ProjectX Cloud Plane

The abuse queue — acted-on cases awaiting or mid-appeal

The queue an operator works (OC-TS-002): cases that took an action and are not yet resolved, across tenants. Staff-only.

One abuse case and its appeal

Appeal an abuse action

A customer’s request to review the action (`CLD-BILL-010`). The action stands until a human decides — an appeal is a review, not an automatic un-suspend. Refused on a case that took no action or whose appeal is already decided.

Body

AppealAbuse

Decide an open abuse appeal

Staff uphold the action or overturn it (`CLD-BILL-010`). Overturning reinstates the account to active and records why, so the next false positive of the same shape is a tuning signal. Staff-only.

Body

DecideAbuseAppeal

Report abuse signals and apply the graduated response

Signals become a case and the case an action — throttle, suspend or hard suspend, by the worst signal’s severity (`CLD-BILL-009`, `CLD-BILL-010`). The data plane reports the signals; the judgement is here. Every action taken is one the customer can appeal.

Body

ReportAbuse

Alert rules

Returns

AlertRuleList

Say when to wake somebody up

A rule over a metric, a check outcome or a journey outcome. `subject` names one resource, check or journey; omitted, the rule watches every one the tenant has, which is what "alert me if any machine runs hot" means. `for_runs` requires the condition to hold across that many consecutive evaluations. One bad sample is noise — a processor touching 95% for ten seconds during a deploy is not an incident — and this single parameter is most of the difference between an alerting system people keep and one they mute. Alerts fire on the transition into breach and resolve on the transition out of it, never once per evaluation. An engine that repeats gets filtered, after which the next real alert is filtered too; an engine that never resolves leaves somebody holding a pager for a problem that fixed itself. A `degraded` check or journey counts as a breach. `degraded` exists so somebody looks at it, and a rule that ignored it would make it a status nothing ever acts on. Missing data is neither a breach nor health. A metric rule on a machine whose agent has died sees no readings; calling that "below the threshold" would report the machine as healthy when the silence is *because* something is wrong. It is its own condition, and `alert_on_no_data` decides whether it pages — false by default so a new rule does not fire before an agent has ever reported.

Body

CreateAlertRule

Returns

AlertRule

Stop alerting on this

A rule that was firing is not resolved on the way out. Deleting it is somebody saying they no longer want to be told, and sending an all-clear would announce that a problem had gone away when all that went away was the question.

One alert rule

Returns

AlertRule

What this rule is firing on right now

One row per subject the rule has evaluated, with whether it is currently firing and how many consecutive evaluations the condition has held. "Is this alerting right now" is the first question anybody asks of a rule, and answering it from the alert history would mean reconstructing a state machine from a list of pages.

Returns

AlertFiring

Days whose spend does not look like the days before them

Judges each of the last `days` complete days (7 by default, 92 at most) against the fourteen days before it. `through` sets the last day judged; it defaults to yesterday, because today is a partial day and would look like a collapse against a baseline of complete ones. The baseline is a median and the scale is the median absolute deviation, so one spike does not raise the bar and hide the next. A finding also has to clear an absolute floor, since a tenant spending ten cents a day that spends thirty has tripled and nobody wants to be told. Spend falling to zero is reported too, as a distinct kind: spend rarely stops because everything was deleted, and a broken meter pipeline is invisible to every other check here because they all read the same empty stream. Each spike names what moved most, measured against its own baseline average rather than by size on the day — the biggest spender on a bad day is usually the biggest spender every day. Reading this raises no alerts. Days that cannot be judged appear in `withheld`, because "no anomaly" and "not enough history to say" are different answers.

Returns

SpendAnomalies

Autoscaling groups

Returns

AutoscalingGroupList

Stop autoscaling a group; its machines keep running

Removes the group and stops the scaling. The member machines are left running — they are ordinary instances the customer still owns, and destroying them because the automation was removed would be a data loss nobody asked for. To tear the fleet down, destroy the members.

One autoscaling group and where it stands

Returns

AutoscalingGroup

Create or change an autoscaling group

Stands up a fleet that grows and shrinks on its own to hold a utilization target. The group names what each member is (the same order a single machine takes), a `min`/`max` band, and a `target_metric` with a `target_percent` it aims to keep the busiest member near. A sweep reads utilization every couple of minutes and moves the member count one at a time when it drifts outside a deadband around the target — the group utilization is the **busiest member’s** p95, not the mean, because scaling out is meant to relieve the machine that is struggling and a mean hides it. `desired` may be pinned, and is otherwise clamped into the band; a group starts at `min` and scales from there. Members are ordinary machines tagged with the group name, so one deleted by hand is simply re-provisioned to reach `desired`. One group per name, so this replaces any existing one.

Body

CreateAutoscalingGroup

Returns

AutoscalingGroup

Backup policies

Returns

BackupPolicyList

Stop backing up a volume

Removes the policy and stops the scheduling. The copies already taken keep and stay restorable — deleting the automation is not a decision to throw away a year of history.

A volume’s backup policy and its verification status

Returns

BackupPolicy

Set a volume’s backup policy

A sweep takes a daily copy, keeps grandfather-father-son retention across daily/weekly/monthly tiers, optionally keeps a copy on a second provider and moves old copies to cold archive, and periodically test-restores the newest copy — because a backup nobody has restored is a hope. One policy per volume; this replaces any existing one.

Body

SetBackupPolicy

Returns

BackupPolicy

The copies a volume’s backup policy has taken

Returns

BackupList

Pause or resume a company’s machines for an empty credit balance

Pay as you go: when a company’s credit balance stays empty past the grace period, the platform’s balance sweep holds its compute — every running machine is stopped and marked held, keeping its disks, data and addresses — and releases it when credits arrive, starting exactly the machines it stopped. A held machine cannot be started by hand or by a power schedule until then. Platform tenant only.

