generated: '2026-08-26'
method: searched
source: >-
  https://support.doubleoctopus.com/support/solutions/articles/33000275542-how-to-configure-the-help-desk-role,
  https://support.doubleoctopus.com/support/solutions/articles/33000294232-frequently-ask-questions
api: Octopus Management Console REST API
coverage_note: >-
  SDO publishes no OpenAPI and no public API reference, so nothing below is derived from a spec.
  Only conventions SDO states in public support articles are recorded as known; every convention the
  public surface does not state is recorded as `not-published` rather than guessed. The full
  operation-level reference exists, but only inside a customer's own deployment at
  <management-console-host>:<port>/docs/.
base_path:
  value: <management-console-host>:<port>/api/
  note: >-
    Confirmed publicly: role ACL rules are written against "only the section of the URL following
    <URL>:<port>/api/". The host and port are the customer's own; there is no vendor API host.
  source: https://support.doubleoctopus.com/support/solutions/articles/33000275542-how-to-configure-the-help-desk-role
auth_style:
  value: API token issued by a REST API service created in the Management Console, alongside a service
    certificate
  detail: authentication/secret-double-octopus-authentication.yml
authorization_style:
  value: role-based resource+method allow/deny ACL
  shape: '{"resource": "<REST API URL>", "methods": ["<Method1>", "<Method2>"], "action": "<allow/deny>"}'
  source: https://support.doubleoctopus.com/support/solutions/articles/33000275542-how-to-configure-the-help-desk-role
idempotency:
  supported: not-published
  header: null
  scope: null
  retention: null
  note: >-
    No idempotency key, header or retry-safety guidance appears on any public SDO surface. NOT
    asserted as absent in the product — it is absent from the public documentation, which is the only
    thing measurable here. No Idempotency pointer is emitted.
pagination:
  style: not-published
  params: []
  response_fields: []
field_expansion: not-published
sparse_fieldsets: not-published
metadata: not-published
request_id_tracing:
  supported: not-published
  note: >-
    The July 2026 release adds improved audit filtering and export in the Management Console, so
    server-side audit correlation exists, but no request-id response header is documented publicly.
  source: https://support.doubleoctopus.com/support/solutions/articles/33000315611-octopus-platform-release-july-2026
versioning:
  style: product/build versioning of the deployed server (see lifecycle/)
  api_version_in_url: not-published
  api_version_header: not-published
error_envelope:
  shape: not-published
  rfc9457: unknown
rate_limit_signaling:
  headers: []
  note: See rate-limits/secret-double-octopus-rate-limits.yml — none published.
dry_run_mode:
  supported: not-published
reversibility:
  grade: not-published
  write_surface: true
  write_surface_evidence: >-
    SDO's own FAQ states the REST APIs "allow complete system control, including scripting, bulk
    updates, and integration with identity management solutions like SailPoint", and the role ACL
    model enumerates HTTP methods per resource — so the API is unambiguously a write surface, not
    read-only. `na` would therefore be wrong here.
  reversal_operations: []
  windows: []
  note: >-
    No reversal operation and no reversal window could be recorded, because SDO publishes no
    operation-level reference on any public host. Directionally relevant lifecycle controls do exist
    and are documented in prose — configurable policies for account lifecycle management, automated
    enrollment groups, and re-enrollment of users — but nothing states a named undo/restore operation
    or the window in which it works, and inventing one is out of bounds. This is `not-published`
    (an honest gap in the public record), NOT `na` (which would falsely claim the API has no writes)
    and NOT `documented` (which would claim a reversal path we cannot point at).
  source: https://support.doubleoctopus.com/support/solutions/articles/33000294232-frequently-ask-questions
cross_links:
  authentication: authentication/secret-double-octopus-authentication.yml
  lifecycle: lifecycle/secret-double-octopus-lifecycle.yml
  rate_limits: rate-limits/secret-double-octopus-rate-limits.yml
  conformance: conformance/secret-double-octopus-conformance.yml