> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelrail.com/llms.txt
> Use this file to discover all available pages before exploring further.

# REST API Reference

> Complete HTTP API reference for the control plane, organized by resource group.

Route inventory for Levelrail's control plane HTTP API, organized by resource group matching `docs/feature-catalog.md`.

The tables below are generated from the route registrations in `internal/api/routes*.go`. After adding or changing a route, run `go run ./scripts/gen-api-reference` (fast and idempotent) and commit the result; `TestAPIReferenceCoversEveryRoute` fails if a registered route is missing. New routes land in the group with the closest path prefix, or in **Other**.

## System

System endpoints for:

* Status checks and diagnostics
* Admin operations
* Configuration retrieval and management

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /healthz | Public | handleHealthz |
| GET | /readyz | Public | handleReadyz |
| GET | /api/v1/brand | Public | handleBrand |
| GET | /api/v1/dev-mode | Public | handleDevMode |
| GET | /api/v1/system/status | AbilityRead | handleSystemStatus |
| GET | /api/v1/system/doctor | AbilityRead | handleSystemDoctor |
| GET | /api/v1/system/containers | AbilityRead | handleListContainers |
| POST | /api/v1/system/prune | AbilityRoot | handleSystemPrune |
| POST | /api/v1/system/backups | AbilityRoot | handleCreateControlPlaneBackup |
| GET | /api/v1/system/backups | AbilityRoot | handleListControlPlaneBackups |
| GET | /api/v1/system/backups/{name}/download | AbilityRoot | handleDownloadControlPlaneBackup |
| POST | /api/v1/system/backups/{name}/verify | AbilityRoot | handleVerifyControlPlaneBackup |
| DELETE | /api/v1/system/backups/{name} | AbilityRoot | handleDeleteControlPlaneBackup |
| GET | /api/v1/system/volumes/orphaned | AbilityRead | handleListOrphanedVolumes |
| POST | /api/v1/system/volumes/orphaned/cleanup | AbilityRoot | handleCleanupOrphanedVolumes |
| POST | /api/v1/system/master-key/rotate | AbilityRoot | handleRotateMasterKey |
| GET | /api/v1/onboarding | AbilityRead | handleGetOnboardingState |
| POST | /api/v1/onboarding/complete | AbilityWrite | handleCompleteOnboarding |
| PUT | /api/v1/onboarding/progress | AbilityRoot | handleUpdateOnboardingProgress |
| GET | /api/v1/updates | AbilityRead | handleGetUpdates |
| GET | /api/v1/system/secrets/binding | AbilityRead | handleGetSecretBinding |
| POST | /api/v1/system/secrets/rebind | AbilityRoot | handleRebindSecrets |
| GET | /api/v1/system/control-plane-dr | AbilityRead | handleGetControlPlaneDR |
| PUT | /api/v1/system/control-plane-dr/settings | AbilityWriteSensitive | handleUpdateControlPlaneDR |
| GET | /api/v1/system/control-plane-dr/backups | AbilityRead | handleListControlPlaneDRBackups |
| POST | /api/v1/system/control-plane-dr/run | AbilityWriteSensitive | handleRunControlPlaneDRBackup |
| POST | /api/v1/system/control-plane-dr/drill | AbilityWriteSensitive | handleRunControlPlaneDRDrill |
| POST | /api/v1/system/control-plane-dr/escrow | AbilityRoot | handleControlPlaneDREscrow |
| POST | /api/v1/system/control-plane-dr/escrow/ack | AbilityWriteSensitive | handleAckControlPlaneDREscrow |
| GET | /api/v1/updates/preflight | AbilityRead | handleUpdatePreflight |
| POST | /api/v1/system/containers/{name}/stop | AbilityRoot | handleStopOrphanedContainer |
| POST | /api/v1/system/containers/{name}/remove | AbilityRoot | handleRemoveOrphanedContainer |
| POST | /api/v1/system/containers/{name}/claim | AbilityWrite | handleClaimOrphanedContainer |
| GET | /api/v1/updates/settings | AbilityRoot | handleGetUpdateSettings |
| PUT | /api/v1/updates/settings | AbilityRoot | handleUpdateSettings |
| GET | /api/v1/system/orphans | AbilityRead | handleListOrphans |
| POST | /api/v1/system/orphans/reap | AbilityRoot | handleReapOrphans |
| GET | /api/v1/updates/releases | AbilityRead | handleReleaseHistory |
| GET | /api/v1/updates/rollback-plan | AbilityRoot | handleRollbackPlan |
| GET | /api/v1/updates/history | AbilityRead | handleUpgradeHistory |
| POST | /api/v1/updates/history/{id}/ack | AbilityWrite | handleAckUpgrade |
| GET | /api/v1/system/reverse-proxy | AbilityRead | handleReverseProxyGuide |
| GET | /api/v1/system/docker-guard | AbilityRead | handleGetDockerGuard |
| PUT | /api/v1/system/docker-guard | AbilityRoot | handleUpdateDockerGuard |
| GET | /api/v1/system/geoip | AbilityRead | handleGeoIPLookup |
| GET | /api/v1/system/proxy-integration | AbilityRead | handleGetProxyIntegration |
| POST | /api/v1/system/proxy-integration/setup | AbilityRoot | handleSetupProxyIntegration |
| POST | /api/v1/system/proxy-integration/apply | AbilityRoot | handleApplyProxyIntegration |
| POST | /api/v1/system/proxy-integration/verify | AbilityRoot | handleVerifyProxyIntegration |
| GET | /api/v1/system/readiness | AbilityRead | handleServerReadiness |
| GET | /api/v1/updates/self-upgrade/plan | AbilityRead | handleSelfUpgradePlan |
| GET | /api/v1/updates/self-upgrade/attempts | AbilityRead | handleSelfUpgradeAttempts |
| POST | /api/v1/updates/self-upgrade | AbilityRoot | handleSelfUpgradeStart |
| GET | /api/v1/updates/schedule | AbilityRead | handleGetUpgradeSchedule |
| POST | /api/v1/updates/schedule | AbilityRoot | handleCreateUpgradeSchedule |
| DELETE | /api/v1/updates/schedule | AbilityRoot | handleCancelUpgradeSchedule |
| GET | /api/v1/updates/auto | AbilityRoot | handleGetUpgradePolicy |
| PUT | /api/v1/updates/auto | AbilityRoot | handleUpdateUpgradePolicy |
| POST | /api/v1/updates/backup-now | AbilityRoot | handleUpgradeBackupNow |
| GET | /api/v1/system/server-address | AbilityRead | handleGetServerAddress |
| PUT | /api/v1/system/server-address | AbilityRoot | handleSetServerAddress |
| GET | /api/v1/system/restart | AbilityRead | handleGetSystemRestart |
| POST | /api/v1/system/restart | AbilityRoot | handleSystemRestart |
| GET | /api/v1/system/cli-console/commands | AbilityRoot | handleCLIConsoleCommands |
| GET | /api/v1/system/cli-console/session | AbilityRoot | handleCLIConsoleSession |

## Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth

<Accordion title="123 endpoints for authentication, two-factor auth, user management, IAM, device login, and OAuth integration">
  Endpoints for:

  * Authentication and session management
  * Two-factor authentication setup and verification
  * User and role management
  * IAM policies and attachment
  * Device login flows
  * OAuth provider configuration

  | Method | Path | Ability | Handler |
  | - | - | - | - |
  | POST | /api/v1/auth/login | Public | handleLogin |
  | POST | /api/v1/auth/register | Public (setup token) | handleRegister |
  | GET | /api/v1/auth/setup-status | Public | handleSetupStatus |
  | POST | /api/v1/auth/logout | Session | handleLogout |
  | PUT | /api/v1/auth/password | Session | handleChangePassword |
  | GET | /api/v1/auth/session | Session | handleGetSession |
  | POST | /api/v1/auth/sessions/revoke-others | Session | handleRevokeOtherSessions |
  | POST | /api/v1/auth/users | AbilityRoot | handleCreateUser |
  | GET | /api/v1/users | AbilityRead | handleListUsers |
  | DELETE | /api/v1/users/{id} | AbilityRoot | handleDeleteUser |
  | PUT | /api/v1/users/{id}/abilities | AbilityRoot | handleUpdateUserAbilities |
  | GET | /api/v1/roles | AbilityRead | handleListRoles |
  | POST | /api/v1/invites | AbilityWrite | handleCreateInvite |
  | GET | /api/v1/invites | AbilityRead | handleListInvites |
  | DELETE | /api/v1/invites/{id} | AbilityWrite | handleRevokeInvite |
  | POST | /api/v1/invites/accept | Public | handleAcceptInvite |
  | POST | /api/v1/iam/policies | AbilityRoot | handleCreatePolicy |
  | GET | /api/v1/iam/policies | AbilityRead | handleListPolicies |
  | GET | /api/v1/iam/policies/{id} | AbilityRead | handleGetPolicy |
  | PUT | /api/v1/iam/policies/{id} | AbilityRoot | handleUpdatePolicy |
  | DELETE | /api/v1/iam/policies/{id} | AbilityRoot | handleDeletePolicy |
  | GET | /api/v1/iam/policies/{id}/attachments | AbilityRead | handleListPolicyAttachments |
  | POST | /api/v1/iam/policies/{id}/attachments | AbilityRoot | handleAttachPolicy |
  | DELETE | /api/v1/iam/policies/{id}/attachments/{principal_type}/{principal_id} | AbilityRoot | handleDetachPolicy |
  | POST | /api/v1/auth/device/start | Public | handleDeviceAuthStart |
  | POST | /api/v1/auth/device/token | Public | handleDeviceAuthToken |
  | GET | /api/v1/auth/device/requests | Session | handleListDeviceAuthRequests |
  | POST | /api/v1/auth/device/{user_code}/approve | Session | handleApproveDeviceAuthRequest |
  | POST | /api/v1/auth/device/{user_code}/deny | Session | handleDenyDeviceAuthRequest |
  | GET | /api/v1/auth/oauth/providers | Public | handleListPublicOAuthProviders |
  | GET | /api/v1/auth/oauth/{provider}/start | Public | handleOAuthStart |
  | GET | /api/v1/auth/oauth/{provider}/callback | Public | handleOAuthCallback |
  | GET | /api/v1/auth/oauth/{provider}/link/start | Session | handleOAuthLinkStart |
  | GET | /api/v1/settings/oauth | AbilityRead | handleListOAuthSettings |
  | PUT | /api/v1/settings/oauth/{provider} | AbilityRoot | handleUpdateOAuthProviderSettings |
  | POST | /api/v1/auth/forgot-password | Public | handleForgotPassword |
  | POST | /api/v1/auth/reset-password | Public | handleResetPassword |
  | POST | /api/v1/auth/tokens | Session | handleCreateToken |
  | GET | /api/v1/auth/tokens | Session | handleListTokens |
  | DELETE | /api/v1/auth/tokens/{id} | Session | handleRevokeToken |
  | GET | /api/v1/settings/ai-assistant | AbilityRead | handleGetAIAssistantSettings |
  | PUT | /api/v1/settings/ai-assistant | AbilityRoot | handleUpdateAIAssistantSettings |
  | DELETE | /api/v1/settings/ai-assistant | AbilityRoot | handleDeleteAIAssistantSettings |
  | GET | /api/v1/settings/deploy-freeze | AbilityRead | handleGetGlobalDeployFreeze |
  | PUT | /api/v1/settings/deploy-freeze | AbilityRoot | handlePutGlobalDeployFreeze |
  | GET | /api/v1/settings/push-subscriptions/vapid-public-key | Session | handleGetPushVAPIDPublicKey |
  | GET | /api/v1/settings/push-subscriptions | Session | handleListPushSubscriptions |
  | POST | /api/v1/settings/push-subscriptions | Session | handleCreatePushSubscription |
  | DELETE | /api/v1/settings/push-subscriptions/{id} | Session | handleDeletePushSubscription |
  | GET | /api/v1/settings/observability | AbilityRead | handleGetObservabilitySettings |
  | PUT | /api/v1/settings/observability | AbilityRoot | handleUpdateObservabilitySettings |
  | POST | /api/v1/auth/session-links | AbilityRoot | handleMintSessionLink |
  | GET | /api/v1/auth/session-links/{token}/consume | Public | handleConsumeSessionLinkGET |
  | GET | /api/v1/auth/whoami | Public | handleWhoami |
  | POST | /api/v1/roles | AbilityRoot | handleCreateRole |
  | PUT | /api/v1/roles/{id} | AbilityRoot | handleUpdateRole |
  | DELETE | /api/v1/roles/{id} | AbilityRoot | handleDeleteRole |
  | PUT | /api/v1/users/{id}/role | AbilityRoot | handleSetUserRole |
  | GET | /api/v1/users/{id}/environment-grants | AbilityRoot | handleGetEnvironmentGrants |
  | PUT | /api/v1/users/{id}/environment-grants | AbilityRoot | handlePutEnvironmentGrants |
  | GET | /api/v1/iam/policy-templates | AbilityRead | handleListPolicyTemplates |
  | POST | /api/v1/iam/policy-templates/{id}/apply | AbilityRoot | handleApplyPolicyTemplate |
  | GET | /api/v1/settings/ai-control | AbilityRead | handleGetAIControl |
  | PUT | /api/v1/settings/ai-control | AbilityRoot | handleUpdateAIControl |
  | POST | /api/v1/settings/ai-control/revoke-agent-tokens | AbilityRoot | handleRevokeAgentTokens |
  | GET | /api/v1/auth/device/pending-summary | AbilityRead | handleDevicePendingSummary |
  | GET | /api/v1/auth/device/activity | AbilityRead | handleDeviceActivity |
  | GET | /api/v1/iam/catalog | AbilityRead | handleIAMCatalog |
  | GET | /api/v1/iam/resources | AbilityRead | handleIAMResources |
  | POST | /api/v1/iam/resources/match | AbilityRead | handleIAMMatch |
  | GET | /api/v1/iam/principals | AbilityRead | handleIAMPrincipals |
  | GET | /api/v1/iam/principals/{principal_type}/{principal_id}/effective | AbilityRead | handleIAMEffective |
  | GET | /api/v1/iam/simulate | AbilityRead | handleIAMSimulate |
  | GET | /api/v1/iam/analyze | AbilityRead | handleIAMAnalyze |
  | POST | /api/v1/iam/policies/validate | AbilityRead | handleValidatePolicy |
  | POST | /api/v1/iam/preview | AbilityRead | handleIAMPreview |
  | GET | /api/v1/iam/policies/{id}/versions | AbilityRead | handleListPolicyVersions |
  | POST | /api/v1/iam/policy-templates/{id}/render | AbilityRead | handleRenderPolicyTemplate |
  | GET | /api/v1/auth/login-options | Public | handleLoginOptions |
  | POST | /api/v1/auth/login-code/request | Public | handleRequestLoginCode |
  | POST | /api/v1/auth/login-code/redeem | Public | handleRedeemLoginCode |
  | POST | /api/v1/auth/login-approval/poll | Public | handlePollLoginApproval |
  | GET | /api/v1/auth/sign-in-requests | Public | handleListSignInRequests |
  | POST | /api/v1/auth/sign-in-requests/codes/{id}/reveal | Public | handleRevealLoginCode |
  | POST | /api/v1/auth/login-approvals/{id}/approve | Public | handleApproveLoginApproval |
  | POST | /api/v1/auth/login-approvals/{id}/deny | Public | handleDenyLoginApproval |
  | GET | /api/v1/auth/trusted-devices | Public | handleListTrustedDevices |
  | DELETE | /api/v1/auth/trusted-devices/{id} | Public | handleRevokeTrustedDevice |
  | GET | /api/v1/settings/auth/code-login | AbilityRead | handleGetCodeLoginSettings |
  | PUT | /api/v1/settings/auth/code-login | AbilityRoot | handlePutCodeLoginSettings |
  | POST | /api/v1/auth/sign-in-alert/disown | Public | handleDisownSignIn |
  | GET | /api/v1/security/posture | AbilityRead | handleSecurityPosture |
  | GET | /api/v1/security/policy | AbilityRead | handleGetSecurityPolicy |
  | PUT | /api/v1/security/policy | AbilityRoot | handlePutSecurityPolicy |
  | GET | /api/v1/security/sessions | Public | handleListSecuritySessions |
  | DELETE | /api/v1/security/sessions/{id} | Public | handleRevokeSecuritySession |
  | POST | /api/v1/security/sessions/revoke-others | Public | handleRevokeOtherSecuritySessions |
  | GET | /api/v1/security/account | Public | handleGetAccountSecurity |
  | PUT | /api/v1/security/account | Public | handlePutAccountSecurity |
  | GET | /api/v1/settings/database-upgrades | AbilityRead | handleGetPlatformUpgradePolicy |
  | PUT | /api/v1/settings/database-upgrades | AbilityRoot | handlePutPlatformUpgradePolicy |
  | GET | /api/v1/settings/domain-automation | AbilityRead | handleGetDomainAutomation |
  | PUT | /api/v1/settings/domain-automation | AbilityRoot | handleUpdateDomainAutomation |
  | PUT | /api/v1/settings/proxy-integration | AbilityRoot | handleUpdateProxyIntegrationSettings |
  | GET | /api/v1/auth/step-up | Public | handleStepUpOptions |
  | POST | /api/v1/auth/step-up | Public | handleStepUp |
  | POST | /api/v1/auth/step-up/passkey/begin | Public | handleStepUpPasskeyBegin |
  | POST | /api/v1/auth/step-up/passkey/finish | Public | handleStepUpPasskeyFinish |
  | GET | /api/v1/settings/beta-features | AbilityRead | handleListBetaFeatures |
  | PUT | /api/v1/settings/beta-features/{feature} | AbilityRoot | handleSetBetaFeature |
  | POST | /api/v1/auth/session-links/consume | Public | handleConsumeSessionLink |
  | GET | /api/v1/auth/2fa | Session | |
  | POST | /api/v1/auth/2fa/setup | Session | |
  | POST | /api/v1/auth/2fa/confirm | Session | |
  | POST | /api/v1/auth/2fa/disable | Session | |
  | POST | /api/v1/auth/2fa/recovery-codes/regenerate | Session | |
  | POST | /api/v1/auth/2fa/verify | Public | |
  | GET | /api/v1/auth/passkeys | Session | |
  | POST | /api/v1/auth/passkeys/register/begin | Session | |
  | POST | /api/v1/auth/passkeys/register/finish | Session | |
  | DELETE | /api/v1/auth/passkeys/{id} | Session | |
  | PATCH | /api/v1/auth/passkeys/{id} | Session | |
  | POST | /api/v1/auth/passkey-login/begin | Public | |
  | POST | /api/v1/auth/passkey-login/finish | Public | |
</Accordion>

