---
title: "Understand Services"
url: "https://docs.caracal.run/v1.0/services/"
markdown_url: "https://docs.caracal.run/markdown/v1.0/services.md"
description: "Identify the service behind a user-visible operation and the dependency to check when that operation fails."
page_type: "landing"
concepts: []
requires: []
---

# Understand Services

Canonical URL: https://docs.caracal.run/v1.0/services/
Markdown URL: https://docs.caracal.run/markdown/v1.0/services.md
Description: Identify the service behind a user-visible operation and the dependency to check when that operation fails.
Page type: landing
Concepts: none
Requires: none

---

Use this section for integration boundaries and operations. It is not a requirement for ordinary console setup.

## Service Selection

| User-visible operation               | Service                               | Supported caller                                             |
| ------------------------------------ | ------------------------------------- | ------------------------------------------------------------ |
| Manage product and policy state      | [API](/v1.0/services/api/)                 | Console BFF, Admin SDK, documented Admin API                 |
| Start Sessions or create Delegations | [Coordinator](/v1.0/services/coordinator/) | SDK, documented Coordinator API, console operator views      |
| Exchange authority for a mandate     | [STS](/v1.0/services/sts/)                 | SDK, `caracal run`, Gateway, documented token client         |
| Protect an HTTP upstream             | [Gateway](/v1.0/services/gateway/)         | Client presenting a Caracal mandate                          |
| Ingest and retain decision evidence  | [Audit](/v1.0/services/audit/)             | Caracal stream producers; operators read through console/API |
| Automate zone management remotely    | [Control](/v1.0/services/control/)         | Trusted automation with a scoped Control credential          |

## Dependency Shape

```mermaid
flowchart LR
  Console --> API
  SDK --> STS
  SDK --> Coordinator
  Client --> Gateway
  Gateway --> STS
  API & STS & Gateway & Coordinator & Audit --> Postgres[(Postgres)]
  API & STS & Gateway & Coordinator & Audit --> Redis[(Redis)]
  Control --> API
```

The packaged Compose and Helm topologies deploy all five runtime services together with Postgres and Redis; Control is the only optional management surface. All five runtime services expose health and readiness. Health means the process responds. Readiness includes dependencies and service-specific thresholds. Control has no separate process: it is an optional plugin on the API port.

## Direct-Call Rule

Do not call `/internal/*` routes, write service tables, publish Redis topics, or manipulate replay directories from application code. Internal routes are authenticated service-to-service contracts. Use the console, SDKs, Admin API, Coordinator API, STS token endpoint, Gateway proxy, or Control API as documented.

## Next Step

[Manage Product State](/v1.0/services/api/) for the management path, or [Issue Mandates](/v1.0/services/sts/) for the authority path.