication_not_configured	Replication worker action needs a binding file.	Start with --replication-binding-file.
`429`	quota_exceeded	Tenant quota rejected publish, queue, or replication egress work.	Reduce request rate or review quota configuration.
`503`	replication_unavailable	Required stream replication policy is not currently satisfied.	Inspect /v1/replication/status before retrying.
`500`	internal_error	Storage, registry, queue, audit, or replication state failed unexpectedly.	Check broker logs, storage permissions, and disk health.

Examples

Create And Publish

Stream

curl -s -X PUT -H 'Content-Type: application/json' \
  --data '{}' \
  http://127.0.0.1:9101/v1/streams/orders

curl -s -X POST -H 'Content-Type: application/json' \
  --data '{"message_id":"msg-1","payload":"hello","durability_mode":"local-append"}' \
  http://127.0.0.1:9101/v1/streams/orders/records

Replay And Inspect

Records

curl -s \
  'http://127.0.0.1:9101/v1/streams/orders/records?start_offset=0&max_records=10&consumer_group=workers&consumer_id=replay-1'

curl -s \
  http://127.0.0.1:9101/v1/streams/orders/consumer-groups/workers/replay-consumers

Claim And Ack

Queue

curl -s -X POST -H 'Content-Type: application/json' \
  --data '{"max_messages":1,"lease_timeout_millis":30000}' \
  http://127.0.0.1:9101/v1/streams/orders/consumer-groups/workers/claims

curl -s -X POST -H 'Content-Type: application/json' \
  --data '{}' \
  http://127.0.0.1:9101/v1/streams/orders/subscriptions/sub-1/deliveries/del-1/ack

Operate

Ops

curl -s http://127.0.0.1:9101/v1/replication/status
curl -s 'http://127.0.0.1:9101/v1/audit/events?start_offset=0&max_records=100'
curl -s http://127.0.0.1:9101/metrics
curl -s 'http://127.0.0.1:9101/streams/orders/tiering/readiness?max_age_ms=86400000'

Safe Next Steps

Available now
Run stream and queue quickstart
Create streams, publish records, replay data, claim queue work, ack results, and inspect private beta limits.
Available now
Review Message Broker limits
Use the limits and compatibility guidance before strengthening stream, queue, auth, replication, or pilot-readiness claims.
Available
Read CLI and SDK reference
Lifecycle flags, diagnostics, data CLI, remote CLI, and Rust SDK publish and replay entry points.
Available
Compare route and auth scope
Separate private beta routes from auth, replication, queue, CLI, SDK, and Kafka protocol boundaries.