## Apps CRUD / Lifecycle / Deploy

<Accordion title="171 endpoints for app management, deployment, lifecycle control, and diagnostics">
  Endpoints for:

  * Application creation, retrieval, update, and deletion
  * Deployment triggers and history
  * Application control (restart, stop, start)
  * Logs, metrics, and diagnostics
  * Build operations and deployment comparisons
  * Image and network information

  | Method | Path | Ability | Handler |
  | - | - | - | - |
  | GET | /api/v1/apps | AbilityRead | handleListApps |
  | POST | /api/v1/apps | AbilityWrite | handleCreateApp |
  | GET | /api/v1/apps/{name} | AbilityRead | handleGetApp |
  | PUT | /api/v1/apps/{name} | AbilityWrite | handleUpdateApp |
  | DELETE | /api/v1/apps/{name} | AbilityWrite | handleDeleteApp |
  | GET | /api/v1/apps/{name}/health | AbilityRead | handleGetAppHealth |
  | PUT | /api/v1/apps/{name}/health | AbilityWrite | handleSetAppHealth |
  | DELETE | /api/v1/apps/{name}/health | AbilityWrite | handleClearAppHealth |
  | GET | /api/v1/apps/{name}/group | AbilityRead | handleGetAppGroup |
  | GET | /api/v1/apps/{name}/hook-runs | AbilityRead | handleGetAppHookRuns |
  | POST | /api/v1/apps/{name}/compose | AbilityDeploy | handleDeployCompose |
  | GET | /api/v1/service-templates | AbilityRead | handleListServiceTemplates |
  | GET | /api/v1/service-templates/{id} | AbilityRead | handleGetServiceTemplate |
  | POST | /api/v1/apps/{name}/clone | AbilityWrite | handleCloneApp |
  | PUT | /api/v1/apps/{name}/node | AbilityRoot | handleSetAppNode |
  | POST | /api/v1/apps/{name}/deploys | AbilityDeploy | handleTriggerDeploy |
  | GET | /api/v1/apps/{name}/deploys | AbilityRead | handleDeployHistory |
  | POST | /api/v1/apps/{name}/restart | AbilityDeploy | handleRestartApp |
  | POST | /api/v1/apps/{name}/stop | AbilityDeploy | handleStopApp |
  | POST | /api/v1/apps/{name}/start | AbilityDeploy | handleStartApp |
  | POST | /api/v1/apps/{name}/exec | AbilityRoot | handleExecApp |
  | GET | /api/v1/apps/{name}/terminal | AbilityRoot | handleAppTerminal |
  | GET | /api/v1/apps/{name}/deploy-attempts | AbilityRead | handleListDeployAttempts |
  | GET | /api/v1/deploys/failed | AbilityRead | handleListFailedDeploys |
  | GET | /api/v1/apps/{name}/deploys/compare | AbilityRead | handleCompareDeploys |
  | GET | /api/v1/apps/{name}/promote/preview | AbilityRead | handlePromotePreview |
  | POST | /api/v1/apps/{name}/promote | AbilityDeploy | handlePromoteApp |
  | GET | /api/v1/apps/{name}/deploys/{deployId}/logs | AbilityRead | handleDeployLogStream |
  | GET | /api/v1/apps/{name}/deploys/{deployId}/logs/download | AbilityRead | handleDownloadDeployLog |
  | GET | /api/v1/apps/{name}/diagnose | AbilityRead | handleDiagnoseApp |
  | GET | /api/v1/apps/{name}/resource-recommendation | AbilityRead | handleAppResourceRecommendation |
  | POST | /api/v1/apps/{name}/builds | AbilityDeploy | handleTriggerBuild |
  | POST | /api/v1/apps/{name}/deploy-spec | AbilityDeploy | handleDeploySpec |
  | POST | /api/v1/git/branches | AbilityDeploy | handleListGitBranches |
  | GET | /api/v1/apps/{name}/images | AbilityRead | handleListImages |
  | GET | /api/v1/apps/{name}/network | AbilityRead | handleGetAppNetwork |
  | POST | /api/v1/apps/{name}/move-with-volumes | AbilityRoot | handleMoveAppWithVolumes |
  | GET | /api/v1/apps/{name}/moves | AbilityRead | handleListAppVolumeMoves |
  | GET | /api/v1/apps/{name}/moves/{id} | AbilityRead | handleGetAppVolumeMove |
  | GET | /api/v1/apps/{name}/auto-rollback | AbilityRead | handleGetAutoRollback |
  | PUT | /api/v1/apps/{name}/auto-rollback | AbilityDeploy | handleSetAutoRollback |
  | GET | /api/v1/apps/{name}/auto-rollback-slo-burn | AbilityRead | handleGetAutoRollbackSLOBurn |
  | PUT | /api/v1/apps/{name}/auto-rollback-slo-burn | AbilityDeploy | handleSetAutoRollbackSLOBurn |
  | GET | /api/v1/apps/{name}/exec-access | AbilityRead | handleGetExecAccess |
  | PUT | /api/v1/apps/{name}/exec-access | AbilityRoot | handleSetExecAccess |
  | GET | /api/v1/apps/{name}/deploys/{deployId}/steps | AbilityRead | handleDeployStepStream |
  | GET | /api/v1/apps/{name}/tags | AbilityRead | handleListAppTags |
  | POST | /api/v1/apps/{name}/tags | AbilityWrite | handleAttachAppTag |
  | DELETE | /api/v1/apps/{name}/tags/{id} | AbilityWrite | handleDetachAppTag |
  | GET | /api/v1/apps/{name}/integrations | AbilityRead | handleListAppIntegrations |
  | POST | /api/v1/apps/{name}/integrations | AbilityWriteSensitive | handleAttachAppIntegration |
  | DELETE | /api/v1/apps/{name}/integrations/{id} | AbilityWriteSensitive | handleDetachAppIntegration |
  | GET | /api/v1/apps/{name}/egress-policy | AbilityRead | handleGetAppEgressPolicy |
  | PUT | /api/v1/apps/{name}/egress-policy | AbilityWriteSensitive | handleSetAppEgressPolicy |
  | DELETE | /api/v1/apps/{name}/egress-policy | AbilityWriteSensitive | handleClearAppEgressPolicy |
  | GET | /api/v1/apps/{name}/pipelines | AbilityRead | handleListPipelines |
  | POST | /api/v1/apps/{name}/pipelines | AbilityWrite | handleCreatePipeline |
  | GET | /api/v1/apps/{name}/pipelines/{pname} | AbilityRead | handleGetPipeline |
  | PUT | /api/v1/apps/{name}/pipelines/{pname} | AbilityWrite | handleUpdatePipeline |
  | DELETE | /api/v1/apps/{name}/pipelines/{pname} | AbilityWrite | handleDeletePipeline |
  | POST | /api/v1/apps/{name}/pipelines/{pname}/runs | AbilityDeploy | handleStartPipelineRun |
  | GET | /api/v1/apps/{name}/pipeline-runs | AbilityRead | handleListPipelineRuns |
  | GET | /api/v1/apps/{name}/pipeline-runs/{id} | AbilityRead | handleGetPipelineRun |
  | GET | /api/v1/apps/{name}/pipeline-runs/{id}/logs | AbilityRead | handleListPipelineRunLogs |
  | GET | /api/v1/apps/{name}/pipeline-runs/{id}/logs/stream | AbilityRead | handleStreamPipelineRunLogs |
  | POST | /api/v1/apps/{name}/pipeline-runs/{id}/cancel | AbilityDeploy | handleCancelPipelineRun |
  | POST | /api/v1/apps/{name}/pipeline-runs/{id}/rerun | AbilityDeploy | handleRerunPipelineRun |
  | POST | /api/v1/apps/{name}/pipeline-runs/{id}/approvals/{approval} | AbilityDeploy | handleDecidePipelineApproval |
  | GET | /api/v1/apps/{name}/loadbalancer | AbilityRead | handleGetLoadBalancer |
  | PUT | /api/v1/apps/{name}/loadbalancer | AbilityWrite | handleSetLoadBalancer |
  | DELETE | /api/v1/apps/{name}/loadbalancer | AbilityWrite | handleDeleteLoadBalancer |
  | POST | /api/v1/apps/{name}/loadbalancer/import | AbilityWrite | handleImportLoadBalancer |
  | GET | /api/v1/apps/{name}/loadbalancer/status | AbilityRead | handleLoadBalancerStatus |
  | GET | /api/v1/apps/{name}/loadbalancer/export | AbilityRead | handleExportLoadBalancer |
  | POST | /api/v1/apps/{name}/pipeline-runs/{id}/hold | AbilityDeploy | handleDecidePipelineRunHold |
  | GET | /api/v1/apps/{name}/pipeline-triggers | AbilityRead | handleListPipelineTriggers |
  | GET | /api/v1/apps/{name}/pipeline-sync | AbilityRead | handleGetPipelineSync |
  | PUT | /api/v1/apps/{name}/pipeline-sync | AbilityWrite | handleSetPipelineSync |
  | POST | /api/v1/apps/{name}/pipeline-sync | AbilityWrite | handleRunPipelineSync |
  | GET | /api/v1/apps/{name}/alert-history | AbilityRead | handleListAppAlertHistory |
  | POST | /api/v1/apps/bulk | AbilityWrite | handleBulkApps |
  | GET | /api/v1/apps/{name}/clone/preview | AbilityRead | handleClonePreview |
  | GET | /api/v1/apps/{name}/deploy-freeze | AbilityRead | handleGetAppDeployFreeze |
  | PUT | /api/v1/apps/{name}/deploy-freeze | AbilityDeploy | handlePutAppDeployFreeze |
  | POST | /api/v1/apps/{name}/preflight | AbilityRead | handlePreflightApp |
  | GET | /api/v1/apps/{name}/requests | AbilityRead | handleQueryRequests |
  | GET | /api/v1/apps/{name}/loadbalancer/history | AbilityRead | handleLoadBalancerHistory |
  | POST | /api/v1/apps/{name}/loadbalancer/check | AbilityWrite | handleLoadBalancerCheck |
  | PUT | /api/v1/apps/{name}/loadbalancer/upstreams/{id} | AbilityWrite | handleSetLoadBalancerUpstream |
  | GET | /api/v1/apps/{name}/timeline | AbilityRead | handleAppTimeline |
  | GET | /api/v1/apps/{name}/pending-changes | AbilityRead | handlePendingChanges |
  | POST | /api/v1/apps/{name}/apply-pending | AbilityDeploy | handleApplyPending |
  | GET | /api/v1/apps/{name}/preview | AbilityRead | handleGetPreview |
  | PUT | /api/v1/apps/{name}/preview | AbilityWrite | handlePutPreview |
  | POST | /api/v1/apps/{name}/preview/capture | AbilityWrite | handleCapturePreview |
  | POST | /api/v1/apps/{name}/preview/prune | AbilityWrite | handlePrunePreview |
  | GET | /api/v1/apps/{name}/preview/history | AbilityRead | handleListPreviews |
  | GET | /api/v1/apps/{name}/deployments/{id}/preview | AbilityRead | handleGetPreviewImage |
  | GET | /api/v1/apps/{name}/changes | AbilityRead | handleAppChanges |
  | GET | /api/v1/apps/{name}/slo-preview | AbilityRead | handleSLOPreview |
  | GET | /api/v1/apps/{name}/supply-chain | AbilityRead | handleGetSupplyChain |
  | PUT | /api/v1/apps/{name}/supply-chain | AbilityWrite | handlePutSupplyChain |
  | POST | /api/v1/apps/{name}/supply-chain/override | AbilityWrite | handleSupplyChainOverride |
  | GET | /api/v1/apps/{name}/deployments/{id}/sbom | AbilityRead | handleGetSBOM |
  | GET | /api/v1/apps/{name}/deployments/{id}/vulnerabilities | AbilityRead | handleGetVulnerabilities |
  | POST | /api/v1/apps/{name}/deployments/{id}/scan | AbilityWrite | handleScanDeployment |
  | POST | /api/v1/apps/{name}/deploys/{deployId}/cancel | AbilityDeploy | handleCancelDeploy |
  | POST | /api/v1/apps/{name}/deploys/{deployId}/rollback | AbilityDeploy | handleRollbackToDeploy |
  | GET | /api/v1/apps/{name}/cancel-superseded | AbilityRead | handleGetCancelSuperseded |
  | PUT | /api/v1/apps/{name}/cancel-superseded | AbilityDeploy | handleSetCancelSuperseded |
  | GET | /api/v1/apps/{name}/preview-policy | AbilityRead | handleGetPreviewPolicy |
  | PUT | /api/v1/apps/{name}/preview-policy | AbilityWriteSensitive | handleSetPreviewPolicy |
  | GET | /api/v1/apps/{name}/deploys/{deployId} | AbilityRead | handleGetDeploy |
  | GET | /api/v1/apps/{name}/schedule | AbilityRead | handleGetAppSchedule |
  | PUT | /api/v1/apps/{name}/schedule | AbilityWriteSensitive | handleSetAppSchedule |
  | GET | /api/v1/apps/{name}/schedule/history | AbilityRead | handleListAppScheduleHistory |
  | POST | /api/v1/service-templates/{id}/deploy | AbilityDeploy | handleDeployServiceTemplateNow |
  | GET | /api/v1/apps/{name}/connections | AbilityRead | handleListAppConnections |
  | POST | /api/v1/apps/{name}/connections | AbilityWrite | handleCreateAppConnection |
  | DELETE | /api/v1/apps/{name}/connections/{env_var} | AbilityWrite | handleDeleteAppConnection |
  | GET | /api/v1/apps/{name}/connectable-databases | AbilityRead | handleListConnectableDatabases |
  | POST | /api/v1/apps/{name}/validate-spec | AbilityRead | handleValidateSpec |
  | GET | /api/v1/apps/{name}/health-score | AbilityRead | handleGetAppHealthScore |
  | POST | /api/v1/apps/{name}/save-as-template | AbilityWrite | handleSaveAppAsTemplate |
  | GET | /api/v1/apps/{name}/cost-estimate | AbilityRead | handleAppCostEstimate |
  | GET | /api/v1/apps/{name}/badge | AbilityRead | handleGetBadgeSettings |
  | PUT | /api/v1/apps/{name}/badge | AbilityRoot | handleSetBadgeSettings |
  | GET | /api/v1/apps/{name}/badge.svg | Public | handlePublicAppBadge |
  | GET | /api/v1/apps/{name}/deploys/{deployId}/probes | AbilityRead | handleListProbeAttempts |
  | POST | /api/v1/apps/{name}/health/discover | AbilityRead | handleDiscoverAppHealth |
  | GET | /api/v1/apps/{name}/streams | AbilityRead | handleListAppStreams |
  | POST | /api/v1/apps/{name}/streams | AbilityWriteSensitive | handleCreateAppStream |
  | DELETE | /api/v1/apps/{name}/streams/{id} | AbilityWriteSensitive | handleDeleteAppStream |
  | GET | /api/v1/apps/git-sources | AbilityRead | handleListGitSources |
  | GET | /api/v1/apps/{name}/auto-update | AbilityRead | handleGetImageAutoUpdate |
  | PUT | /api/v1/apps/{name}/auto-update | AbilityDeploy | handleSetImageAutoUpdate |
  | POST | /api/v1/apps/{name}/auto-update/check | AbilityDeploy | handleCheckImageAutoUpdate |
  | POST | /api/v1/apps/{name}/auto-update/webhook | AbilityWriteSensitive | handleRotateImageUpdateWebhook |
  | GET | /api/v1/apps/{name}/canary | AbilityRead | handleGetCanary |
  | POST | /api/v1/apps/{name}/canary | AbilityDeploy | handleStartCanary |
  | PUT | /api/v1/apps/{name}/canary | AbilityDeploy | handleSetCanaryWeight |
  | DELETE | /api/v1/apps/{name}/canary | AbilityDeploy | handleAbortCanary |
  | POST | /api/v1/apps/{name}/canary/promote | AbilityDeploy | handlePromoteCanary |
  | GET | /api/v1/apps/{name}/sleep | AbilityRead | handleGetAppSleep |
  | PUT | /api/v1/apps/{name}/sleep | AbilityDeploy | handleSetAppSleep |
  | POST | /api/v1/apps/{name}/sleep/wake | AbilityDeploy | handleWakeApp |
  | GET | /api/v1/apps/{name}/environment-domains | AbilityRead | handleGetAppEnvironmentDomains |
  | GET | /api/v1/apps/{name}/listening-ports | AbilityRead | handleAppListeningPorts |
  | GET | /api/v1/apps/{name}/compose | AbilityRead | handleGetComposeStack |
  | GET | /api/v1/apps/{name}/compose/revisions | AbilityRead | handleListComposeRevisions |
  | GET | /api/v1/apps/{name}/compose/revisions/{revision} | AbilityRead | handleGetComposeRevision |
  | POST | /api/v1/apps/{name}/compose/rollback | AbilityDeploy | handleRollbackCompose |
  | POST | /api/v1/apps/{name}/compose/redeploy | AbilityDeploy | handleRedeployCompose |
  | POST | /api/v1/service-templates/{id}/install | AbilityDeploy | handleInstallServiceTemplate |
  | DELETE | /api/v1/apps/{name}/compose | AbilityWrite | handleComposeDown |
  | POST | /api/v1/apps/{name}/move | AbilityRoot | handleStartMove |
  | GET | /api/v1/apps/{name}/placement | AbilityRead | handleGetPlacement |
  | PUT | /api/v1/apps/{name}/placement | AbilityRoot | handleSetPlacement |
  | GET | /api/v1/apps/{name}/investigate | AbilityRead | handleInvestigate |
  | GET | /api/v1/apps/{name}/failure-context | AbilityRead | handleFailureContext |
  | GET | /api/v1/apps/{name}/deploys/{deployId}/gate | AbilityRead | handleGetDeployGate |
  | GET | /api/v1/apps/{name}/deploy-safety | AbilityRead | handleGetDeploySafety |
  | PUT | /api/v1/apps/{name}/deploy-safety | AbilityDeploy | handlePutDeploySafety |
  | GET | /api/v1/apps/{name}/rollback-targets | AbilityRead | handleListRollbackTargets |
  | GET | /api/v1/apps/{name}/job-runs | AbilityRead | handleListScheduledTaskRuns |
  | POST | /api/v1/apps/{name}/env/reveal | AbilityReadSensitive | handleRevealEnv |
  | POST | /api/v1/apps/{name}/env/export | AbilityReadSensitive | handleExportEnvRevealed |
  | GET | /api/v1/apps/{name}/env/export | AbilityRead | handleExportEnvRedacted |
  | GET | /api/v1/apps/{name}/env/settings | AbilityRead | handleGetEnvSettings |
  | PUT | /api/v1/apps/{name}/env/settings | AbilityWriteSensitive | handlePutEnvSettings |
  | POST | /api/v1/apps/{name}/env/{key}/convert-to-secret | AbilityWriteSensitive | handleConvertEnvToSecret |
</Accordion>

`PUT /api/v1/apps/{name}/health` replaces only the app's health config (the body is a `ServiceHealth`: `readiness`, `liveness`, `ready_timeout`), leaving every other field alone; an empty body clears it. Probe fields and validation match [the app spec](/app-spec-reference#probe), with durations in nanoseconds.

## Secrets / Git Source / Webhooks / Preview Environments

Endpoints for:

* Encrypted secrets management and locking
* Git repository connections and configuration
* Webhook delivery history and replay
* [Preview environment](/previews) configuration and lifecycle

| Method | Path | Ability | Handler |
| - | - | - | - |
| PUT | /api/v1/apps/{name}/secrets/{key} | AbilityWriteSensitive | handleSetSecret |
| GET | /api/v1/apps/{name}/secrets | AbilityRead | handleListSecrets |
| POST | /api/v1/apps/{name}/secrets/{key}/lock | AbilityWriteSensitive | handleSetSecretLock |
| GET | /api/v1/apps/{name}/git-source | AbilityRead | handleGetGitSource |
| PUT | /api/v1/apps/{name}/git-source | AbilityWriteSensitive | handleSetGitSource |
| DELETE | /api/v1/apps/{name}/git-source | AbilityWriteSensitive | handleDeleteGitSource |
| POST | /api/v1/webhooks/github/{name} | Public | handleGitPushWebhook |
| GET | /api/v1/apps/{name}/webhook-deliveries | AbilityRead | handleListWebhookDeliveries |
| POST | /api/v1/apps/{name}/webhook-deliveries/{id}/replay | AbilityDeploy | handleReplayWebhookDelivery |
| PUT | /api/v1/apps/{name}/preview-settings | AbilityWriteSensitive | handleSetPreviewEnabled |
| GET | /api/v1/apps/{name}/previews | AbilityRead | handleListPreviewEnvironments |
| POST | /api/v1/apps/{name}/previews/{number}/teardown | AbilityDeploy | handleTeardownPreviewEnvironment |
| POST | /api/v1/previews/sweep | AbilityDeploy | handleSweepPreviewEnvironments |
| DELETE | /api/v1/apps/{name}/secrets/{key} | AbilityWriteSensitive | handleDeleteSecret |
| PUT | /api/v1/apps/{name}/git-source/deploy-settings | AbilityWriteSensitive | handleSetGitDeploySettings |
| GET | /api/v1/previews | AbilityRead | handleListAllPreviews |
| POST | /api/v1/apps/{name}/previews/{number}/approve | AbilityWriteSensitive | handleApprovePreviewEnvironment |
| POST | /api/v1/apps/{name}/git-source/rotate-webhook-secret | AbilityWriteSensitive | handleRotateGitSourceWebhookSecret |
| POST | /api/v1/webhooks/slack/interactions | Public | handleSlackInteraction |
| POST | /api/v1/webhooks/discord/interactions | Public | handleDiscordInteraction |
| PUT | /api/v1/apps/{name}/git-source/build | AbilityWriteSensitive | handleSetGitSourceBuild |
| POST | /api/v1/apps/{name}/git-source/detect | AbilityDeploy | handleDetectGitSourceBuild |
| POST | /api/v1/apps/{name}/previews/{number}/extend | AbilityDeploy | handleExtendPreviewEnvironment |
| GET | /api/v1/apps/{name}/git-source/commits | AbilityDeploy | handleListGitSourceCommits |
| POST | /api/v1/apps/{name}/secrets/{key}/reveal | AbilityReadSensitive | handleRevealSecret |

## Telemetry

Endpoints for:

* Metrics queries with filtering and aggregation
* Log retrieval, search, and live streaming
* Resource usage ranking and monitoring

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/apps/{name}/metrics | AbilityRead | handleQueryMetrics |
| GET | /api/v1/apps/{name}/logs | AbilityRead | handleQueryLogs |
| GET | /api/v1/apps/resource-usage | AbilityRead | handleAppResourceUsage |
| GET | /api/v1/apps/{name}/logs/stream | AbilityRead | handleLiveLogStream |
| GET | /api/v1/apps/{name}/logs/download | AbilityRead | handleDownloadLogs |
| GET | /api/v1/apps/{name}/logs/signatures | AbilityRead | handleLogSignatures |

## Alerts / Scheduled Tasks / Feature Flags / Notification Channels

Endpoints for:

