Kutrion API (Relay)

Kutrion API (the Relay client) is a desktop app for building and sending HTTP and WebSocket requests. It is separate from the Kutrion server and from the REST API you build against. It runs on your machine and talks to your Kutrion server only to borrow credentials and to sync collections.

The point of the app is that a collection holds references to vault credentials, not the credentials themselves. When you press Send, the vault releases the referenced credential to the app for that one request. It is held in memory, discarded after the request, and the release is written to the audit trail by the server. If the vault cannot release it, the request is not sent.

Availability

Kutrion API is available from Downloads for macOS (Apple silicon) and Linux (x86_64). There is no Intel macOS or Windows build. The builds are unsigned, so on first launch on macOS you clear the quarantine flag or choose Open Anyway in System Settings, Privacy and Security; the Downloads card shows the exact steps.

Set up

1. Download and install the app from Downloads.
2. Enter your Kutrion server address if it is not your default. A self-hosted server uses its own address, for example https://kutrion.example.com.
3. Sign in. Either use Sign in with Kutrion, which opens an approval page in your browser and returns to the app, or sign in with your email and password. If the account asks for a second factor, you complete it as usual. After a browser sign-in the app shows which account it is now signed in to and asks you to continue; choosing “Not you?” revokes the device instead.

The app keeps its own session. It does not borrow the sign-in held by the Kutrion Hub.

Main tasks

Build and send a request

Create a collection, add requests, and use environments for variables such as a base URL. Requests support headers, query parameters, bodies, pre-request and test scripts, cookies and a response viewer. WebSocket connections are supported from the same builder. Anything you send leaves your machine directly, or through the proxy you set under Settings.

Authenticate without storing a credential

On a request, collection or folder, choose a vault credential for authentication. Supported schemes include bearer, Basic, OAuth 2.0 client credentials and AWS Signature Version 4. The credential is borrowed at send time and used once.

If you type a bearer token or Basic password directly instead, it is kept in your device’s operating-system secret store, not in the collection file. The collection, sync payloads and exports carry only a marker. A saved token is sent only to the site you entered when saving it. On another device the token is absent and you enter it again.

Import

Import from a Postman collection or environment, an OpenAPI or Swagger spec (JSON or YAML), or a pasted curl command. Credentials found in the import are left out and reported, not kept.

Sync and share

Signed in, you can sync a collection to your Kutrion server. What syncs is the same references-only document, and the server re-checks that it holds no credential values. You can share a synced collection with a team and pick a role; recipients borrow from their own vault access, so sharing a collection does not share a credential.

Mock servers, webhooks and schedules

The app can serve a collection’s saved responses from a local port, listen for inbound webhooks on a local port to trigger a flow or collection, and run collections on a schedule. All of these run on your machine, and scheduled runs fire only while the app is open.

Run collections from CI

The headless runner relay-run runs an exported collection and writes a JUnit report, with an optional JSON report. It authenticates with a Kutrion access token in KUTRION_TOKEN and borrows credentials the same way. A field that holds a saved-token marker is refused, because the secret is not on the CI machine. Prefer a vault credential or a variable there.

AI copilot

The copilot defaults to a model on your own network (Ollama). You can point it at another endpoint, Ollama or OpenAI-compatible, in Settings. Nothing is sent to a cloud service unless you configure an endpoint that is one. If your organization restricts AI to local models, the app only reaches an address on a loopback or private network. See AI overview and AI privacy model.

What is and is not recorded

The server records one audit event per credential release, naming where it was spent. Sending a request that borrows nothing is not audited, because nothing was released. See Audit logs. Kutrion’s claim is the narrow one: no plaintext credential material at rest in the collection, the sync copy or an export. It is an audited access broker, and the app does not make your request bodies or responses private from you or from the target API.

Feature clip

There is no Kutrion API feature clip yet.

Where to go next

• API overview - the REST API the clients use.
• API tokens and SCIM - tokens for unattended access.
• Kutrion Hub - the account app for the desktop clients.