# Mount Thor

> Customer documentation for Mount Thor: Apple hardware at datacenter scale for bare-metal machines and macOS virtual machines.

## Docs

- [Quickstart](https://docs.mountthor.com/quickstart.md): Create and connect to your first Mount Thor machine
- [Bare metal](https://docs.mountthor.com/compute/bare-metal.md): Allocate and access a dedicated Apple Silicon Mac
- [Virtual machines](https://docs.mountthor.com/compute/virtual-machines.md): Create and access an isolated macOS virtual machine
- [Images](https://docs.mountthor.com/platform/images.md): Choose a macOS image for compute
- [Fleet and capacity](https://docs.mountthor.com/platform/fleet-capacity.md): View your capacity and machine classes
- [Account](https://docs.mountthor.com/platform/account.md): Inspect your active customer and tenant
- [Team management](https://docs.mountthor.com/platform/team-management.md): Invite teammates and manage access roles
- [API keys](https://docs.mountthor.com/platform/api-keys.md): Manage credentials for automation
- [Workload identity](https://docs.mountthor.com/platform/identity-principals.md): Authenticate CI workloads with OIDC
- [Billing](https://docs.mountthor.com/platform/billing.md): Review funds, prices, usage, credits, and invoices
- [Get Account](https://docs.mountthor.com/api-reference/account/get-account.md): Returns account identity, tenant namespace mapping, and customer-visible entitlements for the bearer API key. Use `tenants[].namespace_name` when configuring `kubectl` for the Compute API.
- [Update Account](https://docs.mountthor.com/api-reference/account/update-account.md): This operation only updates customer-owned display metadata. It does not change legal name, tenant bindings, namespaces, entitlements, routing, or account status.
- [Activate Account](https://docs.mountthor.com/api-reference/registration/activate-account.md): Redeems a one-time registration code, activates the account, and returns the initial API key exactly once. The route accepts JSON and the hosted HTML registration form.
- [List Keys](https://docs.mountthor.com/api-reference/api-keys/list-keys.md): Plaintext API keys and verifier material are never returned. Revoked keys remain visible for audit until retention cleanup.
- [Create Key](https://docs.mountthor.com/api-reference/api-keys/create-key.md): The plaintext `api_key` is returned exactly once. The requested scopes must be covered by the caller's own API-key scopes. Store the returned value in a secret manager before discarding the response.
- [Delete Key](https://docs.mountthor.com/api-reference/api-keys/delete-key.md)
- [List Sessions](https://docs.mountthor.com/api-reference/sessions/list-sessions.md): Lists active session metadata for the requesting actor. Token material is never returned, and sessions outside the actor scope are not disclosed.
- [Create Session](https://docs.mountthor.com/api-reference/sessions/create-session.md): Creates a short-lived compute session from an API key or a trusted workload identity token.
- [Start Browser Login](https://docs.mountthor.com/api-reference/sessions/start-browser-login.md)
- [Revoke Session](https://docs.mountthor.com/api-reference/sessions/revoke-session.md): Revokes one active session by id within the requesting actor scope. Returns 404 when the session is absent or belongs to another actor.
- [List Fleet Resources](https://docs.mountthor.com/api-reference/fleet/list-fleet-resources.md)
- [List Fleet Capacity](https://docs.mountthor.com/api-reference/fleet/list-fleet-capacity.md): Returns commercial and operational limits that apply to the tenant's fleet: committed quantities, whether on-demand use is allowed, bare-metal machine caps, and access-session caps.
- [Get Fleet Summary](https://docs.mountthor.com/api-reference/fleet/get-fleet-summary.md): Returns customer-safe resource inventory plus exact paid VM block occupancy. Capacity configuration and availability are exposed by their dedicated canonical endpoints.
- [List Usage](https://docs.mountthor.com/api-reference/fleet/list-usage.md): Returns usage grouped by resource class for a live window (`24h`, `7d`, `month`) or a closed calendar month (`YYYY-MM`). Open lifecycles report elapsed raw time; billing minimums are applied only when the lifecycle closes.
- [List Images](https://docs.mountthor.com/api-reference/images/list-images.md)
- [Get Image](https://docs.mountthor.com/api-reference/images/get-image.md)
- [List Teammates](https://docs.mountthor.com/api-reference/customer-users/list-teammates.md)
- [Invite Teammate](https://docs.mountthor.com/api-reference/customer-users/invite-teammate.md): Returns 409 until runtime admission is ready.
- [List Billing Usage](https://docs.mountthor.com/api-reference/billing/list-billing-usage.md): Returns usage aggregated across every tenant under the customer account, plus a per-tenant breakdown. Window semantics match `/v1/admin/fleet/usage`: `24h` -> hourly buckets; `7d`, `month`, and a closed `YYYY-MM` calendar month -> daily buckets. Open lifecycles report elapsed raw time; per-class bil…