* Alert rule creation and management
* Scheduled task configuration and execution
* [Feature flag](/feature-flags) configuration and evaluation
* Notification channel management and delivery tracking

| Method | Path | Ability | Handler |
| - | - | - | - |
| POST | /api/v1/apps/{name}/alerts | AbilityWrite | handleCreateAlertRule |
| GET | /api/v1/apps/{name}/alerts | AbilityRead | handleListAlertRules |
| PUT | /api/v1/apps/{name}/alerts/{id} | AbilityWrite | handleUpdateAlertRule |
| DELETE | /api/v1/apps/{name}/alerts/{id} | AbilityWrite | handleDeleteAlertRule |
| POST | /api/v1/apps/{name}/flags | AbilityWrite | handleCreateFeatureFlag |
| GET | /api/v1/apps/{name}/flags | AbilityRead | handleListFeatureFlags |
| GET | /api/v1/apps/{name}/flags/{id} | AbilityRead | handleGetFeatureFlag |
| PUT | /api/v1/apps/{name}/flags/{id} | AbilityWrite | handleUpdateFeatureFlag |
| DELETE | /api/v1/apps/{name}/flags/{id} | AbilityWrite | handleDeleteFeatureFlag |
| GET | /api/v1/flags/evaluate/{key} | AbilityRead | handleEvaluateFeatureFlag |
| POST | /api/v1/apps/{name}/deploy-notify-targets | AbilityWrite | handleCreateDeployNotifyTarget |
| GET | /api/v1/apps/{name}/deploy-notify-targets | AbilityRead | handleListDeployNotifyTargets |
| DELETE | /api/v1/apps/{name}/deploy-notify-targets/{id} | AbilityWrite | handleDeleteDeployNotifyTarget |
| GET | /api/v1/notification-channels | AbilityRead | handleListNotificationChannels |
| POST | /api/v1/notification-channels | AbilityWrite | handleCreateNotificationChannel |
| PUT | /api/v1/notification-channels/{id} | AbilityWrite | handleUpdateNotificationChannel |
| DELETE | /api/v1/notification-channels/{id} | AbilityWrite | handleDeleteNotificationChannel |
| POST | /api/v1/notification-channels/test | AbilityWrite | handleTestNotificationChannel |
| POST | /api/v1/notification-channels/{id}/test | AbilityWrite | handleTestExistingNotificationChannel |
| GET | /api/v1/notification-channels/{id}/deliveries | AbilityRead | handleListNotificationDeliveries |
| POST | /api/v1/prometheus/read | AbilityRead | handlePrometheusRead |
| POST | /api/v1/apps/{name}/alerts/{id}/silence | AbilityWrite | handleSilenceAlertRule |

## Databases CRUD / Engines / Resources

Endpoints for:

* Database creation, retrieval, and deletion
* Engine registry and telemetry
* Resource recommendations and node placement

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/database-engines | AbilityRead | handleListDatabaseEngines |
| GET | /api/v1/databases | AbilityRead | handleListDatabases |
| POST | /api/v1/databases | AbilityWrite | handleCreateDatabase |
| GET | /api/v1/databases/{name} | AbilityRead | handleGetDatabase |
| DELETE | /api/v1/databases/{name} | AbilityWrite | handleDeleteDatabase |
| GET | /api/v1/databases/{name}/status | AbilityRead | handleDatabaseStatus |
| GET | /api/v1/databases/{name}/metrics | AbilityRead | handleQueryDatabaseMetrics |
| GET | /api/v1/databases/{name}/logs | AbilityRead | handleQueryDatabaseLogs |
| GET | /api/v1/databases/{name}/logs/stream | AbilityRead | handleLiveDatabaseLogStream |
| GET | /api/v1/databases/{name}/resource-recommendation | AbilityRead | handleDatabaseResourceRecommendation |
| PUT | /api/v1/databases/{name}/node | AbilityRoot | handleSetDatabaseNode |
| GET | /api/v1/databases/{name}/slow-queries | AbilityRead | handleQueryDatabaseSlowQueries |
| POST | /api/v1/databases/{name}/pitr | AbilityWriteSensitive | handleEnablePITR |
| DELETE | /api/v1/databases/{name}/pitr | AbilityWriteSensitive | handleDisablePITR |
| GET | /api/v1/databases/{name}/pitr | AbilityRead | handleGetPITRStatus |
| POST | /api/v1/databases/{name}/base-backups | AbilityWriteSensitive | handleTriggerBaseBackup |
| GET | /api/v1/databases/{name}/base-backups | AbilityRead | handleListBaseBackupHistory |
| POST | /api/v1/databases/{name}/pitr-restore | AbilityRoot | handleTriggerPITRRestore |
| GET | /api/v1/databases/{name}/pitr-restores | AbilityRead | handleListPITRRestoreHistory |
| PUT | /api/v1/databases/{name}/version | AbilityWriteSensitive | handleSetDatabaseVersion |
| POST | /api/v1/databases/{name}/major-upgrade | AbilityRoot | handleMajorUpgrade |
| GET | /api/v1/databases/{name}/major-upgrades | AbilityRead | handleListMajorUpgrades |
| POST | /api/v1/databases/{name}/major-upgrades/{id}/rollback | AbilityRoot | handleRollbackMajorUpgrade |
| DELETE | /api/v1/databases/{name}/major-upgrades/{id}/snapshot | AbilityRoot | handleDiscardMajorUpgradeSnapshot |
| PUT | /api/v1/databases/{name}/environment | AbilityWrite | handleSetDatabaseEnvironment |
| GET | /api/v1/databases/{name}/schema | AbilityReadSensitive | handleGetDatabaseSchema |
| GET | /api/v1/databases/{name}/tables/{schema}/{table}/rows | AbilityReadSensitive | handleGetDatabaseTableRows |
| POST | /api/v1/databases/{name}/query | AbilityReadSensitive | handleDatabaseQuery |
| POST | /api/v1/databases/{name}/query/write | AbilityRoot | handleDatabaseQueryWrite |
| POST | /api/v1/databases/{name}/explain | AbilityReadSensitive | handleDatabaseExplain |
| GET | /api/v1/databases/{name}/keys | AbilityReadSensitive | handleScanDatabaseKeys |
| GET | /api/v1/databases/{name}/key | AbilityReadSensitive | handleGetDatabaseKey |
| GET | /api/v1/databases/{name}/query-history | AbilityReadSensitive | handleListDatabaseQueryHistory |
| DELETE | /api/v1/databases/{name}/query-history | AbilityReadSensitive | handleClearDatabaseQueryHistory |
| GET | /api/v1/databases/{name}/saved-queries | AbilityReadSensitive | handleListDatabaseSavedQueries |
| POST | /api/v1/databases/{name}/saved-queries | AbilityReadSensitive | handleSaveDatabaseQuery |
| DELETE | /api/v1/databases/{name}/saved-queries/{id} | AbilityReadSensitive | handleDeleteDatabaseSavedQuery |
| GET | /api/v1/databases/{name}/users | AbilityReadSensitive | handleListDatabaseUsers |
| POST | /api/v1/databases/{name}/users | AbilityRoot | handleCreateDatabaseUser |
| POST | /api/v1/databases/{name}/users/{role}/rotate | AbilityRoot | handleRotateDatabaseUser |
| POST | /api/v1/databases/{name}/users/{role}/disable | AbilityRoot | handleDisableDatabaseUser |
| POST | /api/v1/databases/{name}/users/{role}/enable | AbilityRoot | handleEnableDatabaseUser |
| DELETE | /api/v1/databases/{name}/users/{role} | AbilityRoot | handleDeleteDatabaseUser |
| GET | /api/v1/databases/{name}/access/temp | AbilityReadSensitive | handleListDatabaseTempCredentials |
| POST | /api/v1/databases/{name}/access/temp | AbilityRoot | handleIssueDatabaseTempCredential |
| DELETE | /api/v1/databases/{name}/access/temp/{id} | AbilityRoot | handleRevokeDatabaseTempCredential |
| GET | /api/v1/databases/{name}/access/principals | AbilityReadSensitive | handleDatabaseWhoCanAccess |
| POST | /api/v1/databases/{name}/access/grants | AbilityRoot | handleGrantDatabaseAccess |
| DELETE | /api/v1/databases/{name}/access/grants/{policy_id}/{principal_type}/{principal_id} | AbilityRoot | handleRevokeDatabaseGrant |
| GET | /api/v1/databases/{name}/network | AbilityRead | handleGetDatabaseNetwork |
| POST | /api/v1/databases/{name}/network/rules/preview | AbilityRoot | handlePreviewDatabaseRules |
| PUT | /api/v1/databases/{name}/network/rules | AbilityRoot | handleApplyDatabaseRules |
| DELETE | /api/v1/databases/{name}/network/rules | AbilityRoot | handleRemoveDatabaseRules |
| POST | /api/v1/databases/{name}/network/make-private | AbilityRoot | handleMakeDatabasePrivate |
| PUT | /api/v1/databases/{name}/network/scope | AbilityRoot | handleSetDatabaseScope |
| PUT | /api/v1/databases/{name}/network/tls | AbilityRoot | handleSetDatabaseTLS |
| GET | /api/v1/databases/{name}/tables/{schema}/{table}/structure | AbilityReadSensitive | handleGetDatabaseTableStructure |
| GET | /api/v1/databases/upgrade-summary | AbilityRead | handleDatabaseUpgradeSummary |
| GET | /api/v1/databases/{name}/upgrades | AbilityRead | handleGetDatabaseUpgrades |
| PUT | /api/v1/databases/{name}/upgrade-policy | AbilityWriteSensitive | handlePutDatabaseUpgradePolicy |
| POST | /api/v1/databases/{name}/upgrade-now | AbilityWriteSensitive | handleDatabaseUpgradeNow |
| POST | /api/v1/databases/{name}/move | AbilityRoot | handleStartMove |
| GET | /api/v1/databases/{name}/placement | AbilityRead | handleGetPlacement |
| PUT | /api/v1/databases/{name}/placement | AbilityRoot | handleSetPlacement |

## Projects / Organizations / Environments

Endpoints for:

* Project and organization management
* Environment definitions and configuration
* Environment variable and configuration inheritance
* Bulk lifecycle operations (restart, stop, start)

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/projects | AbilityRead | handleListProjects |
| POST | /api/v1/projects | AbilityWrite | handleCreateProject |
| GET | /api/v1/projects/{id} | AbilityRead | handleGetProject |
| DELETE | /api/v1/projects/{id} | AbilityWrite | handleDeleteProject |
| POST | /api/v1/projects/{id}/restart | AbilityDeploy | handleRestartProject |
| POST | /api/v1/projects/{id}/stop | AbilityDeploy | handleStopProject |
| POST | /api/v1/projects/{id}/start | AbilityDeploy | handleStartProject |
| GET | /api/v1/organizations | AbilityRead | handleListOrganizations |
| POST | /api/v1/organizations | AbilityWrite | handleCreateOrganization |
| GET | /api/v1/organizations/{id} | AbilityRead | handleGetOrganization |
| DELETE | /api/v1/organizations/{id} | AbilityWrite | handleDeleteOrganization |
| PUT | /api/v1/projects/{id}/organization | AbilityWrite | handleSetProjectOrganization |
| GET | /api/v1/organizations/{id}/env | AbilityRead | handleGetOrganizationEnv |
| PUT | /api/v1/organizations/{id}/env | AbilityWrite | handleSetOrganizationEnv |
| GET | /api/v1/projects/{id}/environments | AbilityRead | handleListEnvironments |
| POST | /api/v1/projects/{id}/environments | AbilityWrite | handleCreateEnvironment |
| PATCH | /api/v1/environments/{id} | AbilityWrite | handleUpdateEnvironment |
| DELETE | /api/v1/environments/{id} | AbilityWrite | handleDeleteEnvironment |
| PUT | /api/v1/apps/{name}/environment | AbilityWrite | handleSetAppEnvironment |
| GET | /api/v1/environments/{id}/clone/preview | AbilityRead | handleEnvironmentClonePreview |
| POST | /api/v1/environments/{id}/clone | AbilityDeploy | handleEnvironmentClone |
| GET | /api/v1/environments/{id}/env | AbilityRead | handleGetEnvironmentEnv |
| PUT | /api/v1/environments/{id}/env | AbilityWrite | handleSetEnvironmentEnv |
| GET | /api/v1/projects/{id}/env | AbilityRead | handleGetProjectEnv |
| PUT | /api/v1/projects/{id}/env | AbilityWrite | handleSetProjectEnv |
| PUT | /api/v1/apps/{name}/project | AbilityWrite | handleSetAppProject |
| PUT | /api/v1/databases/{name}/project | AbilityWrite | handleSetDatabaseProject |
| PUT | /api/v1/databases/{name}/resources | AbilityWrite | handleSetDatabaseResources |
| GET | /api/v1/organizations/{id}/env/all | AbilityRead | handleListOrganizationEnvAll |
| GET | /api/v1/organizations/{id}/env/secrets | AbilityRead | handleListOrganizationEnvSecretKeys |
| PUT | /api/v1/organizations/{id}/env/secrets/{key} | AbilityWrite | handleSetOrganizationEnvSecret |
| DELETE | /api/v1/organizations/{id}/env/secrets/{key} | AbilityWrite | handleDeleteOrganizationEnvSecret |
| GET | /api/v1/environments/{id}/env/all | AbilityRead | handleListEnvironmentEnvAll |
| GET | /api/v1/environments/{id}/env/secrets | AbilityRead | handleListEnvironmentEnvSecretKeys |
| PUT | /api/v1/environments/{id}/env/secrets/{key} | AbilityWrite | handleSetEnvironmentEnvSecret |
| DELETE | /api/v1/environments/{id}/env/secrets/{key} | AbilityWrite | handleDeleteEnvironmentEnvSecret |
| GET | /api/v1/projects/{id}/env/all | AbilityRead | handleListProjectEnvAll |
| GET | /api/v1/projects/{id}/env/secrets | AbilityRead | handleListProjectEnvSecretKeys |
| PUT | /api/v1/projects/{id}/env/secrets/{key} | AbilityWrite | handleSetProjectEnvSecret |
| DELETE | /api/v1/projects/{id}/env/secrets/{key} | AbilityWrite | handleDeleteProjectEnvSecret |
| GET | /api/v1/projects/{id}/environments/compare | AbilityRead | handleCompareEnvironmentEnv |
| GET | /api/v1/projects/{id}/topology | AbilityRead | handleGetProjectTopology |
| GET | /api/v1/environments | AbilityRead | handleListAllEnvironments |
| POST | /api/v1/environments | AbilityWrite | handleCreateGlobalEnvironment |

## Nodes

Endpoints for:

* Physical infrastructure management and monitoring
* Node health and status
* Workload assignment and placement
* Cordon, drain, and lifecycle operations
* Node-level metrics and patch status
* Agent certificate re-enrollment and revocation