Body

BillingHold

Blueprints

Returns

BlueprintList

Create a blueprint

Creates a reusable, parameterised template (`CLD-ORCH-004`): declared parameters and resource templates that reference them with `${param}`. A resource may pin a provider for a cross-provider stack (`CLD-ORCH-005`), or leave it to placement.

Body

CreateBlueprint

Returns

Blueprint

Delete a blueprint

Refused while a stack still uses it — delete the stack first.

One blueprint

Returns

Blueprint

Object storage buckets

Returns

BucketList

Create an object storage bucket

Creates a bucket in a ProjectX region and hands back a ProjectX endpoint to address it. Which upstream holds the bytes is chosen by the region and is not part of the request or the response (ADR-009). The endpoint names a ProjectX region, never an upstream one, which is what makes "one S3 endpoint fronting any provider" true: an SDK configured against it does not change when the provider behind the region does.

Body

CreateBucket

Returns

Bucket

Delete a bucket and its contents

Deletes the bucket at the provider first, then removes the record. Everything in the bucket is gone. Refused if the provider cannot be reached: removing the record without the upstream would leave a store nobody is tracking.

One bucket and its ProjectX endpoint

Returns

Bucket

Access keys issued for a bucket

Returns

AccessKeyList

Issue an S3 access key for a bucket

Issues a key pair scoped to this bucket, for a ProjectX principal. The secret is in this response exactly once and never again — store it, because retrieving it later is impossible by design; losing it means deleting the key and issuing another. The key addresses the bucket through its ProjectX endpoint and names no upstream.

Body

CreateAccessKey

Returns

AccessKeyIssued

Revoke an S3 access key

Revokes the key at the provider and destroys its secret. The record survives with state `revoked`, because "this key was revoked on Tuesday" is a question somebody asks. Whatever was using the key stops working, which is the point.

Set a bucket’s versioning, lifecycle, CORS and public access

Applies the whole configuration, not a patch: a field omitted keeps its current value. Versioning retains overwritten and deleted object versions; lifecycle rules expire or tier objects by age; CORS rules say which browser origins may call the bucket; public access serves objects to anonymous readers and is false unless explicitly set. The configuration is applied at the provider before the record is updated, so a change the provider rejects never lands claiming to be in force.

Body

ConfigureBucket

Returns

Bucket

Spending limits and where they stand

Each budget is returned with its current evaluation: spend so far, percentage used, and a forecast to period end. The forecast is withheld early in a period rather than guessed, because projecting a month from a few hours produces a confident number that is wrong.

Returns

BudgetList

Set a spending limit

A budget with `enforcement: block` refuses new provisioning once spend has actually passed the limit. It never refuses on a forecast: a projection is wrong, and declining real work for an imagined reason is worse than telling somebody so they can decide. `alert_at_percent` thresholds fire once each per period, on crossing.

Body

CreateBudget

Returns

Budget

Remove a spending limit

Deleting a `block` budget lets provisioning resume, which is the point of being able to delete it. A budget that was never there is a 404 rather than a silent success, so a mistyped name is reported instead of reassured.

One spending limit and where it stands

Returns

Budget

Apply an action to many resources at once

Applies one action to many resources in a single, rate-limit-aware call. The request is bounded so a runaway operation is refused at the boundary rather than throttled halfway; each target is attempted independently and its outcome recorded, so one failure does not abort the rest. Targets in another tenant are skipped, never actioned.

Body

BulkOperation

Returns

BulkOperationResult

When machines run out of headroom, from their own history

A forecast per running machine and metric, over `cpu.utilization`, `memory.utilization` and `disk.utilization` — the three that have a ceiling to run out of. The others are refused rather than projected against a denominator this platform would have to invent. Reads ninety days by default rather than the month every other report uses. A quarter projected from three weeks is a number somebody approves a purchase against, so the window is the shortest one that makes a quarterly plan worth writing down. History is bucketed to one point per day and each point is that day’s p95. Fitting a line through raw samples would let a day that reported every ten seconds outweigh the thirty before it that reported hourly, and a mean would hide the nightly batch that is the whole question. The regression runs on dates rather than positions, so a fortnight missing from the middle stays a gap instead of being compressed into a slope several times too steep. **It refuses to answer more often than it answers, on purpose.** A date here gets hardware ordered. Fewer than seven days of readings, a straight line that accounts for less than half the variation, or a newest reading more than three days old all produce an entry in `unforecast` with the reason instead of a date. The noise case is the one worth naming: a machine swinging between 10% and 90% yields a perfectly good slope that means nothing, and projecting from it is how somebody buys capacity they did not need. A flat or falling series gets no date at all — not a very large number, not a date in the past — and says why in `no_exhaustion`. A machine already over the ceiling reports zero days rather than a negative count: it is not going to run out, it has. `fit`, `days` and `samples` travel with every forecast. The date is what gets acted on, so the evidence for it has to be on the same row.

Returns

CapacityPlan

The platform’s sellable inventory per region and class

Capacity pools (`CLD-MKT-013`): what the platform can sell of each machine class in each region — a total, a headroom buffer held back unsold, per-provider upstream quotas, and derived availability and utilization. Staff-only: the per-provider quotas name the upstreams and how the account is spread across them, which is the supply chain. This is what lets an order be refused cleanly at the door rather than fail mid-provision, and what a low-capacity alert watches.

Returns

CapacityPoolList

Remove a capacity pool

Stops managing capacity for a class in a region (`CLD-MKT-013`). The class falls back to the placement resolver’s own judgement, as it did before the pool existed — unmanaged is not the same as unavailable.

Set the capacity pool for a region and class

Records what the platform can sell of a machine class in a region (`CLD-MKT-013`): a total, a headroom buffer held back unsold, and per-provider upstream quotas that say where the capacity physically is and in what order allocation fills it (`CLD-MKT-014`). Staff-only. Headroom larger than the total, or provider quotas summing past it, is refused as a misconfiguration.

