> ## Documentation Index > Fetch the complete documentation index at: https://docs.celum.io/llms.txt > Use this file to discover all available pages before exploring further. # Guest flow topology > The tenant-facing flow read. Cluster-addressed for the reason spelled out **Authorisation:** `security:Read` on `krn:celum:supervisor:{?supervisor}:cluster:{name}:security:*`, or on `krn:celum:supervisor:{?supervisor}:project:{?project}:cluster:{name}:security:*` — the project-qualified form, which is how a policy scopes a tenant to one project. Either resource matching is enough. ## OpenAPI ````yaml /openapi.json get /api/clusters/{name}/security/flows/topology openapi: 3.0.3 info: description: >- The HTTP surface of the Celum backend, generated from its own router and authorisation map — so this list cannot drift from the server that serves it. **Every operation states the IAM action and resource it is authorised against.** That pairing is the part worth reading: a policy naming the right action against the wrong resource matches nothing, and fails silently. Request and response bodies come from the Go types the handlers send and decode. Where those types do not determine the shape (an interface, a map[string]any, an unknown custom encoding), the operation says so in `x-celum-schema-gap` instead of carrying a guessed schema. title: Celum API version: 1.0.0 servers: - description: Your Celum deployment url: https://{host} variables: host: default: celum.example.com description: The host your Celum backend is served from security: - sessionCookie: [] - bearerToken: [] tags: - description: AI assistant & MCP name: ai-assistant - description: Clusters & CAPI lifecycle name: capi - description: Certificates & external secrets name: certs - description: GitOps & apps name: gitops - description: IAM, audit & auth name: iam - description: Image library name: images - description: Infrastructure & supervisors name: infrastructure - description: Networking name: networking - description: Observability & platform health name: observability - description: Platform onboarding & settings name: platform-settings - description: Projects name: projects - description: Registries & mirroring name: registries - description: Security & flows name: security - description: Storage name: storage - description: Templates & addons name: templates - description: Virtualization platform (KubeVirt/CDI) name: virt - description: Virtual machines name: vms - description: Workloads & topology name: workloads paths: /api/clusters/{name}/security/flows/topology: get: tags: - security summary: Guest flow topology description: >- The tenant-facing flow read. Cluster-addressed for the reason spelled out **Authorisation:** `security:Read` on `krn:celum:supervisor:{?supervisor}:cluster:{name}:security:*`, or on `krn:celum:supervisor:{?supervisor}:project:{?project}:cluster:{name}:security:*` — the project-qualified form, which is how a policy scopes a tenant to one project. Either resource matching is enough. operationId: get_clusters_byName_security_flows_topology parameters: - description: >- The supervisor's name, as registered under Administration → Supervisors. in: path name: name required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/api.flowTopologyResponse' description: Success. '400': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Request. '401': description: Not authenticated — no valid session cookie or API token. '403': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: >- Authenticated, but no policy allows this action on this resource. The body carries the action and resource that were evaluated. '502': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Gateway. components: schemas: api.flowTopologyResponse: properties: edges: items: $ref: '#/components/schemas/clickhouse.TopologyEdge' nullable: true type: array nodes: items: $ref: '#/components/schemas/clickhouse.TopologyNode' nullable: true type: array scope: $ref: '#/components/schemas/api.flowScopeNote' required: - edges - nodes - scope type: object x-go-type: backend/internal/api.flowTopologyResponse api.ErrorBody: properties: error: type: string required: - error type: object clickhouse.TopologyEdge: properties: action: type: string allowCount: format: int64 minimum: 0 type: integer bytes: format: int64 minimum: 0 type: integer destIdentity: format: int32 minimum: 0 type: integer destIps: items: type: string type: array destKind: type: string destNamespace: type: string destPort: format: int32 minimum: 0 type: integer destPortDisplay: format: int32 minimum: 0 type: integer destRedacted: type: boolean destWorkloadName: type: string dropReasons: items: type: string type: array flows: format: int64 minimum: 0 type: integer l7Http: items: $ref: '#/components/schemas/l7.Rule' type: array l7Protocol: type: string l7Top: items: type: string type: array outcome: type: string protocol: type: string rejectCount: format: int64 minimum: 0 type: integer sourceIdentity: format: int32 minimum: 0 type: integer sourceIps: items: type: string type: array sourceKind: type: string sourceNamespace: type: string sourceRedacted: type: boolean sourceWorkloadName: type: string traceObservationPoints: items: type: string type: array trafficDirection: type: string trafficDirections: items: type: string type: array viaGateway: type: string required: - action - bytes - destNamespace - destPort - destWorkloadName - flows - protocol - sourceNamespace - sourceWorkloadName type: object x-go-type: backend/internal/clickhouse.TopologyEdge clickhouse.TopologyNode: properties: aliases: items: type: string type: array cluster: type: string coveredBy: items: $ref: '#/components/schemas/clickhouse.CoveringPolicyRef' type: array description: type: string fqdn: type: string kind: type: string labelName: type: string labels: items: type: string type: array listenPorts: items: $ref: '#/components/schemas/clickhouse.TopologyPort' nullable: true type: array namespace: type: string redacted: type: boolean role: type: string subnet: type: string totalBytes: format: int64 minimum: 0 type: integer totalFlows: format: int64 minimum: 0 type: integer vlan: format: int64 type: integer workloadName: type: string required: - listenPorts - namespace - totalBytes - totalFlows - workloadName type: object x-go-type: backend/internal/clickhouse.TopologyNode api.flowScopeNote: properties: addressing: type: string cluster: type: string labels: items: type: string type: array namespaces: items: type: string type: array required: - addressing - cluster type: object x-go-type: backend/internal/api.flowScopeNote l7.Rule: properties: collapsed: type: boolean count: format: int64 minimum: 0 type: integer exact: type: boolean method: type: string path: type: string samples: items: type: string type: array required: - method - path type: object x-go-type: backend/internal/l7.Rule clickhouse.CoveringPolicyRef: properties: kind: type: string name: type: string namespace: type: string required: - kind - name type: object x-go-type: backend/internal/clickhouse.CoveringPolicyRef clickhouse.TopologyPort: properties: action: type: string flows: format: int64 minimum: 0 type: integer l7Protocol: type: string outcome: type: string peers: format: int64 minimum: 0 type: integer policyL7: type: boolean port: format: int32 minimum: 0 type: integer protocol: type: string required: - action - flows - peers - port - protocol type: object x-go-type: backend/internal/clickhouse.TopologyPort securitySchemes: sessionCookie: description: >- The session cookie issued by the OIDC sign-in flow. This is what a browser uses. in: cookie name: k8s-gate-session type: apiKey bearerToken: description: >- An API token, minted from your own identity page. A token carries the IAM groups you held **when it was minted**, and cannot bypass deletion approval — except for guest clusters inside a project that same token created. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.