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/nodes | AbilityRoot | handleListNodes |
| GET | /api/v1/nodes/{id} | AbilityRoot | handleGetNode |
| DELETE | /api/v1/nodes/{id} | AbilityRoot | handleDeleteNode |
| PUT | /api/v1/nodes/{id}/workloads | AbilityRoot | handleSetNodeWorkloads |
| POST | /api/v1/nodes/join-tokens | AbilityRoot | handleCreateNodeJoinToken |
| GET | /api/v1/nodes/{id}/health | AbilityRoot | handleGetNodeHealth |
| POST | /api/v1/nodes/{id}/cordon | AbilityRoot | handleCordonNode |
| POST | /api/v1/nodes/{id}/uncordon | AbilityRoot | handleUncordonNode |
| POST | /api/v1/nodes/{id}/drain | AbilityRoot | handleDrainNode |
| GET | /api/v1/nodes/{id}/metrics | AbilityRoot | handleQueryNodeMetrics |
| GET | /api/v1/nodes/{id}/patch-status | AbilityRoot | handleGetNodePatchStatus |
| GET | /api/v1/nodes/{id}/events | AbilityRoot | handleListNodeEvents |
| GET | /api/v1/nodes/{id}/capacity-forecast | AbilityRoot | handleNodeCapacityForecast |
| POST | /api/v1/nodes/{id}/reenroll-token | AbilityRoot | handleCreateNodeReenrollToken |
| POST | /api/v1/nodes/{id}/revoke-cert | AbilityRoot | handleRevokeNodeCert |
| POST | /api/v1/nodes/{id}/mesh/rotate-key | AbilityRoot | handleRotateNodeMeshKey |
| GET | /api/v1/nodes/resource-usage | AbilityRoot | handleFleetResourceUsage |
| POST | /api/v1/nodes/provision | AbilityRoot | handleCreateNodeProvision |
| PUT | /api/v1/nodes/{id}/region | AbilityRoot | handleSetNodeRegion |
| POST | /api/v1/nodes/ssh-provision | AbilityRoot | handleCreateSSHNodeProvision |
| POST | /api/v1/nodes/{id}/mesh/rejoin | AbilityRoot | handleRejoinNodeMesh |
| GET | /api/v1/nodes/{id}/drains | AbilityRoot | handleListNodeDrains |
| GET | /api/v1/nodes/{id}/labels | AbilityRoot | handleGetNodeLabels |
| PUT | /api/v1/nodes/{id}/labels | AbilityRoot | handleSetNodeLabels |
| POST | /api/v1/nodes/ssh-provision/preflight | AbilityRoot | handleSSHProvisionPreflight |

## Ingress / Certificates / Domains / Email / Cloudflare

<Accordion title="91 endpoints for TLS, domains, ingress control, and DNS/Vault integrations">
  Endpoints for:

  * TLS certificate lifecycle and management
  * ACME configuration and certificate validation
  * Domain routing and DNS configuration
  * Domain-level controls (basic auth, maintenance mode, redirects, custom error pages, WAF)
  * Email configuration for notifications
  * Cloudflare, Route 53, and Vault integrations
  * External secret management

  | Method | Path | Ability | Handler |
  | - | - | - | - |
  | GET | /api/v1/certificates | AbilityRead | handleListCertificates |
  | GET | /api/v1/settings/ingress | AbilityRead | handleGetIngressSettings |
  | PUT | /api/v1/settings/ingress | AbilityRoot | handleUpdateIngressSettings |
  | GET | /api/v1/settings/ingress/check | AbilityRoot | handleCheckIngressDomain |
  | GET | /api/v1/settings/dashboard-url | AbilityRead | handleGetDashboardURL |
  | PUT | /api/v1/settings/dashboard-url | AbilityRoot | handleUpdateDashboardURL |
  | GET | /api/v1/apps/{name}/domains/{domain}/check | AbilityRead | handleCheckDomain |
  | GET | /api/v1/apps/{name}/domains/{domain}/auth | AbilityRead | handleGetDomainBasicAuth |
  | PUT | /api/v1/apps/{name}/domains/{domain}/auth | AbilityRoot | handleSetDomainBasicAuth |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/auth | AbilityRoot | handleClearDomainBasicAuth |
  | GET | /api/v1/apps/{name}/domains/{domain}/maintenance | AbilityRead | handleGetDomainMaintenance |
  | PUT | /api/v1/apps/{name}/domains/{domain}/maintenance | AbilityDeploy | handleSetDomainMaintenance |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/maintenance | AbilityDeploy | handleClearDomainMaintenance |
  | GET | /api/v1/apps/{name}/domains/{domain}/redirect | AbilityRead | handleGetDomainRedirect |
  | PUT | /api/v1/apps/{name}/domains/{domain}/redirect | AbilityDeploy | handleSetDomainRedirect |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/redirect | AbilityDeploy | handleClearDomainRedirect |
  | GET | /api/v1/apps/{name}/domains/{domain}/tls-cert | AbilityRead | handleGetDomainTLSCert |
  | PUT | /api/v1/apps/{name}/domains/{domain}/tls-cert | AbilityRoot | handleSetDomainTLSCert |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/tls-cert | AbilityRoot | handleClearDomainTLSCert |
  | GET | /api/v1/apps/{name}/domains/{domain}/waf | AbilityRead | handleGetDomainWAF |
  | PUT | /api/v1/apps/{name}/domains/{domain}/waf | AbilityDeploy | handleSetDomainWAF |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/waf | AbilityDeploy | handleClearDomainWAF |
  | GET | /api/v1/apps/{name}/domains/{domain}/error-pages | AbilityRead | handleGetDomainErrorPages |
  | PUT | /api/v1/apps/{name}/domains/{domain}/error-pages | AbilityDeploy | handleSetDomainErrorPage |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/error-pages | AbilityDeploy | handleClearDomainErrorPages |
  | GET | /api/v1/settings/email | AbilityRead | handleGetEmailSettings |
  | PUT | /api/v1/settings/email | AbilityRoot | handleUpdateEmailSettings |
  | GET | /api/v1/settings/cloudflare-tunnel | AbilityRead | handleGetCloudflareTunnelSettings |
  | PUT | /api/v1/settings/cloudflare-tunnel | AbilityRoot | handleUpdateCloudflareTunnelSettings |
  | DELETE | /api/v1/settings/cloudflare-tunnel | AbilityRoot | handleDisconnectCloudflareTunnel |
  | GET | /api/v1/settings/cloudflare-dns | AbilityRead | handleGetCloudflareDNSSettings |
  | PUT | /api/v1/settings/cloudflare-dns | AbilityRoot | handleUpdateCloudflareDNSSettings |
  | DELETE | /api/v1/settings/cloudflare-dns | AbilityRoot | handleDisconnectCloudflareDNS |
  | GET | /api/v1/settings/route53-dns | AbilityRead | handleGetRoute53DNSSettings |
  | PUT | /api/v1/settings/route53-dns | AbilityRoot | handleUpdateRoute53DNSSettings |
  | DELETE | /api/v1/settings/route53-dns | AbilityRoot | handleDisconnectRoute53DNS |
  | GET | /api/v1/settings/vault | AbilityRead | handleGetVaultSettings |
  | PUT | /api/v1/settings/vault | AbilityRoot | handleUpdateVaultSettings |
  | DELETE | /api/v1/settings/vault | AbilityRoot | handleDisconnectVault |
  | PUT | /api/v1/apps/{name}/vault-env/{key} | AbilityWrite | handleSetAppVaultEnv |
  | DELETE | /api/v1/apps/{name}/vault-env/{key} | AbilityWrite | handleClearAppVaultEnv |
  | PUT | /api/v1/apps/{name}/preview-env/{key} | AbilityWrite | handleSetAppPreviewEnvOverride |
  | DELETE | /api/v1/apps/{name}/preview-env/{key} | AbilityWrite | handleClearAppPreviewEnvOverride |
  | GET | /api/v1/apps/{name}/branch-env | AbilityRead | handleListAppBranchEnv |
  | POST | /api/v1/apps/{name}/branch-env | AbilityWriteSensitive | handleSetAppBranchEnv |
  | DELETE | /api/v1/apps/{name}/branch-env/{id} | AbilityWrite | handleDeleteAppBranchEnv |
  | PATCH | /api/v1/apps/{name}/domains | AbilityWrite | handleEditAppDomains |
  | POST | /api/v1/apps/{name}/domains/{domain}/cert/renew | AbilityRoot | handleRenewDomainCertificate |
  | GET | /api/v1/apps/{name}/domains/{domain}/dns-records | AbilityRead | handleListDNSRecords |
  | POST | /api/v1/apps/{name}/domains/{domain}/dns-records | AbilityRoot | handleCreateDNSRecord |
  | PUT | /api/v1/apps/{name}/domains/{domain}/dns-records | AbilityRoot | handleUpdateDNSRecord |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/dns-records | AbilityRoot | handleDeleteDNSRecord |
  | POST | /api/v1/settings/email/test | AbilityWrite | handleTestEmail |
  | GET | /api/v1/settings/ingress/https | AbilityRead | handleGetHTTPSStatus |
  | POST | /api/v1/settings/ingress/https | AbilityRoot | handleEnableHTTPS |
  | GET | /api/v1/apps/{name}/domains/{domain}/search-visibility | AbilityRead | handleGetDomainSearchVisibility |
  | PUT | /api/v1/apps/{name}/domains/{domain}/search-visibility | AbilityDeploy | handleSetDomainSearchVisibility |
  | GET | /api/v1/apps/{name}/domains/{domain}/headers | AbilityRead | handleGetDomainPolicy |
  | PUT | /api/v1/apps/{name}/domains/{domain}/headers | AbilityDeploy | handleSetDomainPolicy |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/headers | AbilityDeploy | handleDeleteDomainPolicy |
  | GET | /api/v1/apps/{name}/domains/{domain}/forwarders | AbilityRead | handleGetDomainPolicy |
  | PUT | /api/v1/apps/{name}/domains/{domain}/forwarders | AbilityDeploy | handleSetDomainPolicy |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/forwarders | AbilityDeploy | handleDeleteDomainPolicy |
  | GET | /api/v1/apps/{name}/domains/{domain}/geo | AbilityRead | handleGetDomainPolicy |
  | PUT | /api/v1/apps/{name}/domains/{domain}/geo | AbilityDeploy | handleSetDomainPolicy |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/geo | AbilityDeploy | handleDeleteDomainPolicy |
  | GET | /api/v1/apps/{name}/domains/{domain}/cache | AbilityRead | handleGetDomainPolicy |
  | PUT | /api/v1/apps/{name}/domains/{domain}/cache | AbilityDeploy | handleSetDomainPolicy |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/cache | AbilityDeploy | handleDeleteDomainPolicy |
  | POST | /api/v1/apps/{name}/domains/{domain}/cache/purge | AbilityDeploy | handlePurgeDomainCache |
  | GET | /api/v1/apps/{name}/domains/{domain}/cache/stats | AbilityRead | handleGetDomainCacheStats |
  | GET | /api/v1/apps/{name}/domains/{domain}/policies | AbilityRead | handleGetDomainPolicies |
  | POST | /api/v1/apps/{name}/domains/{domain}/policies/preview | AbilityRead | handlePreviewDomainPolicies |
  | GET | /api/v1/apps/{name}/domains/{domain}/redirects | AbilityRead | handleGetDomainRedirects |
  | PUT | /api/v1/apps/{name}/domains/{domain}/redirects | AbilityDeploy | handleSetDomainRedirectSettings |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/redirects | AbilityDeploy | handleDeleteDomainRedirectSettings |
  | POST | /api/v1/apps/{name}/domains/{domain}/redirects/canonical | AbilityDeploy | handleSetDomainCanonical |
  | PUT | /api/v1/apps/{name}/domains/{domain}/redirects/aliases | AbilityDeploy | handleSetDomainAliases |
  | GET | /api/v1/apps/{name}/domains/{domain}/ports | AbilityRead | handleGetDomainPorts |
  | PUT | /api/v1/apps/{name}/domains/{domain}/ports/{port}/restrict | AbilityWriteSensitive | handleRestrictDomainPort |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/ports/{port}/restrict | AbilityWriteSensitive | handleUnrestrictDomainPort |
  | GET | /api/v1/apps/{name}/domains/{domain}/go-live | AbilityRead | handleGoLiveStatus |
  | POST | /api/v1/apps/{name}/domains/{domain}/go-live | AbilityRoot | handleGoLiveRun |
  | POST | /api/v1/apps/{name}/domains/go-live/plan | AbilityWrite | handleGoLivePlan |
  | POST | /api/v1/settings/ingress/apps-base-domain/backfill | AbilityRoot | handleBackfillBaseDomain |
  | POST | /api/v1/apps/{name}/domains/{domain}/doctor | AbilityRead | handleDomainDoctor |
  | GET | /api/v1/apps/{name}/domains/{domain}/auth-gate | AbilityRead | handleGetDomainAuthGate |
  | PUT | /api/v1/apps/{name}/domains/{domain}/auth-gate | AbilityRoot | handleSetDomainAuthGate |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/auth-gate | AbilityRoot | handleClearDomainAuthGate |
  | GET | /api/v1/apps/{name}/domains/{domain}/auth-gate/events | AbilityReadSensitive | handleListAuthGateEvents |
  | DELETE | /api/v1/apps/{name}/domains/{domain}/auth-gate/sessions | AbilityRoot | handleRevokeAuthGateSessions |
</Accordion>

## Static Sites / Backup Targets / Registry Credentials

Endpoints for:

* Static site configuration and visibility
* S3-compatible backup target management and testing
* External registry credentials for image pull authentication
* Domain enumeration