Body

SetCapacityPool

Returns

CapacityPool

What this workspace can order, and where

ProjectX machine classes and ProjectX regions. Which upstream serves a given combination is ProjectX’s commercial structure and is not part of this answer, in any cloud_mode (ADR-009). Availability is derived from the placement resolver, so a class listed here can actually be ordered.

Returns

CloudCatalog

CDN distributions

Returns

CdnList

Create a CDN distribution

Creates a CDN distribution that caches an origin at the edge (`CLD-NET-010`), served by the CDN you choose — Cloudflare, Akamai, Bunny or provider-native. The reply carries a ProjectX endpoint, so switching CDN does not change the address customers use.

Body

CreateCdn

Returns

Cdn

Delete a CDN distribution

One CDN distribution

Returns

Cdn

Certificates

Returns

CertificateList

Issue a certificate

Issues a TLS certificate for one or more domains (`CLD-NET-011`), via ACME (Let’s Encrypt and the like) or a commercial CA, renewed automatically before expiry unless you opt out. The private key is vaulted and never returned.

Body

IssueCertificate

Returns

Certificate

Delete a certificate

One certificate

Returns

Certificate

Renew a certificate now

Renews the certificate immediately, recording the new expiry (`CLD-NET-011`). Normally automatic; this forces it early.

Returns

Certificate

Agentless checks

Returns

CheckList

Watch something from the outside

A `ping`, `port`, `http`, `ssl` or `dns` check against an endpoint you name. Checks run from ProjectX’s network rather than yours, so private, loopback, link-local and carrier-private targets are refused — a probe of `169.254.169.254` from our network would reach the endpoint that serves *our* instance credentials, not your service. For the same reason an `http` target must use http or https and must not carry a username or password, since a credential in a URL ends up in logs and audit entries. That refusal is checked again by the prober against the address it actually connected to, after resolution and after any redirect: a permitted hostname that resolves somewhere forbidden produces a refused result rather than a healthy one. `ssl` reports `degraded` rather than `down` while a certificate is close to expiry. A certificate with nine days left is serving traffic perfectly; paging somebody at 3am about it is wrong, and calling it healthy tells them nothing until the morning it breaks.

Body

CreateCheck

Returns

Check

Stop watching

The check and its results go together; nothing else references them.

One check

Returns

Check

Recent outcomes, newest first

The recent history only. A check every thirty seconds is 2,880 results a day, and the long view belongs with the metrics in the lakehouse rather than beside the configuration.

Returns

CheckResultList

Run a check now

For confirming a check works after creating it, rather than waiting for its interval. A prober failure becomes a `down` result rather than an error: a monitoring system whose own failures are invisible reports everything as healthy while it is broken.

Returns

CheckResult

Fleet view across clusters

A cross-cluster rollup (`CLD-K8S-007`): each cluster summarised — region, version, state, mode and total node count — for an operator scanning many at once.

Returns

ClusterFleet

Kubernetes clusters

Returns

ClusterList

Create a Kubernetes cluster

Provisions a Kubernetes cluster in a ProjectX region (`CLD-K8S-001`, `-002`), managed on an upstream service or self-managed on ProjectX metal — the mode is chosen, which upstream backs a managed control plane is not (ADR-009). The reply carries a ProjectX API-server endpoint; add node pools with the node-pools endpoint.

Body

CreateCluster

Returns

Cluster

Delete a Kubernetes cluster

Deletes the cluster at the provider first, then the record.

One Kubernetes cluster

Returns

Cluster

Set the cluster’s add-ons

Sets which managed add-ons are installed from the curated catalogue (`CLD-K8S-005`): ingress, cert-manager, CSI, monitoring, service mesh, GitOps. The whole set is applied, not a patch.

Body

ConfigureAddons

Returns

Cluster

Generate a short-lived kubeconfig

Mints a kubeconfig from your ProjectX identity (`CLD-K8S-006`), bound to the calling principal and short-lived — no static token is ever stored, so a leaked kubeconfig stops working rather than granting standing access. The credential is returned once.

Returns

Kubeconfig

Set the cluster’s node pools

Sets a cluster’s node pools (`CLD-K8S-003`): size, count, autoscaling bounds and taints. The whole set is applied, not a patch. An autoscaling pool whose count falls outside its own min/max is refused.

Body

ConfigureCluster

Returns

Cluster

Drain a node pool

Cordons a node pool and reschedules its work before it shrinks or is removed (`CLD-K8S-003`), so pods move rather than die.

Returns

Cluster

Roll back the last cluster upgrade

Rolls the control plane back to the version it was upgraded from (`CLD-K8S-004`). Refused when there is no upgrade to roll back.

Returns

Cluster

Upgrade the cluster version

Upgrades the control plane one minor version forward (`CLD-K8S-004`), recording where it came from so it can be rolled back. Skipping versions or going backwards is refused.

Body

UpgradeCluster

Returns

Cluster

Workload inventory

Lists the workloads running on the cluster (`CLD-K8S-008`): deployments, statefulsets and the like, with ready-over-desired replicas. Read live from the cluster.

Returns

WorkloadList

Reserved-commitment recommendations from steady-state spend

Which steadily-running resources are worth buying ahead on a reserved or savings-plan commitment (`CLD-FIN-008`). A candidate has to have run for most of the window — a variable workload committed to a year is a year of paying for hours it does not use — and to have cost something, since there is no on-demand spend to beat otherwise. The saving is the window spend projected to the term and discounted, and the discount is a *stated assumption* rather than a real reserved rate: the platform holds no reserved rate card, so `assumed_discount_percent` travels on every row for somebody to check before they approve a year-long purchase against it. The projection is the resource’s own observed spend carried forward, not a forecast about prices. `undecided` is part of the answer: a resource with no recommendation is explained — too little history, too variable, or nothing charged — rather than read as "already optimal". This recommends; it buys nothing.

