Everything the console does,you can do headless.
The web interface has no private endpoints. It calls the same API, with the same tokens and the same permissions, which is why anything you see on a screen can also happen in a pipeline.
One API, and it describes itself.
The control plane serves its own OpenAPI document at /api/v1/openapi.json: 56 operations across 39 paths, with a test that fails the build if the specification and the router ever drift. Generate a client from it, or read it as documentation.
curl -H "Authorization: Bearer $SEXTANT_TOKEN" \
https://sextant.example.org/api/v1/devices
{ "tag": "balie-001", "status": "online",
"baseline": "compliant", "version": "current" }Tokens with a ceiling and an end date.
A token is minted for a purpose, with the highest role it may ever reach and a lifetime after which it stops working. A pipeline that only reads gets a token that can only read, and it expires whether or not anyone remembers it.
$ sxctl devices list -json | jq '.[] | select(.status=="offline")'
$ sxctl settings set group:balie desktop.lockAfterMinutes 10 -enforce
$ sxctl changes open lock-screens "shorter idle lock"
$ sxctl changes submit lock-screens
$ sxctl evidence 2026-01-01 2026-06-30 > audit-h1.jsonsxctl, for the terminal and the pipeline.
The same operations without a browser. Configuration comes from the environment (SEXTANT_URL, SEXTANT_TOKEN) so a secret never travels on the command line, and every list can be asked for as JSON.
What people do with it.
Joiners and leavers
Your HR system already knows who arrives and who leaves. Enrolling and retiring a device is two calls.
Evidence on a schedule
A signed export for the quarter, pulled by a job rather than remembered by a person the week an auditor writes.
Changes from your own pipeline
Open a change, edit it, submit it. The same gate and the same waves as a change made in the console.
One document for every laptop.site.audit.
Take it, run it, help build it.
The software is yours under the EUPL 1.2 and needs nobody’s permission. What the project needs is people: a laptop model we have never imaged, a language nobody has translated, a bug found by running it for real.