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/static-sites | AbilityRead | handleListStaticSites |
| GET | /api/v1/backup-targets | AbilityRead | handleListBackupTargets |
| POST | /api/v1/backup-targets | AbilityWriteSensitive | handleCreateBackupTarget |
| GET | /api/v1/backup-targets/{id} | AbilityRead | handleGetBackupTarget |
| PUT | /api/v1/backup-targets/{id} | AbilityWriteSensitive | handleUpdateBackupTarget |
| DELETE | /api/v1/backup-targets/{id} | AbilityWriteSensitive | handleDeleteBackupTarget |
| POST | /api/v1/backup-targets/{id}/test | AbilityWriteSensitive | handleTestBackupTarget |
| GET | /api/v1/registry-credentials | AbilityRead | handleListRegistryCredentials |
| POST | /api/v1/registry-credentials | AbilityWriteSensitive | handleCreateRegistryCredential |
| GET | /api/v1/registry-credentials/{id} | AbilityRead | handleGetRegistryCredential |
| PUT | /api/v1/registry-credentials/{id} | AbilityWriteSensitive | handleUpdateRegistryCredential |
| DELETE | /api/v1/registry-credentials/{id} | AbilityWriteSensitive | handleDeleteRegistryCredential |
| POST | /api/v1/registry-credentials/{id}/test | AbilityWriteSensitive | handleTestRegistryCredential |
| GET | /api/v1/registry-credentials/{id}/repositories | AbilityReadSensitive | handleListRegistryCredentialRepositories |
| GET | /api/v1/registry-credentials/{id}/tags | AbilityReadSensitive | handleListRegistryCredentialTags |
| GET | /api/v1/domains | AbilityRead | handleListDomains |
| GET | /api/v1/domains/automation/runs | AbilityRead | handleListAutomationRuns |
| POST | /api/v1/domains/automation/runs/{id}/undo | AbilityRoot | handleUndoAutomationRun |
| GET | /api/v1/domains/{domain}/activity | AbilityRead | handleDomainActivity |
| GET | /api/v1/domains/standalone | AbilityRead | handleListStandaloneDomains |
| POST | /api/v1/domains/standalone | AbilityWriteSensitive | handleCreateStandaloneDomain |
| POST | /api/v1/domains/standalone/validate | AbilityWriteSensitive | handleValidateStandaloneDomain |
| GET | /api/v1/domains/standalone/candidates | AbilityWriteSensitive | handleStandaloneCandidates |
| PUT | /api/v1/domains/standalone/{domain} | AbilityWriteSensitive | handleUpdateStandaloneDomain |
| DELETE | /api/v1/domains/standalone/{domain} | AbilityWriteSensitive | handleDeleteStandaloneDomain |

## Built-in Container Registry

Endpoints for:

* Registry configuration and management
* Image repository and tag browsing

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/settings/registry | AbilityRead | handleGetRegistrySettings |
| PUT | /api/v1/settings/registry | AbilityRoot | handleUpdateRegistrySettings |
| DELETE | /api/v1/settings/registry | AbilityRoot | handleDisableRegistry |
| GET | /api/v1/registry/repositories | AbilityRead | handleListRegistryRepositories |
| GET | /api/v1/registry/tags | AbilityRead | handleListRegistryTags |
| GET | /api/v1/dockerhub/search | AbilityRead | handleDockerHubSearch |
| GET | /api/v1/dockerhub/repositories/{namespace}/{repo}/tags | AbilityRead | handleDockerHubTags |

## Git Provider Apps

Endpoints for:

* GitHub App integration and repository browsing
* GitLab App integration and project browsing
* Bitbucket App integration and repository browsing
* OAuth flow management and provider status

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/git-providers | AbilityReadSensitive | handleListGitProviders |
| GET | /api/v1/github-app | AbilityRoot | handleGetGitHubAppStatus |
| DELETE | /api/v1/github-app | AbilityRoot | handleDisconnectGitHubApp |
| PUT | /api/v1/github-app/manual | AbilityRoot | handleConnectGitHubAppManually |
| GET | /api/v1/github-app/register/preview | AbilityRoot | handleGetGitHubAppManifestPreview |
| GET | /api/v1/github-app/register/start | AbilityRoot | handleStartGitHubAppRegistration |
| GET | /api/v1/github-app/callback | AbilityRoot | handleGitHubAppCallback |
| GET | /api/v1/github-app/installed | AbilityRoot | handleGitHubAppInstalled |
| GET | /api/v1/github-app/repos | AbilityReadSensitive | handleListGitHubAppRepos |
| GET | /api/v1/github-app/repos/{owner}/{repo}/branches | AbilityReadSensitive | handleListGitHubAppBranches |
| POST | /api/v1/github-app/repos/{owner}/{repo}/use-as-source | AbilityWriteSensitive | handleUseGitHubRepoAsSource |
| GET | /api/v1/gitlab-app | AbilityRoot | handleGetGitLabAppStatus |
| PUT | /api/v1/gitlab-app | AbilityRoot | handleConnectGitLabApp |
| DELETE | /api/v1/gitlab-app | AbilityRoot | handleDisconnectGitLabApp |
| GET | /api/v1/gitlab-app/connect | AbilityRoot | handleStartGitLabAppConnect |
| GET | /api/v1/gitlab-app/callback | AbilityRoot | handleGitLabAppCallback |
| GET | /api/v1/gitlab-app/projects | AbilityReadSensitive | handleListGitLabAppProjects |
| GET | /api/v1/gitlab-app/projects/{id}/branches | AbilityReadSensitive | handleListGitLabAppBranches |
| POST | /api/v1/gitlab-app/projects/{id}/use-as-source | AbilityWriteSensitive | handleUseGitLabProjectAsSource |
| GET | /api/v1/bitbucket-app | AbilityRoot | handleGetBitbucketAppStatus |
| PUT | /api/v1/bitbucket-app | AbilityRoot | handleConnectBitbucketApp |
| DELETE | /api/v1/bitbucket-app | AbilityRoot | handleDisconnectBitbucketApp |
| GET | /api/v1/bitbucket-app/connect | AbilityRoot | handleStartBitbucketAppConnect |
| GET | /api/v1/bitbucket-app/callback | AbilityRoot | handleBitbucketAppCallback |
| GET | /api/v1/bitbucket-app/repos | AbilityReadSensitive | handleListBitbucketAppRepos |
| GET | /api/v1/bitbucket-app/repos/{workspace}/{repoSlug}/branches | AbilityReadSensitive | handleListBitbucketAppBranches |
| POST | /api/v1/bitbucket-app/repos/{workspace}/{repoSlug}/use-as-source | AbilityWriteSensitive | handleUseBitbucketRepoAsSource |
| GET | /api/v1/github-app/installations | AbilityRoot | handleListGitHubAppInstallations |
| DELETE | /api/v1/github-app/installations/{id} | AbilityRoot | handleDeleteGitHubAppInstallation |

## Database Backups / Restore / Clone Restore

Endpoints for:

* Backup history and manual triggers
* Backup verification and scheduled retention
* Database control (stop, start, public access)
* Restore and clone-restore operations

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/backups | AbilityRead | handleListAllBackups |
| POST | /api/v1/databases/{name}/backups | AbilityWriteSensitive | handleTriggerBackup |
| GET | /api/v1/databases/{name}/backups | AbilityRead | handleListBackupHistory |
| GET | /api/v1/databases/{name}/backups/{historyId}/download | AbilityReadSensitive | handleDownloadBackup |
| POST | /api/v1/databases/{name}/backups/{historyId}/verify | AbilityWriteSensitive | handleVerifyBackup |
| GET | /api/v1/databases/{name}/backups/{historyId}/verifications | AbilityRead | handleListBackupVerifications |
| PUT | /api/v1/databases/{name}/backup-schedule | AbilityWriteSensitive | handleSetBackupSchedule |
| DELETE | /api/v1/databases/{name}/backup-schedule | AbilityWriteSensitive | handleClearBackupSchedule |
| PUT | /api/v1/databases/{name}/public-access | AbilityWriteSensitive | handleSetDatabasePublicAccess |
| DELETE | /api/v1/databases/{name}/public-access | AbilityWriteSensitive | handleClearDatabasePublicAccess |
| POST | /api/v1/databases/{name}/stop | AbilityWriteSensitive | handleStopDatabase |
| POST | /api/v1/databases/{name}/start | AbilityWriteSensitive | handleStartDatabase |
| POST | /api/v1/databases/{name}/restore | AbilityRoot | handleTriggerRestore |
| GET | /api/v1/databases/{name}/restores | AbilityRead | handleListRestoreHistory |
| POST | /api/v1/databases/{name}/restore-as-new | AbilityWriteSensitive | handleCloneRestore |
| GET | /api/v1/databases/{name}/clone-restores | AbilityRead | handleListCloneRestores |
| DELETE | /api/v1/databases/{name}/backups/{historyId} | AbilityWriteSensitive | handleDeleteBackup |
| GET | /api/v1/backups/health | AbilityRead | handleBackupHealth |
| GET | /api/v1/backups/drills | AbilityRead | handleListBackupDrills |
| GET | /api/v1/backups/drills/{id} | AbilityRead | handleGetBackupDrill |
| POST | /api/v1/backups/drills | AbilityWriteSensitive | handleStartBackupDrill |
| POST | /api/v1/backups/protection/refresh | AbilityWriteSensitive | handleRefreshBackupProtection |
| GET | /api/v1/backups/coverage | AbilityRead | handleBackupCoverage |
| POST | /api/v1/backups/protect-all | AbilityWriteSensitive | handleProtectAll |
| POST | /api/v1/backups/encryption-key/ack | AbilityWriteSensitive | handleAckBackupEncryptionKey |

## App Volume Backups / Restore

Endpoints for:

* Named volume backup history and scheduling
* Backup verification and retention management
* Volume restore operations (in-place and non-destructive clone)

| Method | Path | Ability | Handler |
| - | - | - | - |
| POST | /api/v1/apps/{name}/volumes/{volume}/backups | AbilityWriteSensitive | handleTriggerVolumeBackup |
| GET | /api/v1/apps/{name}/volumes/{volume}/backups | AbilityRead | handleListVolumeBackupHistory |
| GET | /api/v1/apps/{name}/volumes/{volume}/backups/{historyId}/download | AbilityReadSensitive | handleDownloadVolumeBackup |
| POST | /api/v1/apps/{name}/volumes/{volume}/backups/{historyId}/verify | AbilityWriteSensitive | handleVerifyVolumeBackup |
| GET | /api/v1/apps/{name}/volumes/{volume}/backups/{historyId}/verifications | AbilityRead | handleListVolumeBackupVerifications |
| GET | /api/v1/apps/{name}/volumes/{volume}/backup-schedule | AbilityRead | handleGetVolumeBackupSchedule |
| PUT | /api/v1/apps/{name}/volumes/{volume}/backup-schedule | AbilityWriteSensitive | handleSetVolumeBackupSchedule |
| DELETE | /api/v1/apps/{name}/volumes/{volume}/backup-schedule | AbilityWriteSensitive | handleClearVolumeBackupSchedule |
| POST | /api/v1/apps/{name}/volumes/{volume}/restore | AbilityRoot | handleTriggerVolumeRestore |
| GET | /api/v1/apps/{name}/volumes/{volume}/restores | AbilityRead | handleListVolumeRestoreHistory |
| POST | /api/v1/apps/{name}/volumes/{volume}/restore-as-new | AbilityWriteSensitive | handleVolumeCloneRestore |
| GET | /api/v1/apps/{name}/volumes/{volume}/clone-restores | AbilityRead | handleListVolumeCloneRestores |
| DELETE | /api/v1/apps/{name}/volumes/{volume}/backups/{historyId} | AbilityWriteSensitive | handleDeleteVolumeBackup |
| PUT | /api/v1/apps/{name}/volumes | AbilityWrite | handleSetAppVolumes |
| GET | /api/v1/apps/{name}/volumes/{volume}/backup-policy | AbilityRead | handleGetVolumeBackupPolicy |
| PUT | /api/v1/apps/{name}/volumes/{volume}/backup-policy | AbilityWriteSensitive | handleSetVolumeBackupPolicy |
| POST | /api/v1/apps/{name}/volumes/{volume}/restore-to | AbilityWriteSensitive | handleVolumeRestoreTo |

## App Storage / Database Attach

Endpoints for:

* [Object storage](/object-storage) bucket attachment and configuration
* Database connectivity for applications

| Method | Path | Ability | Handler |
| - | - | - | - |
| PUT | /api/v1/apps/{name}/storage | AbilityWriteSensitive | handleSetAppStorage |
| DELETE | /api/v1/apps/{name}/storage | AbilityWriteSensitive | handleClearAppStorage |
| PUT | /api/v1/apps/{name}/database | AbilityWrite | handleSetAppDatabase |
| DELETE | /api/v1/apps/{name}/database | AbilityWrite | handleClearAppDatabase |
| GET | /api/v1/storage-env-keys | AbilityRead | handleListStorageEnvKeys |

## Audit Log / Log Drain

Endpoints for:

* Fleet-wide audit trail and log management
* External log sink configuration per application

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/audit-log | AbilityRoot | handleListAuditLog |
| POST | /api/v1/audit-log/purge | AbilityRoot | handlePurgeAuditLog |
| GET | /api/v1/apps/{name}/log-drain | AbilityRead | handleGetAppLogDrain |
| PUT | /api/v1/apps/{name}/log-drain | AbilityWriteSensitive | handleSetAppLogDrain |
| DELETE | /api/v1/apps/{name}/log-drain | AbilityWriteSensitive | handleClearAppLogDrain |
| GET | /api/v1/audit-log/export | AbilityRoot | handleExportAuditLog |

`GET /api/v1/audit-log` accepts optional query params: `limit`, `before` (RFC3339 cursor), `path`, `method`, `client_kind` (exact match), `q` (case-insensitive substring across actor name, ability, method, path and remote address), `status=failed` (only `status_code >= 400`), and `format=csv`. All filters combine with AND and the CSV export honors them.