Returns

CommitmentAdvice

Record a console session’s lifecycle

The relay’s second endpoint, and the reason a console session is more than its handshake in the audit trail: the relay reports a session opened when the upstream dial succeeds and closed when either side ends it, so the record shows the console’s duration rather than only its ticket. `cloud:console:record` sits in no seeded role beside the relay’s own, the ticket must already be redeemed — a session on an unexchanged ticket is a report about nothing — and `x-projectx-on-behalf-of` must name the principal the ticket was issued to, exactly as at redemption. The envelope is written by the shared middleware, which is the only writer: a relay that sealed its own events would be a second writer on the tenant’s chain.

Body

ConsoleSessionRecord

Returns

ConsoleSessionReceipt

Exchange a console ticket for the upstream endpoint

The relay’s endpoint, not a customer’s. `cloud:console:redeem` sits in no seeded role: it is meant for the console relay’s service principal and nobody else, so a customer who guessed a ticket id still cannot turn it into an endpoint. Single use — a second redemption answers 409, which is the signal that somebody forwarded a ticket. `x-projectx-on-behalf-of` must name the principal the ticket was issued to, so a relay cannot exchange one customer’s ticket while claiming to act for another.

Returns

ConsoleGrant

How far behind each provider’s cost data is

Cost data must be no more than six hours behind the provider it came from (`CLD-FIN-013`). This says, per provider, how far behind the newest usage held from it is, and whether that is within the SLO. Freshness is per provider rather than one number because the sources ingest independently: one upstream’s billing export can stall while the rest stay current, and a single tenant-wide “fresh” would hide exactly the source that has gone quiet — the one a cost view built without it would be silently too low from. Measured over the last day, against the platform clock. A customer sees an anonymous label per source ordered worst-first — whether their data is fresh is their answer, but which upstream is behind is not their concern (ADR-009); staff and `byo` see the provider handle, because they chase the stalled export. `all_fresh` is the one-line answer and `stale` is the actionable subset.

Returns

CostFreshness

What usage cost over a period

Rated from the meter stream at the wholesale rate in effect when each hour of usage happened, not at today’s rate. `from` and `to` bound the period; `to` is exclusive so adjacent periods never double-count a boundary hour. `by` breaks the same period down by `project`, `workspace`, `substrate`, `meter`, `resource`, or `tag:<name>` for allocation dimensions an organisation invented for itself. A customer sees what they are charged; staff also see what it cost us and what we made, because those two numbers side by side are our supplier terms and our margin. Usage that could not be priced is reported as a count rather than dropped, since a total that silently omits it is quietly too low.

Returns

CostView

What each cost centre spent, for showback or chargeback

One statement per cost centre per currency for the period, defaulting to the month in progress. `mode=showback` is informational and may be incomplete: usage nobody tagged sits in `unassigned` for somebody to follow up. `mode=chargeback` is a complete partition of the invoice, and is only usable when `refusals` is empty — every minor unit has to land on exactly one centre, because a chargeback that does not add up looks authoritative, gets loaded into a finance system, and surfaces a quarter later as a variance nobody can trace. Nothing is apportioned. Shared cost is not spread by headcount or usage share, because every such rule has a loser and choosing one would be taking sides in the tenant’s budget argument. Untagged spend is assigned whole to the centre that declares it absorbs it. `totals` compares what the statements charge with what the invoice says, per currency. They should always agree; the comparison is there so that the day a line is counted twice, this is what says so.

Returns

Chargeback

Cost centres

Returns

CostCentreList

Declare a cost centre

`code` is the tenant’s own code — the one their identity provider already sends for people as SCIM’s enterprise `costCenter` — and usage is joined to a centre by the `cost_centre` tag carrying that value. A centre names an owner and a display name for a code the customer maintains; it does not invent the code. At most one centre may set `absorbs_unassigned`. Two absorbers would each take the whole remainder and the statements would total more than the invoice. Which team pays for untagged spend is the tenant’s decision, so a second one is refused rather than resolved by a tiebreak.

Body

CreateCostCentre

Returns

CostCentre

Delete a cost centre

Statements are computed on demand and not stored, so nothing is orphaned. Usage still tagged with this code becomes an unknown code on the next allocation and is reported as one, rather than quietly joining the unassigned bucket — the two need different fixes.

One cost centre

Returns

CostCentre

Credential records

Records only. The material never leaves the vault, and a record carries a fingerprint instead so that two keys can be compared without either being seen.

Store a provider credential

The material goes to the vault and the response never echoes it. A workspace-scoped credential is what a BYO workspace provisions with; a platform-scoped one is ProjectX’s partner key.

Body

CreateCredential

Revoke a credential and destroy its material

The record survives, because “this key was revoked on Tuesday” is a question somebody will ask and a deleted row cannot answer it.

Reveal a credential’s material under a break-glass grant

The one route in this service that returns secret material, and the narrowest. It requires `x-projectx-grant-id` naming the break-glass grant it is attributed to, because a reveal nobody can review afterwards is a reveal with no control on it. The material is returned once and is never present in a list or a read, never written to the audit entry — which carries the fingerprint instead — and never cached. A revoked credential cannot be revealed: its material is already destroyed.

Replace the material, keep the record

The vault path does not change, so nothing holding a reference has to be updated. The fingerprint does, which is how an operator confirms the rotation took.

Body

RotateCredential

Test a provider credential against the provider (D5)

Opens a session with the provider in a region it serves and runs the cheapest read the driver has. The reply says whether the key was accepted and the provider reachable, and names the fault in ProjectX terms if not — a rejected key, a rate limit, an unreachable region — so the operator vault can show why a key is failing rather than only that it is.

