# Volumez

> Volumez is a SaaS data-infrastructure-as-a-service (DIaaS) company that composes block and file
> storage directly out of cloud instance-local NVMe media instead of a storage controller. Its
> orchestrator API is declarative: you describe the outcome you want (IOPS, bandwidth, latency,
> resiliency, encryption, snapshot schedule) as a Policy, and Volumez plans and provisions volumes
> across media, nodes and zones to meet it.

Generated by API Evangelist on 2026-09-04 from the provider's own published artifacts. Volumez does
not publish an llms.txt of its own (https://volumez.com/llms.txt returns 404, probed 2026-09-04).

## Status of the developer surface (read this first)

- The machine-readable contract is REAL and first-party: OpenAPI 3.0.1, 95 paths, 124 operations,
  108 schemas, published by Volumez inside its own generated Go client.
- The API HOST IS GONE. `api.volumez.com` (the production base named throughout Volumez's own
  documentation) and `api.dev.volumez.com` (the single `servers[]` entry in the OpenAPI) both return
  NXDOMAIN as of 2026-09-04.
- The DOCUMENTATION HOST IS GONE. `docs.volumez.com` still resolves to Document360 behind Cloudflare
  but presents no valid TLS certificate (immediate handshake failure; HTTP 409 "error code: 1001" on
  port 80). It is unreachable for every client, not just this crawler.
- The status page is still live at the vendor URL and still reports every component operational,
  which contradicts the DNS. Treat it as stale.
- The company's public site was rebuilt in 2026 around enterprise agentic-AI infrastructure and
  contains no developer, documentation, pricing, signup or status link at all.

## API

- [Volumez Orchestrator API — OpenAPI 3.0.1](https://raw.githubusercontent.com/VolumezTech/volumez-rest-client/main/pkg/openapi/api/openapi.yaml): The full first-party contract. 124 operations over volumes, policies, snapshots, attachments, media, nodes, networks, connectivities, exports, associations, capacity groups, jobs, alerts, infra planning and tenant/user/role administration.
- [Generated client reference](https://github.com/VolumezTech/volumez-rest-client/blob/main/pkg/openapi/README.md): Per-operation and per-model documentation shipped with the Go client.
- Documented production base URL: `https://api.volumez.com` (from Volumez's own authentication and job-status docs). Currently NXDOMAIN.
- `servers[]` in the contract: `https://api.dev.volumez.com`. Currently NXDOMAIN.

## Authentication

- JWT in the `authorization` request header, validated against an AWS Cognito user pool
  (`x-amazon-apigateway-authtype: cognito_user_pools`). 108 of 124 operations require it.
- `POST /signin` returns `AccessToken`, `IdToken`, `RefreshToken`, `ExpiresIn` (86400) and
  `TokenType` (Bearer). Volumez's own samples put the raw `IdToken` in the `authorization` header.
- Four token types: REST API token (identity JWT), tenant token (access JWT, used by the connector
  and as the Terraform `tenant_token`), tenant host/refresh token, and the CSI driver refresh token
  (documented to expire in 10 years, passed to Helm as `vlzAuthToken`).
- Azure AD / Entra ID SSO mapping is supported.

## Conventions an agent must know

- **Asynchronous by default.** A mutating call returns `{"Message": "<jobId>"}` — the job id arrives
  in a field named `Message`, not `id`. Poll `GET /jobs/{job}` until `state == "done"` and
  `progress == 100`.
- **No idempotency.** Zero occurrences of "idempoten" in the specification, no Idempotency-Key, no
  ETag/If-Match on any of the 69 mutating operations. A retried `POST /volumes` after a timeout can
  provision a second volume across real cloud media.
- **Rehearse before you spend.** `POST /volumes/plan`, `GET /policies/{policy}/size/{size}/zone/{zone}`,
  `POST /infra-planner/create-infra-plan`, `POST /infra-planner/provider-pricing-info` and
  `POST /connectivities/test` all return a plan or a price without creating anything.
- **Reversal exists; windows do not.** `PATCH /volumes/{volume}/snapshots/{snapshot}/rollback`
  reverses a volume to a snapshot, `POST /volumes/{volume}/recover` recovers one, and
  `PATCH /tenant-settings/reset` undoes a settings change — but Volumez publishes no retention or
  grace window for any of them. `DELETE /volumes/{volume}` is irreversible: there is no soft delete
  and no restore operation.
- **Errors are opaque.** 291 of 306 declared error responses are `{"message": string}` with no code,
  no field path and no retry hint. The three async provisioning operations return a richer
  `{"Message", "ErrorCode", "ObjectID", "JobID"}` shape whose numeric codes are not published.
- **Pagination is inconsistent.** `/jobs` takes `page`+`count`; `/associations`, `/exports/` and
  `/virtualmedia` take `startfrom`+`count`; the other ~20 list operations take nothing and return
  everything. No total or next-cursor field exists anywhere.
- **No rate-limit signalling.** Two operations declare a 429; no `X-RateLimit-*`, `RateLimit-*` or
  `Retry-After` header is declared anywhere.
- **Objects are addressed by name**, not by opaque id — `/volumes/{volume}`, `/policies/{policy}`,
  `/nodes/{node}`, `/media/{media}` — while bodies also carry `volumeid`/`snapshotid`/`mediaid`.

## SDKs and tooling

- [Go client](https://pkg.go.dev/github.com/VolumezTech/volumez-rest-client) —
  `go get github.com/VolumezTech/volumez-rest-client/pkg/openapi`. Untagged: the only resolvable
  version is the commit pseudo-version `v0.0.0-20250928121505-c03963f268fd` (2025-09-28).
- [Kubernetes CSI driver (Helm)](https://github.com/VolumezTech/helm-csi) —
  `helm repo add volumez-csi https://volumeztech.github.io/helm-csi`. 111 chart versions; latest
  `1.36.0-rc.1` (2025-11-03), latest stable `1.35.0` (2025-10-23).
- [Terraform + Bicep modules](https://github.com/VolumezTech/volumez) — AWS EC2/EKS, Azure VM/VMSS/AKS,
  OCI instance pools. Distributed by `git clone` only; NOT in the Terraform Registry.
- No npm, PyPI, RubyGems, crates.io, NuGet or Maven package exists.

## Not published

- No MCP server, no A2A agent card, no GraphQL, no gRPC/Protobuf, no WSDL.
- No webhooks, callbacks, streaming or AsyncAPI. Alerts are poll-only.
- No `/.well-known/` document on any Volumez-controlled host.
- No pricing page and no plans — enterprise "contact us", sold through AWS, Azure and Oracle Cloud
  marketplaces. The API's own `POST /infra-planner/provider-pricing-info` prices the CLOUD
  PROVIDER's instances, not Volumez.
- No SLA, no deprecation policy, no public roadmap, no API changelog.

## Company

- [Volumez](https://volumez.com/) — founded 2020, San Francisco Bay Area with R&D in Tel Aviv.
- [About](https://volumez.com/about)
- [Certifications](https://volumez.com/certifications) — ISO 27001 and SOC 2 are listed by name only;
  no certificate, auditor, scope or expiry is published.
- [GitHub](https://github.com/VolumezTech)
- [Status](https://volumez.statuspage.io/) — Atlassian Statuspage, machine-readable at
  `/api/v2/summary.json`. The branded hostname `status.volumez.com` presents a `*.statuspage.io`
  certificate and fails name verification.
- [Terms of use](https://volumez.com/terms-of-use) · [Privacy policy](https://volumez.com/privacy-policy) · [Contact](https://volumez.com/contact-us)