## AI Models / GPUs

AI model resources on GPU nodes and the GPU node snapshots they schedule against. Details: [AI models](/ai-models).

| Method | Path | Ability | Handler |
| - | - | - | - |
| GET | /api/v1/models | AbilityRead | handleListModels |
| POST | /api/v1/models | AbilityWriteSensitive | handleCreateModel |
| GET | /api/v1/models/{name} | AbilityRead | handleGetModel |
| DELETE | /api/v1/models/{name} | AbilityWrite | handleDeleteModel |
| POST | /api/v1/models/{name}/restart | AbilityWrite | handleRestartModel |
| POST | /api/v1/models/{name}/api-key | AbilityWriteSensitive | handleRotateModelAPIKey |
| PUT | /api/v1/models/{name}/hf-token | AbilityWriteSensitive | handleSetModelHFToken |
| GET | /api/v1/models/{name}/logs | AbilityRead | handleQueryModelLogs |
| GET | /api/v1/models/{name}/logs/stream | AbilityRead | handleLiveModelLogStream |
| GET | /api/v1/gpus | AbilityRead | handleListGPUNodes |
| GET | /api/v1/models/{name}/keys | AbilityRead | handleListModelKeys |
| POST | /api/v1/models/{name}/keys | AbilityWriteSensitive | handleCreateModelKey |
| DELETE | /api/v1/models/{name}/keys/{id} | AbilityWrite | handleRevokeModelKey |
| POST | /api/v1/models/{name}/keys/{id}/rotate | AbilityWriteSensitive | handleRotateModelKey |
| GET | /api/v1/models/{name}/usage | AbilityRead | handleModelUsage |
| POST | /api/v1/models/preflight | AbilityRead | handleModelPreflight |
| GET | /api/v1/models/{name}/engine-metrics | AbilityRead | handleModelEngineMetrics |
| GET | /api/v1/models/{name}/fit | AbilityRead | handleModelFit |
| POST | /api/v1/models/fit | AbilityRead | handleModelFitCheck |
| PUT | /api/v1/models/{name}/residency | AbilityWrite | handleSetModelResidency |
| POST | /api/v1/models/{name}/wake | AbilityWrite | handleWakeModel |
| POST | /api/v1/models/{name}/sleep | AbilityWrite | handleSleepModel |
| PUT | /api/v1/models/{name}/swap-group | AbilityWrite | handleSetModelSwapGroup |

## Other

Routes that do not fit an existing group.