Health, utilization and spend, grouped one way

A read-only rollup over things that already have a system of record: instances, the cost view, metric summaries and alert state. Nothing is stored, so there is no stale copy to reconcile. `by` is `resource`, `project` or `provider`. `provider` needs an audience that sees upstream names — a ProjectX Cloud customer is refused rather than being silently regrouped, because a dashboard that quietly answered a different question than the one asked is worse than one that says no. `health` is the worst verdict among a row’s members, never an average: averaging is how a dashboard shows green while a tenth of the fleet is down. `unknown` is a real state and ranks below `degraded` — a machine with no readings has not been judged, and reporting it as `up` would be a console claiming everything is fine because it is looking at nothing. `health_counts` breaks the one word down so a row with one gap in it is navigable rather than just vague. Utilization figures are the highest member p95, not the mean of them. Nine idle machines would otherwise hide the one that is saturated, which is the one somebody opened this page about. A row that reported nothing has no `utilization` key at all rather than zeroes. Checks and journeys are listed in `synthetics` rather than inside the rows. A check records a target and no resource, deliberately — it probes from outside — so attributing one to a resource would mean guessing, and the guess is wrong exactly when it matters: a shared load balancer, a CDN name, a target that moved. `unrated_usage` counts usage in the window that could not be priced. It is here because a cost figure assembled from partly unpriceable usage is too low, and too low is the direction nobody investigates.

Returns

Dashboard

Managed databases

Returns

DatabaseList

Create a managed database

Provisions a managed database engine in a ProjectX region (`CLD-DB-001`…`-005`). The engine, version, size class and HA topology are chosen; the reply carries a ProjectX connection endpoint derived from the region, never the upstream’s own host, so an application’s connection string names no supplier (ADR-009).

Body

CreateDatabase

Returns

Database

Delete a managed database

Deletes the database at the provider first, then the record. Everything in the database is gone — this is destructive and audited as such.

One managed database

Returns

Database

Set the backup retention window

Sets how many days of continuous backup the database keeps for point-in-time recovery (`CLD-DB-007`). Zero turns automated backup off — the right choice for a cache, the wrong one for a system of record.

Body

ConfigureBackup

Returns

Database

Fail over to the standby

Promotes the standby to primary (`CLD-DB-006`). Refused unless there is a standby and the database is otherwise idle. The ProjectX endpoint keeps working while the node behind it changes.

Returns

Database

Turn automatic failover on or off

Sets whether the platform promotes a standby automatically when the primary fails (`CLD-DB-006`). Turning it on needs a standby to fail over to, so it is refused on a database with no replicas.

Body

ConfigureFailover

Returns

Database

Run an on-demand failover drill

Exercises the failover path without a real outage (`CLD-DB-012`): the standby is promoted, checked and demoted again, and the result — pass or fail, and how long the promotion took — is recorded on the database as evidence an SLA review or an audit wants.

Returns

Database

Live database health

Reads the database’s live health (`CLD-DB-011`): open connections against the limit, query throughput and the slowest recent query, and how far a replica trails the primary. Computed on demand, never stored.

Returns

DatabaseMonitoring

Set engine parameters

Sets the engine parameter overrides on a database (`CLD-DB-009`). The map is the whole set, not a patch — sending an empty map clears back to engine defaults. The engine validates the values and rejects an impossible one.

Body

SetDatabaseParameters

Returns

Database

Configure the connection pooler

Turns the connection pooler on or off (`CLD-DB-010`). A pooler multiplexes many client connections onto a few engine connections, so a fleet of app servers does not exhaust the engine’s connection limit. When on, it answers on its own ProjectX endpoint.

Body

ConfigurePool

Returns

Database

Set the number of read replicas

Sets how many read replicas follow the primary (`CLD-DB-006`). A standalone database cannot have replicas — move it to a high-availability topology first. Dropping to zero turns automatic failover off, since there is no longer a standby to promote.

Body

ScaleReplicas

Returns

Database

Restore to a point in time as a new database

Restores the database to a moment inside its backup window, as a new database (`CLD-DB-007`). Never in place — a wrong timestamp costs a throwaway database, not the original. The target moment must fall inside the source’s retention window.

Body

RestoreDatabase

Returns

Database

Roll back the last version upgrade

Rolls the database back to the version it was upgraded from (`CLD-DB-008`). Refused when there is no upgrade to roll back. The source version is what the upgrade recorded, so the rollback is exact rather than a guess.

Returns

Database

Upgrade the engine version

Upgrades the database to a newer version the engine runs (`CLD-DB-008`). The version it came from is recorded so the upgrade can be rolled back. The target must be a real forward step on the engine’s version menu.

Body

UpgradeDatabase

Returns

Database

DNS zones

Returns

DnsZoneList

Create a DNS zone

Creates a DNS zone for a domain (`CLD-NET-008`), served by the DNS provider you choose — Cloudflare, Route 53 or provider-native (`CLD-NET-009`). Add records with the records endpoint.

Body

CreateDnsZone

Returns

DnsZone

Delete a DNS zone

One DNS zone

Returns

DnsZone

Set the zone’s records

Sets a zone’s records (`CLD-NET-008`). The whole set is applied, not a patch. A failover record needs a health check; a geo record routes by resolver location (GeoDNS).

Body

ConfigureDnsZone

Returns

DnsZone

Network file shares

Returns

FileShareList

Create a network file share

Creates an NFS filesystem in a ProjectX region that many machines mount at once — the multi-mount counterpart to a block volume. The reply carries a ProjectX mount target derived from the region, never the upstream’s own export address, so a fleet’s mount configuration names no supplier (ADR-009).

Body

CreateFileShare

Returns

FileShare

Delete a network file share

Deletes the share at the provider first, then the record. Everything on the filesystem is gone. Unlike a volume there is no “detach first” — many machines mount a share and none holds a lock the platform arbitrates.

One network file share

Returns

FileShare

Grow a network file share

Grows the share. A share may only grow — a filesystem extends onto new capacity online, but shrinking means moving data off the tail. A request to shrink or keep the same size is refused.

Body

ResizeFileShare

Returns

FileShare

Floating IPs

Returns

FloatingIpList

Allocate a floating IP

Allocates a public address the customer holds and can move between resources (`CLD-NET-006`), IPv4 or IPv6 (`CLD-NET-007`). The address is real and ProjectX-facing; which upstream announces it is staff detail (ADR-009).

Body

AllocateFloatingIp

Returns

FloatingIp

Release a floating IP

Releases the address back to the pool. Refused while it is still assigned — unassign it first.