- [List Billing Costs](https://docs.mountthor.com/api-reference/billing/list-billing-costs.md): Joins live usage against the customer's active price book and returns itemized line items per (tenant, resource_kind, resource_class, usage_model). The math is recomputed live on every request for both the current period and past months. Issued invoices are served by the invoice routes, not this one…
- [List Invoices](https://docs.mountthor.com/api-reference/billing/list-invoices.md): Returns invoice headers ordered by `period_start` descending. `finality` distinguishes a running estimate from a final invoice.
- [Get Invoice](https://docs.mountthor.com/api-reference/billing/get-invoice.md): The invoice must belong to the authenticated customer; a not-found shape is returned even when the invoice exists for a different customer so this endpoint cannot be used to probe for invoice IDs across tenants. Line-item detail is provider-hosted — follow `hosted_invoice_url`.
- [List Billing Prices](https://docs.mountthor.com/api-reference/billing/list-billing-prices.md): Returns each priced resource kind, class, and usage model.
- [List Bare Metal Machines](https://docs.mountthor.com/api-reference/compute/list-bare-metal-machines.md): Lists bare-metal machines in the tenant namespace, including lifecycle status and customer-visible allocation details.
- [Create Bare Metal Machine](https://docs.mountthor.com/api-reference/compute/create-bare-metal-machine.md): Creates a bare-metal machine request. The request selects a machine class, image channel, access policy, and optional placement preferences.
- [Get Bare Metal Machine](https://docs.mountthor.com/api-reference/compute/get-bare-metal-machine.md): Returns one bare-metal machine by name, including desired state and customer-visible status.
- [Delete Bare Metal Machine](https://docs.mountthor.com/api-reference/compute/delete-bare-metal-machine.md): Deletes one bare-metal machine by name and starts the configured cleanup policy.
- [List Virtual Machines](https://docs.mountthor.com/api-reference/compute/list-virtual-machines.md): Lists Virtual Machines in the tenant namespace.
- [Create Virtual Machine](https://docs.mountthor.com/api-reference/compute/create-virtual-machine.md): Creates one Virtual Machine in the tenant namespace.
- [Get Virtual Machine](https://docs.mountthor.com/api-reference/compute/get-virtual-machine.md): Returns one Virtual Machine by name from the tenant namespace.
- [Delete Virtual Machine](https://docs.mountthor.com/api-reference/compute/delete-virtual-machine.md): Deletes one Virtual Machine by name from the tenant namespace.
- [List Machine Classes](https://docs.mountthor.com/api-reference/compute/list-machine-classes.md): Lists customer-visible bare-metal hardware classes available for BareMetalMachine requests.
- [Get Machine Class](https://docs.mountthor.com/api-reference/compute/get-machine-class.md): Returns one bare-metal hardware class by name.
- [Get Identity Setup](https://docs.mountthor.com/api-reference/identity/get-identity-setup.md)
- [Create Identity Setup Link](https://docs.mountthor.com/api-reference/identity/create-identity-setup-link.md)
- [List IdPs](https://docs.mountthor.com/api-reference/identity-workload/list-idps.md): Returns external OIDC providers trusted by this customer. These records contain trust configuration only; they do not contain token or key material.
- [Create IdP](https://docs.mountthor.com/api-reference/identity-workload/create-idp.md): Adds an external OIDC issuer to the customer's trust boundary. The issuer URL is canonicalized on write, and active issuers must be unique per customer.
- [Update IdP](https://docs.mountthor.com/api-reference/identity-workload/update-idp.md): Updates mutable IdP metadata: display name, accepted audiences, clock skew, and status. The issuer URL and JWKS source are immutable; register a new IdP to change those trust roots.
- [List Principals](https://docs.mountthor.com/api-reference/identity-workload/list-principals.md): Returns OIDC workload bindings that can exchange external tokens for short lived Mount Thor sessions.
- [Create Principal](https://docs.mountthor.com/api-reference/identity-workload/create-principal.md): Creates a binding from a verified external OIDC token to Mount Thor session scopes. The request must reference an existing IdP or provide inline IdP material that Mount Thor can register or reuse.
- [Update Principal](https://docs.mountthor.com/api-reference/identity-workload/update-principal.md): Updates mutable principal metadata, scopes, TTL, matching constraints, and lifecycle status. Disabling a principal blocks new token exchanges; already minted sessions keep their own expiry.

## OpenAPI Specs

- [customer-compute-crds.v1.openapi](https://docs.mountthor.com/api-reference/customer-compute-crds.v1.openapi.json)
- [customer-api.v1.openapi](https://docs.mountthor.com/api-reference/customer-api.v1.openapi.json)