| Method | Path | Ability | Handler |
| - | - | - | - |
| POST | /api/v1/build/detect | AbilityDeploy | handleDetectFramework |
| POST | /api/v1/pipelines/validate | AbilityRead | handleValidatePipeline |
| GET | /api/v1/pipelines/schema | AbilityRead | handlePipelineSchema |
| POST | /api/v1/tags | AbilityWrite | handleCreateTag |
| GET | /api/v1/tags | AbilityRead | handleListTags |
| DELETE | /api/v1/tags/{id} | AbilityWrite | handleDeleteTag |
| GET | /api/v1/tags/{id}/apps | AbilityRead | handleListAppsByTag |
| GET | /api/v1/integrations | AbilityRead | handleListIntegrationCatalog |
| GET | /api/v1/deploy-approvals | AbilityRead | handleListDeployApprovals |
| GET | /api/v1/deploy-approvals/{id} | AbilityRead | handleGetDeployApproval |
| POST | /api/v1/deploy-approvals/{id}/approve | AbilityDeploy | handleApproveDeployApproval |
| POST | /api/v1/deploy-approvals/{id}/reject | AbilityDeploy | handleRejectDeployApproval |
| GET | /api/v1/mesh | AbilityRoot | handleGetMeshStatus |
| GET | /api/v1/gitea-app | AbilityRoot | handleGetGiteaAppStatus |
| PUT | /api/v1/gitea-app | AbilityRoot | handleConnectGiteaApp |
| DELETE | /api/v1/gitea-app | AbilityRoot | handleDisconnectGiteaApp |
| GET | /api/v1/gitea-app/connect | AbilityRoot | handleStartGiteaAppConnect |
| GET | /api/v1/gitea-app/callback | AbilityRoot | handleGiteaAppCallback |
| GET | /api/v1/gitea-app/repos | AbilityReadSensitive | handleListGiteaAppRepos |
| GET | /api/v1/gitea-app/repos/{owner}/{repo}/branches | AbilityReadSensitive | handleListGiteaAppBranches |
| POST | /api/v1/gitea-app/repos/{owner}/{repo}/use-as-source | AbilityWriteSensitive | handleUseGiteaRepoAsSource |
| POST | /api/v1/ai/sessions | AbilityRoot | handleCreateAIChatSession |
| GET | /api/v1/ai/sessions | AbilityRoot | handleListAIChatSessions |
| GET | /api/v1/ai/sessions/{id} | AbilityRoot | handleGetAIChatSession |
| DELETE | /api/v1/ai/sessions/{id} | AbilityRoot | handleDeleteAIChatSession |
| POST | /api/v1/ai/sessions/{id}/messages | AbilityRoot | handleCreateAIChatMessage |
| POST | /api/v1/ai/sessions/{id}/confirmations/{confirmation_id} | AbilityRoot | handleResolveAIChatConfirmation |
| GET | /api/v1/storage/providers | AbilityRead | handleListStorageProviders |
| GET | /api/v1/storage/destinations | AbilityRead | handleListStorageDestinations |
| POST | /api/v1/storage/destinations | AbilityWriteSensitive | handleCreateStorageDestination |
| GET | /api/v1/storage/destinations/{id} | AbilityRead | handleGetStorageDestination |
| PUT | /api/v1/storage/destinations/{id} | AbilityWriteSensitive | handleUpdateStorageDestination |
| DELETE | /api/v1/storage/destinations/{id} | AbilityWriteSensitive | handleDeleteStorageDestination |
| POST | /api/v1/storage/destinations/{id}/test | AbilityWriteSensitive | handleTestStorageDestination |
| GET | /api/v1/log-archive/policies | AbilityRead | handleListLogArchivePolicies |
| PUT | /api/v1/log-archive/policy | AbilityWrite | handleSetLogArchivePolicy |
| DELETE | /api/v1/log-archive/policy | AbilityWrite | handleDeleteLogArchivePolicy |
| POST | /api/v1/log-archive/dump | AbilityWrite | handleLogArchiveDump |
| GET | /api/v1/log-archive/runs | AbilityRead | handleListLogArchiveRuns |
| GET | /api/v1/log-archive/objects | AbilityRead | handleListLogArchiveObjects |
| GET | /api/v1/log-archive/objects/download | AbilityRead | handleDownloadLogArchiveObject |
| GET | /api/v1/build-cache | AbilityRead | handleListBuildCache |
| PUT | /api/v1/build-cache | AbilityWrite | handleSetBuildCache |
| DELETE | /api/v1/build-cache | AbilityWrite | handleDeleteBuildCache |
| GET | /api/v1/build-cache/stats | AbilityRead | handleBuildCacheStats |
| POST | /api/v1/build-cache/clear | AbilityWrite | handleClearBuildCache |
| GET | /api/v1/pipeline-runs | AbilityRead | handleListAllPipelineRuns |
| GET | /api/v1/pipelines/summary | AbilityRead | handleGetPipelineSummary |
| GET | /api/v1/loadbalancers | AbilityRead | handleListLoadBalancers |
| GET | /api/v1/alert-silences | AbilityRead | handleListAlertSilences |
| POST | /api/v1/alert-silences | AbilityWrite | handleCreateAlertSilence |
| DELETE | /api/v1/alert-silences/{id} | AbilityWrite | handleExpireAlertSilence |
| GET | /api/v1/alert-maintenance-windows | AbilityRead | handleListMaintenanceWindows |
| POST | /api/v1/alert-maintenance-windows | AbilityWrite | handleCreateMaintenanceWindow |
| PUT | /api/v1/alert-maintenance-windows/{id} | AbilityWrite | handleUpdateMaintenanceWindow |
| DELETE | /api/v1/alert-maintenance-windows/{id} | AbilityWrite | handleDeleteMaintenanceWindow |
| GET | /api/v1/alert-history | AbilityRead | handleListAlertHistory |
| GET | /public/status | Public | handlePublicStatusHTML |
| GET | /public/status.json | Public | handlePublicStatusJSON |
| GET | /public/status.rss | Public | handlePublicStatusRSS |
| GET | /api/v1/status-page | AbilityRead | handleGetStatusPage |
| PUT | /api/v1/status-page | AbilityWrite | handlePutStatusPage |
| GET | /api/v1/status-page/preview | AbilityRead | handleStatusPagePreview |
| GET | /api/v1/status-page/components | AbilityRead | handleListStatusComponents |
| POST | /api/v1/status-page/components | AbilityWrite | handleCreateStatusComponent |
| PUT | /api/v1/status-page/components/{id} | AbilityWrite | handleUpdateStatusComponent |
| DELETE | /api/v1/status-page/components/{id} | AbilityWrite | handleDeleteStatusComponent |
| GET | /api/v1/status-page/incidents | AbilityRead | handleListStatusIncidents |
| POST | /api/v1/status-page/incidents | AbilityWrite | handleCreateStatusIncident |
| POST | /api/v1/status-page/incidents/{id}/updates | AbilityWrite | handlePostStatusIncidentUpdate |
| DELETE | /api/v1/status-page/incidents/{id} | AbilityWrite | handleDeleteStatusIncident |
| GET | /api/v1/apps-summary | AbilityRead | handleAppsSummary |
| POST | /api/v1/preflight | AbilityWrite | handlePreflightNew |
| POST | /api/v1/imports/plan | AbilityWrite | handleImportPlan |
| POST | /api/v1/apply/plan | AbilityRead | handleIaCPlan |
| POST | /api/v1/apply | AbilityWrite | handleIaCApply |
| GET | /api/v1/export | AbilityRead | handleIaCExport |
| GET | /api/v1/apply/schema | AbilityRead | handleIaCSchema |
| POST | /api/v1/imports/platform/discover | AbilityWriteSensitive | handleDiscoverPlatformImport |
| POST | /api/v1/imports/platform/apply | AbilityWriteSensitive | handleApplyPlatformImport |
| GET | /api/v1/deployments | AbilityRead | handleListDeployments |
| GET | /api/v1/deployments/summary | AbilityRead | handleDeploymentsSummary |
| GET | /api/v1/deployments/stream | AbilityRead | handleDeploymentsStream |
| GET | /api/v1/model-cache | AbilityRead | handleListModelCache |
| POST | /api/v1/model-cache/prune | AbilityRoot | handlePruneModelCache |
| POST | /api/v1/pipelines/filters | AbilityRead | handlePipelineFilters |
| GET | /api/v1/apps-metrics | AbilityRead | handleBatchAppMetrics |
| GET | /api/v1/node-providers | AbilityRoot | handleListNodeProviders |
| POST | /api/v1/node-providers | AbilityRoot | handleSetNodeProviderCredential |
| GET | /api/v1/node-providers/{provider}/regions | AbilityRoot | handleListNodeProviderRegions |
| GET | /api/v1/node-providers/{provider}/sizes | AbilityRoot | handleListNodeProviderSizes |
| GET | /api/v1/node-provisions | AbilityRoot | handleListNodeProvisions |
| GET | /api/v1/node-provisions/{id} | AbilityRoot | handleGetNodeProvision |
| GET | /.well-known/jwks.json | Public | handleOIDCJWKS |
| GET | /api/v1/pipelines/oidc | AbilityRead | handleGetPipelineOIDCInfo |
| POST | /api/v1/pipelines/oidc/rotate-key | AbilityRoot | handleRotatePipelineOIDCKey |
| GET | /api/v1/network/topology | AbilityRead | handleGetNetworkTopology |
| GET | /api/v1/ssh-node-provisions | AbilityRoot | handleListSSHNodeProvisions |
| GET | /api/v1/ssh-node-provisions/{id} | AbilityRoot | handleGetSSHNodeProvision |
| GET | /api/v1/network-shares | AbilityRead | handleListNetworkShares |
| POST | /api/v1/network-shares | AbilityWriteSensitive | handleCreateNetworkShare |
| GET | /api/v1/network-shares/{id} | AbilityRead | handleGetNetworkShare |
| PUT | /api/v1/network-shares/{id} | AbilityWriteSensitive | handleUpdateNetworkShare |
| DELETE | /api/v1/network-shares/{id} | AbilityWriteSensitive | handleDeleteNetworkShare |
| POST | /api/v1/network-shares/{id}/test | AbilityRead | handleTestNetworkShare |
| GET | /api/v1/firewall-rules | AbilityRead | handleListFirewallRules |
| POST | /api/v1/firewall-rules | AbilityWriteSensitive | handleCreateFirewallRule |
| DELETE | /api/v1/firewall-rules/{id} | AbilityWriteSensitive | handleDeleteFirewallRule |
| GET | /api/v1/openapi.json | AbilityRead | handleOpenAPISpec |
| GET | /api/v1/changelog | AbilityRead | handleGetChangelog |
| GET | /api/v1/templates/custom | AbilityRead | handleListCustomTemplates |
| DELETE | /api/v1/templates/custom/{id} | AbilityWrite | handleDeleteCustomTemplate |
| GET | /api/v1/network/proxy | AbilityRead | handleGetNetworkProxy |
| GET | /api/v1/firewall/host | AbilityRead | handleHostFirewallStatus |
| POST | /api/v1/firewall/host/enable | AbilityRoot | handleEnableHostFirewall |
| POST | /api/v1/firewall/host/disable | AbilityRoot | handleDisableHostFirewall |
| POST | /api/v1/hooks/image-update/{name}/{token} | Public | handleImageUpdateWebhook |
| GET | /api/v1/hooks/wake | Public | handleWakeHook |
| GET | /api/v1/imports/platform/databases | AbilityRead | handleListDatabaseDataCopies |
| GET | /api/v1/imports/platform/databases/{name} | AbilityRead | handleGetDatabaseDataCopy |
| POST | /api/v1/imports/platform/databases/{name}/copy | AbilityWriteSensitive | handleCopyDatabaseData |
| GET | /api/v1/migration/volumes | AbilityRead | handleVolumeGuide |
| GET | /api/v1/migration/cutover | AbilityRead | handleCutoverReport |
| GET | /api/v1/migration/cutover/verify | AbilityWriteSensitive | handleCutoverVerify |
| GET | /api/v1/ingress/connectivity | AbilityRead | handleIngressConnectivity |
| GET | /api/v1/firewall/exposure | AbilityRead | handleExposureReport |
| POST | /api/v1/firewall/exposure/preview | AbilityRoot | handleExposurePreview |
| PUT | /api/v1/firewall/exposure/restrictions/{protocol}/{port} | AbilityRoot | handleExposureRestrict |
| DELETE | /api/v1/firewall/exposure/restrictions/{protocol}/{port} | AbilityRoot | handleExposureUnrestrict |
| GET | /api/v1/attention/feed | AbilityRead | handleAttentionFeed |
| POST | /api/v1/attention/dismiss | Session | handleAttentionDismiss |
| GET | /api/v1/external-databases | AbilityRead | handleListExternalDatabases |
| POST | /api/v1/external-databases | AbilityRoot | handleCreateExternalDatabase |
| POST | /api/v1/external-databases/test | AbilityRoot | handleTestExternalDatabase |
| GET | /api/v1/external-databases/candidates | AbilityRoot | handleListExternalDatabaseCandidates |
| POST | /api/v1/external-databases/adopt | AbilityRoot | handleAdoptExternalDatabase |
| GET | /api/v1/external-databases/{name} | AbilityRead | handleGetExternalDatabase |