One floating IP

Returns

FloatingIp

Assign a floating IP to a resource

Attaches the address to a resource, moving it if already assigned (`CLD-NET-006`). Moving the address is instant and needs no DNS change — the whole point of a floating IP.

Body

AssignFloatingIp

Returns

FloatingIp

Unassign a floating IP

Returns

FloatingIp

Serverless functions

Returns

FunctionList

Deploy a serverless function

Deploys code that runs without a server to manage (`CLD-ORCH-012`): a runtime, an entry-point handler, a trigger and a memory allotment. An http-triggered function answers on a ProjectX endpoint.

Body

CreateFunction

Returns

Function

Delete a serverless function

One serverless function

Returns

Function

What changed and what complained, on one time axis

The last 24 hours by default. Answers the first question anybody asks during an incident: what changed just before this started? Two halves, and the split follows what already has a history. Operations are merged in at read time and never copied, because they are already an append-only record with a timestamp, a target and the principal who asked — a second table holding the same facts would be a second answer, and the one that disagreed would be the one read mid-incident. Alert transitions and probe outcome changes are stored, because they had nowhere readable to live: `AlertSink` and `AuditSink` are both write-only by design, so anything sent through them is gone by the time a review happens. Probe events record a **change**, never a state. A check on a thirty-second interval is 2,880 runs a day, and a timeline carrying all of them is one nobody opens. `correlations` pairs each complaint with the changes shortly before it. The field is called `preceded_by` and not `caused_by` on purpose: a resize four minutes before a disk alert is worth looking at, and whether it caused anything is a question for a person. By default a change does not have to concern the same resource — a firewall change on one machine explains another going unreachable, and `same_resource_only=true` narrows it when that is what you want. Every complaint appears in `correlations` even with nothing before it, because dropping the empty ones would turn "nothing we know of changed" into silence, and silence reads as "not investigated". `gaps` names what this cannot tell you. Application deploys are not on it — nothing reports them to ProjectX — and an empty `preceded_by` means nothing *this platform was told about* changed, which is not the same as nothing having changed.

Returns

IncidentTimeline

The incident notices sent to you

Only the notices whose incident reached your tenant (`CLD-BILL-012`).

Notify the customers an incident affected

Sends an incident communication to the affected customers, and only them (`CLD-BILL-012`). A customer not in the affected set never receives it. Staff-only.

Body

SendIncidentNotice

Managed ingresses

Returns

IngressList

Create a managed ingress

Creates a managed reverse proxy in a ProjectX region (`CLD-NET-014`), so you do not stand up and operate nginx or Envoy yourself. The reply carries a ProjectX endpoint; add routes with the routes endpoint.

Body

CreateIngress

Returns

Ingress

Delete a managed ingress

One managed ingress

Returns

Ingress

Set the ingress routes

Sets an ingress’s host/path routes and optional TLS certificate (`CLD-NET-014`). The whole set is applied, not a patch.

Body

ConfigureIngress

Returns

Ingress

Private interconnects

Returns

InterconnectList

Provision a private interconnect

Provisions a dedicated private link from a network into a ProjectX data centre (`CLD-NET-013`), for latency and isolation a VPN over the internet cannot promise. Committed bandwidth in Mbps.

Body

CreateInterconnect

Returns

Interconnect

Delete a private interconnect

One private interconnect

Returns

Interconnect

Scripted journeys

Returns

JourneyList

Watch a user flow from outside

An ordered list of requests with assertions. What makes it a journey rather than several checks is state: a step may `capture` a value from its response, and later steps interpolate it as `{{name}}` — "log in, then load the dashboard" only means anything if the second request carries what the first returned. Steps stop at the first failure and the rest are reported `skipped`. If login fails, checking the dashboard tells you nothing, and five failures for one cause sends somebody looking for five problems. Secrets are supplied as `secrets` on create, stored in the vault, and referenced as `{{secret.name}}`. Only their names are ever returned: a test account’s password on a monitoring config is a password in a place nobody thinks to look. Every target is judged twice. A step whose URL contains a placeholder is checked again after rendering, immediately before the request, because a value captured from a response could point the request at ProjectX’s own metadata endpoint. A target may not have its origin supplied by a placeholder at all — a placeholder fills in a path, not the host, or nothing about the destination is known until the request is made. `max_latency_ms` makes a working-but-slow journey `degraded`. A checkout flow that completes in twenty seconds is not down and is not fine.

Body

CreateJourney

Returns

Journey

Stop watching a flow

The journey’s secrets are removed from the vault first. A record deleted while its material stayed behind would leave a password in the vault with nothing referencing it, which is a secret nobody rotates.

One journey

Returns

Journey

Recent runs, newest first, with the step that broke

Returns

JourneyResultList

Run a journey now

Returns

JourneyResult

Knowledge base articles

Public help articles; staff also see canned responses (`CLD-BILL-011`). A customer sees only the public audience.

One knowledge base article

Write a knowledge base article or canned response

Body

PutKbArticle

Load balancers

Returns

LoadBalancerList

Create a load balancer

Creates an L4 or L7 load balancer in a ProjectX region (`CLD-NET-005`), with an IPv4, IPv6 or dual-stack address (`CLD-NET-007`). The reply carries a ProjectX endpoint; add listeners with the config endpoint. Which upstream serves it is chosen for the region (ADR-009).

Body

CreateLoadBalancer

Returns

LoadBalancer

Delete a load balancer

One load balancer

Returns

LoadBalancer

Set the balancer’s listeners

Sets a balancer’s listeners (`CLD-NET-005`): front-end ports, backends, health checks and — for https listeners — SSL termination with a certificate. The whole set is applied, not a patch. l4 balancers take tcp/udp; l7 take http/https.

Body

ConfigureLoadBalancer

Returns

LoadBalancer

Query log lines, newest first

Narrow by `resource`, by `min_level` (that level and everything more severe), and by `contains` over the message. Defaults to the last hour and 200 lines, capped at 1000. Lines carry `redactions` when this pipeline replaced something on the way in. That is on the response on purpose: a reader is looking at a modified record, and an investigator who cannot see that will read a `«redacted»` as something the application printed.

Returns

LogLines

Ship log lines

Up to 5000 lines per push, from an agent on the machine. The batch is validated in full and refused whole on the first bad line, so an agent that gets a 202 can be sure nothing was dropped. **Every line is redacted before it is stored.** Logs are the highest-risk surface for leaking a secret — applications log `Authorization` headers on retry and connection strings on startup failure — and once a line is in the lakehouse it is queryable by staff, by dashboards and by everything built on top, so a secret that lands there has leaked to all of them at once. Known secret shapes are replaced (bearer tokens, `password=`, JSON web tokens, PEM private keys, provider access keys, the password half of a URL) and any field whose *name* is a secret loses its value entirely, whatever it contains. A redaction is never a refusal. An application that logs a password is doing something normal and unfortunate, and rejecting its logs would mean losing the whole stream over it. The line is stored with the secret gone and `redactions` counts what was replaced. Entropy is deliberately not used to detect secrets: high-entropy strings in logs are overwhelmingly commit hashes, request ids and trace ids — exactly what somebody debugging needs — while `password=hunter2` is low entropy and is a password. The tenant comes from the caller’s own context, never a line: an agent able to name a tenant could write into somebody else’s log stream, and a log stream is what an incident is reconstructed from.

Body

ShipLogs

Returns

LogsAccepted

What machines have been doing, summarised

One summary per machine and metric over the window, defaulting to the month in progress. `resource` narrows it to one machine and `metric` to one reading. Percentiles are nearest-rank rather than interpolated, so every figure is a reading that actually happened — "we shrank your machine because of a value computed between two observations" is not a sentence that survives being asked about. `first_at` and `last_at` are the readings present, not the window requested. A p95 over two hours of a thirty-day window is a confident number about almost nothing, and that is only visible if the summary says what it covers.

Returns

MetricSummaries

Push agent readings

Processor, memory, disk, network and process readings from an agent on the machine. Up to 1000 readings per push; an agent with a backlog sends several batches. The batch is validated in full and refused whole on the first bad reading. Partial acceptance would give the agent a 200 and no reason to retry, so the dropped readings would be gone and the gap would surface later as a rightsizing recommendation computed over a window with holes in it. A percent above 100 is refused. Agents get this wrong constantly — eight cores reported as 800% is the classic — and the damage is not a bad chart but a rightsizing engine concluding the machine needs to be eight times larger, priced, and offered for approval. The tenant is taken from the caller’s own context, never the body: an agent able to name a tenant could write readings onto somebody else’s machines, and a recommendation is a thing you can move by writing readings.

Body

PushMetrics

Returns

MetricsAccepted

Private networks

Returns

NetworkList

Create a private network

Creates a VPC with the given CIDR in a ProjectX region (`CLD-NET-001`). Which upstream VPC backs it is chosen for the region and is not part of the request or the response (ADR-009). Subnets, routes and firewall rules are set with the config endpoint.

Body

CreateNetwork

Returns

Network

Delete a private network

Deletes the network at the provider first, then the record, dropping any peering links other networks held to it.

One private network

Returns

Network

Set subnets, routes and firewall rules

Sets a network’s subnets, routes and firewall rules (`CLD-NET-001`, `-003`). The whole configuration is applied, not a patch, so an omitted field keeps its current value. Firewall rules use one model across providers.

Body

ConfigureNetwork

Returns

Network

Peer with another network

Peers this network with another so their address spaces route to each other, possibly across providers (`CLD-NET-002`). The peering is recorded on both sides.

Body

PeerNetwork

Returns

Network

Mint a time-boxed signed URL for one object

Signs a URL for one object with the named access key, against the bucket’s ProjectX endpoint. The URL names a ProjectX region, never an upstream one, carries its own expiry and stores nothing server-side. A read-only key cannot presign a PUT — a URL is exactly as powerful as the key that signed it.

Body

PresignObject

Returns

PresignedUrl

Record a cleared payment, raising the account where earned

Records that an account cleared a payment (`CLD-MKT-009`) — the signal it is real. Re-evaluates the ladder and raises the account to the highest tier whose bar it now meets, unless it is flagged for review, in which case it holds. Called by the billing pipeline when a payment settles, not by the customer.

Returns

AccountStanding

Accounts awaiting manual review

Accounts flagged for a human before they rise (`CLD-MKT-009`). A flag freezes the ladder — the raise is exactly what an abuser is waiting for — so a suspicious account is held here without being told why until a reviewer clears or holds it. Staff-only.

Returns

AccountStandingList

Clear or hold an account under review

A reviewer’s decision on a flagged account (`CLD-MKT-009`). `clear` releases the freeze and re-evaluates the ladder immediately, so an account held below its earned tier rises the moment it is cleared; `hold` keeps it frozen — a decision to deny a raise without deleting the account. Staff-only.

Body

DecideOnboardingReview

Returns

AccountStanding

This account’s onboarding standing and current caps

Where the calling account sits on the ladder (`CLD-MKT-009`): its tier, cleared payments, review state, and the caps it is entitled to right now — the ceilings a new account is held to until it earns a raise.

Returns

AccountStanding

The onboarding tier ladder

The named cap sets a new account climbs (`CLD-MKT-009`): each tier’s caps on instances, volumes and monthly spend, and the payment-and-age bar to reach it. A new account starts on the lowest tier and rises automatically as it clears payments — cautious by default because the first account a fraud ring opens looks like the first a real customer opens.

Returns

OnboardingTierList

Delete an onboarding tier

Define an onboarding tier

Sets a tier’s caps and the bar to reach it (`CLD-MKT-009`). Staff-only. The lowest-rank tier is the conservative default every new account gets; higher tiers name a payment count and account age an account must clear to rise to them automatically.