| PUT | /api/v1/external-databases/{name} | AbilityRoot | handleUpdateExternalDatabase |
| DELETE | /api/v1/external-databases/{name} | AbilityWrite | handleDeleteExternalDatabase |
| POST | /api/v1/external-databases/{name}/probe | AbilityWrite | handleProbeExternalDatabase |
| GET | /api/v1/external-databases/{name}/password | AbilityRoot | handleRevealExternalDatabasePassword |
| GET | /api/v1/usage/summary | AbilityRead | handleUsageSummary |
| GET | /api/v1/migration/hub/local-sources | AbilityRead | handleHubLocalSources |
| POST | /api/v1/migration/hub/sessions | AbilityWriteSensitive | handleCreateHubSession |
| GET | /api/v1/migration/hub/sessions | AbilityRead | handleListHubSessions |
| GET | /api/v1/migration/hub/sessions/{id} | AbilityRead | handleGetHubSession |
| DELETE | /api/v1/migration/hub/sessions/{id} | AbilityWriteSensitive | handleDeleteHubSession |
| PUT | /api/v1/migration/hub/sessions/{id}/selection | AbilityWriteSensitive | handlePutHubSelection |
| PUT | /api/v1/migration/hub/sessions/{id}/step | AbilityWriteSensitive | handlePutHubStep |
| POST | /api/v1/migration/hub/sessions/{id}/apply | AbilityWriteSensitive | handleApplyHubSession |
| GET | /api/v1/migration/hub/sessions/{id}/receipt | AbilityRead | handleHubReceipt |
| GET | /api/v1/migration/hub/sessions/{id}/items/{db}/connection | AbilityRead | handleHubConnection |
| POST | /api/v1/migration/hub/sessions/{id}/items/{db}/reveal | AbilityReadSensitive | handleHubReveal |
| POST | /api/v1/migration/apps/plan | AbilityWriteSensitive | handleAppImportPlan |
| POST | /api/v1/migration/apps/sessions | AbilityWriteSensitive | handleCreateAppImportSession |
| GET | /api/v1/migration/apps/sessions | AbilityRead | handleListAppImportSessions |
| GET | /api/v1/migration/apps/sessions/{id} | AbilityRead | handleGetAppImportSession |
| DELETE | /api/v1/migration/apps/sessions/{id} | AbilityWriteSensitive | handleDeleteAppImportSession |
| POST | /api/v1/migration/apps/sessions/{id}/connect | AbilityWriteSensitive | handleConnectAppImportSession |
| PUT | /api/v1/migration/apps/sessions/{id}/plan | AbilityWriteSensitive | handlePutAppImportPlan |
| POST | /api/v1/migration/apps/sessions/{id}/stage | AbilityWriteSensitive | handleStageAppImport |
| POST | /api/v1/migration/apps/sessions/{id}/verify | AbilityWriteSensitive | handleVerifyAppImport |
| POST | /api/v1/migration/apps/sessions/{id}/rollback | AbilityWriteSensitive | handleRollbackAppImport |
| GET | /api/v1/migration/apps/sessions/{id}/images | AbilityRead | handleAppImportImages |
| GET | /api/v1/migration/apps/sessions/{id}/images/status | AbilityRead | handleAppImportImagesStatus |
| POST | /api/v1/migration/apps/sessions/{id}/images/transfer | AbilityWriteSensitive | handleTransferAppImportImages |
| POST | /api/v1/migration/apps/sessions/{id}/images/cancel | AbilityWriteSensitive | handleCancelAppImportImages |
| GET | /api/v1/migration/apps/sessions/{id}/volumes | AbilityRead | handleAppImportVolumes |
| PUT | /api/v1/migration/apps/sessions/{id}/items/{item}/volumes/{vol} | AbilityWriteSensitive | handleSetAppImportVolume |
| GET | /api/v1/migration/apps/sessions/{id}/cutover | AbilityRead | handleAppImportCutover |
| GET | /api/v1/migration/apps/sessions/{id}/cutover/verify | AbilityWriteSensitive | handleAppImportCutoverVerify |
| POST | /api/v1/migration/apps/sessions/{id}/items/{item}/route | AbilityWriteSensitive | handleRouteAppImport |
| GET | /api/v1/migration/apps/sessions/{id}/receipt | AbilityRead | handleAppImportReceipt |
| GET | /api/v1/dns/zones | AbilityRead | handleListDNSZones |
| POST | /api/v1/dns/zones | AbilityRoot | handleCreateDNSZone |
| GET | /api/v1/dns/zones/{zone} | AbilityRead | handleGetDNSZone |
| DELETE | /api/v1/dns/zones/{zone} | AbilityRoot | handleDeleteDNSZone |
| GET | /api/v1/dns/zones/{zone}/nameservers | AbilityRead | handleDNSZoneNameServers |
| GET | /api/v1/dns/zones/{zone}/delegation | AbilityRead | handleDNSZoneDelegation |
| GET | /api/v1/dns/zones/{zone}/discover | AbilityRead | handleDiscoverDNSZoneRecords |
| GET | /api/v1/dns/zones/{zone}/records | AbilityRead | handleListDNSZoneRecords |
| POST | /api/v1/dns/zones/{zone}/records | AbilityRoot | handleCreateDNSZoneRecord |
| PUT | /api/v1/dns/zones/{zone}/records | AbilityRoot | handleUpdateDNSZoneRecord |
| DELETE | /api/v1/dns/zones/{zone}/records | AbilityRoot | handleDeleteDNSZoneRecord |
| POST | /api/v1/dns/zones/{zone}/records/import | AbilityRoot | handleImportDNSZoneRecords |
| GET | /api/v1/dns/zones/{zone}/records/export | AbilityRead | handleExportDNSZoneRecords |
| POST | /api/v1/dns/zones/{zone}/templates/{id} | AbilityRoot | handleApplyDNSTemplate |
| GET | /api/v1/dns/templates | AbilityRead | handleListDNSTemplates |
| GET | /api/v1/dns/check | AbilityRead | handleDNSCheck |
| GET | /api/v1/dns/health-checks | AbilityRead | handleListDNSHealthChecks |
| POST | /api/v1/dns/health-checks | AbilityRoot | handleCreateDNSHealthCheck |
| DELETE | /api/v1/dns/health-checks/{id} | AbilityRoot | handleDeleteDNSHealthCheck |
| GET | /api/v1/dns/zone | AbilityRead | handleDNSZone |
| GET | /api/v1/traffic/summary | AbilityRead | handleTrafficSummary |
| GET | /api/v1/migration/apps/sessions/{id}/items/{item}/cutover/plan | AbilityRead | handleAppImportCutoverPlan |
| GET | /api/v1/migration/apps/sessions/{id}/items/{item}/cutover/runs | AbilityRead | handleListAppImportCutoverRuns |
| POST | /api/v1/migration/apps/sessions/{id}/items/{item}/cutover/runs | AbilityWriteSensitive | handleStartAppImportCutover |
| GET | /api/v1/migration/apps/sessions/{id}/items/{item}/cutover/runs/{run} | AbilityRead | handleGetAppImportCutoverRun |
| POST | /api/v1/migration/apps/sessions/{id}/items/{item}/cutover/runs/{run}/rollback | AbilityWriteSensitive | handleRollbackAppImportCutover |
| POST | /api/v1/migration/apps/sessions/{id}/items/{item}/cutover/runs/{run}/confirm-dns | AbilityWriteSensitive | handleConfirmAppImportCutoverDNS |
| GET | /api/v1/compose | AbilityRead | handleListComposeStacks |
| POST | /api/v1/compose/preview | AbilityDeploy | handlePreviewCompose |
| GET | /api/v1/node-moves | AbilityRoot | handleListNodeMoves |
| GET | /api/v1/node-moves/{id} | AbilityRoot | handleGetNodeMove |
| GET | /api/v1/node-drains/{id} | AbilityRoot | handleGetNodeDrain |
| GET | /api/v1/mesh/connectivity | AbilityRoot | handleMeshConnectivity |
| GET | /api/v1/teams | AbilityRead | handleListTeams |
| POST | /api/v1/teams | AbilityRoot | handleCreateTeam |
| GET | /api/v1/teams/roles | AbilityRead | handleListTeamRoles |
| GET | /api/v1/teams/{id} | AbilityRead | handleGetTeam |
| PATCH | /api/v1/teams/{id} | AbilityWrite | handleRenameTeam |
| DELETE | /api/v1/teams/{id} | AbilityWrite | handleDeleteTeam |
| GET | /api/v1/teams/{id}/members | AbilityRead | handleListTeamMembers |
| PUT | /api/v1/teams/{id}/members/{user} | AbilityWrite | handleSetTeamMemberRole |
| DELETE | /api/v1/teams/{id}/members/{user} | AbilityWrite | handleRemoveTeamMember |
| DELETE | /api/v1/teams/{id}/members/me | AbilityRead | handleLeaveTeam |
| POST | /api/v1/teams/{id}/transfer | AbilityWrite | handleTransferTeam |
| GET | /api/v1/teams/{id}/events | AbilityRead | handleListTeamEvents |
| GET | /api/v1/teams/{id}/invites | AbilityRead | handleListTeamInvites |
| POST | /api/v1/teams/{id}/invites | AbilityWrite | handleCreateTeamInvite |
| DELETE | /api/v1/teams/{id}/invites/{invite} | AbilityWrite | handleRevokeTeamInvite |
| GET | /api/v1/team-invites/{token} | Session | handlePreviewTeamInvite |
| POST | /api/v1/team-invites/accept | Public | handleAcceptTeamInvite |
| GET | /metrics | AbilityRead | handleScrapeMetrics |
| GET | /api/v1/export/destinations | AbilityRoot | handleListExportDestinations |
| POST | /api/v1/export/destinations | AbilityRoot | handleCreateExportDestination |
| GET | /api/v1/export/destinations/{id} | AbilityRoot | handleGetExportDestination |
| PATCH | /api/v1/export/destinations/{id} | AbilityRoot | handleUpdateExportDestination |
| DELETE | /api/v1/export/destinations/{id} | AbilityRoot | handleDeleteExportDestination |
| POST | /api/v1/export/destinations/{id}/test | AbilityRoot | handleTestExportDestination |
| GET | /api/v1/mesh/settings | AbilityRead | handleGetMeshSettings |
| PUT | /api/v1/mesh/settings | AbilityRoot | handleUpdateMeshSettings |
| GET | /api/v1/resource-advisor/findings | AbilityRead | handleResourceAdvisorFindings |
| GET | /api/v1/resource-advisor/summary | AbilityRead | handleResourceAdvisorSummary |
| POST | /api/v1/resource-advisor/findings/{id}/apply | AbilityWrite | handleResourceAdvisorApply |
| POST | /api/v1/resource-advisor/findings/{id}/dismiss | AbilityWrite | handleResourceAdvisorState |
| POST | /api/v1/resource-advisor/findings/{id}/snooze | AbilityWrite | handleResourceAdvisorState |
| POST | /api/v1/resource-advisor/findings/{id}/restore | AbilityWrite | handleResourceAdvisorState |
| POST | /api/v1/imports/analyze | AbilityWrite | handleAnalyzeImport |
| GET | /api/v1/storage/orphans | AbilityRead | handleListStorageOrphans |
| DELETE | /api/v1/storage/orphans/{id} | AbilityWriteSensitive | handleReclaimStorageOrphan |
| GET | /api/v1/setup/guide | AbilityRead | handleGetSetupGuide |
| PUT | /api/v1/setup/guide/steps/{id} | AbilityRoot | handleSetSetupGuideStep |
| PUT | /api/v1/setup/guide/visibility | AbilityRoot | handleSetSetupGuideVisibility |
| POST | /api/v1/setup/guide/reset | AbilityRoot | handleResetSetupGuide |
| GET | /api/v1/logs/queries | AbilityRead | handleListSavedLogQueries |
| POST | /api/v1/logs/queries | AbilityWrite | handleCreateSavedLogQuery |
| PUT | /api/v1/logs/queries/{id} | AbilityWrite | handleUpdateSavedLogQuery |
| DELETE | /api/v1/logs/queries/{id} | AbilityWrite | handleDeleteSavedLogQuery |
| GET | /api/v1/usage/report | AbilityRead | handleUsageReport |
| GET | /api/v1/usage/settings | AbilityRoot | handleGetUsageSettings |
| PUT | /api/v1/usage/settings | AbilityRoot | handlePutUsageSettings |
| GET | /api/v1/usage/budgets | AbilityRead | handleListUsageBudgets |
| PUT | /api/v1/usage/budgets | AbilityWrite | handlePutUsageBudget |
| DELETE | /api/v1/usage/budgets/{id} | AbilityWrite | handleDeleteUsageBudget |
| POST | /api/v1/mobile/pairing-codes | AbilityRoot | handleCreateMobilePairing |
| POST | /api/v1/mobile/pair | Public | handleMobilePair |
| GET | /api/v1/mobile/devices | AbilityRead | handleListMobileDevices |
| DELETE | /api/v1/mobile/devices/{id} | AbilityRead | handleRevokeMobileDevice |
| GET | /api/v1/mobile/overview | AbilityRead | handleMobileOverview |
| GET | /api/v1/gate/check | Public | handleGateCheck |
| GET | /gate/login | Public | handleGateLogin |

## See also

* [Feature Catalog](/feature-catalog) - high-level overview of platform capabilities
* [Observability](/observability) - metrics, logs, alerts, and telemetry APIs
* [Architecture](/architecture) - control plane design and reconciliation patterns
* [CLI Reference](/cli-reference) - command-line tool for all API operations


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.