Body

SetOnboardingTier

Returns

OnboardingTier

Fetch one cloud operation with its steps and progress

The operation URN in a cloud 202 response (an order, a resize, a rebuild, a workspace move) resolves here. Every step reports its own state, attempts and error, so a stuck provision can be read without opening the workflow engine.

Price and check a configuration before confirming

The price preview step of the ordering flow (`CLD-MKT-010`): configure a machine class and region and see what it would cost, before anything is created or charged. The price is a quote from the price book, so it is the number the first invoice line will carry — preview and invoice agree by construction, not by a second calculation. A configuration that cannot be placed — an exhausted class, a region with no capacity, one the workspace is not permitted — comes back with `available: false` and a reason in ProjectX terms rather than an error, because the customer asked a fair question and the honest answer is "not here, not now". Nothing is created and nothing is charged either way. Confirming an order is the ordinary provision at `POST /v1/cloud/instances`, which reads the same price book, so the machine an order makes is the machine a direct create makes.

Body

PreviewOrder

Returns

OrderPreview

Places to run and their regions

Where a workspace’s data plane can live: ProjectX servers as the default, plus the ProjectX-managed clouds (AWS, Azure, Google Cloud), each with its regions. A place’s regions and whether its managed account is configured are derived from the driver and the vault-backed platform credential; the driver name and the managed account itself are shown to staff only (ADR-009). Residency (M9) will later narrow which of these a sovereign customer may use.

Returns

CloudPlaces

One place to run

Returns

CloudPlace

Enable or disable a place (staff)

Takes a place off the list or puts it back. The default — ProjectX servers — must always be available and cannot be disabled.

Body

PlaceStatePatch

Record a place’s ProjectX-managed account (staff)

The only way a managed cloud account is recorded. The key goes to the vault and the response never echoes it — only a fingerprint comes back, like every credential write. Refused for ProjectX servers, which we run ourselves and hold no external account for.

Body

AttachManagedAccount

The regions a place runs in

Country, jurisdiction and a display name per region — the customer-facing answer to where a place is, so it is not staff-gated.

Drain or restore a region of a place (staff)

An operator incident control (plan M8): sets every substrate serving the place’s region, and the serverless pool for the place+region, to `draining` — or back to `active` with `drain:false`. Draining stops new placement and leaves running work alone (the substrate drain semantic, carried up to the region); it takes a region out of rotation during an incident, it does not evict the tenants on it. The reply summarises exactly what was touched. Staff-only.

Body

DrainRegion

Returns

RegionDrainSummary

Recovery playbooks

Returns

PlaybookList

Define a recovery playbook

Records a named recovery plan for a class of incident (`CLD-MON-011`): a trigger — an incident kind and the severity at or above which it applies — and an ordered list of remediation steps, each an action (restart an instance, fail a database over, scale out, drain a node, rotate a credential, notify) and the resource it acts on. A playbook does not fire itself. An automated remediation that runs unattended is how a flapping check restarts a database forty times, so a playbook is stored and run on request by a human or a supervised trigger — the same doctrine that puts a production stack apply behind approval. An empty plan is refused: a recovery plan with no steps is worse than none, because somebody trusts it exists.

Body

CreatePlaybook

Returns

Playbook

Delete a recovery playbook

One recovery playbook

Returns

Playbook

Run a recovery playbook

Runs the playbook’s steps in order and records the outcome of each (`CLD-MON-011`). A disabled playbook is refused rather than silently skipped — running one somebody turned off would defeat the switch. Reports a per-step result; acting on each step goes to the resource service’s own recovery verb.

Returns

PlaybookRun

Enable or disable a playbook

Body

SetPlaybookState

Returns

Playbook

Resources configured in a way that is a known risk

A CIS-benchmark posture scan (`CLD-MON-009`) over a tenant’s own resources, reporting the misconfigurations that leak data or expose a surface (`CLD-MON-010`): a bucket anyone can read, a security group or network firewall open to the whole internet (an inbound rule from `0.0.0.0/0` or `::/0`, not an ordinary outbound rule), and a block volume not encrypted at rest. Each finding cites the CIS control it maps to, carries a severity, and names the ProjectX resource to fix — never a supplier. Findings are ranked worst-first and `summary` counts them by severity, so a dashboard has a one-line answer before the list. `not_evaluated` names the controls this scan cannot check and why: missing-MFA is the identity pillar’s fact, not the cloud service’s, and volume-at-rest encryption finds nothing today because every substrate encrypts blocks by default — both are named rather than silently passed, because a scan that omits a control reads as a pass for it. This reports; it changes nothing. Fixing a finding goes through the ordinary configure endpoint for the resource, with its own permission.

Returns

PostureReport

Stop scheduling a machine’s power

Removes the schedule and changes nothing else. The machine stays in whatever power state the last application left it — deleting the schedule is not a decision to start or stop the machine, which would be a power change nobody asked for.

Set the start and stop schedule for a machine

Turns a machine off and on at set hours to stop it billing for hours nobody uses. One schedule per machine, so this replaces any existing one. The schedule sets the machine’s **desired** power at each boundary hour and the reconciler converges the actual state — there is one authority on power and it is the desired spec, so a schedule and a customer’s own manual stop do not fight. `days` are ISO weekdays (1 Monday … 7 Sunday), and on a day not in the set the schedule does nothing, so a machine off at weekends stays off through Saturday and Sunday. `start_hour_utc` and `stop_hour_utc` must differ — an equal pair could mean "always on" or a one-hour window, and the schedule should not have to guess.

Body

SetPowerSchedule

Returns

PowerSchedule

Start and stop schedules

Returns

PowerScheduleList

What a spec would cost, every way it could be served

Prices one machine class in one region before anything is ordered. `hours` defaults to 730, a 30-day month. `every_region=true` widens the answer to every ProjectX region that offers the class, which is the comparison a customer can act on — where a machine lands is the lever they have. The quoted figure is what an order would actually be charged, which is not always the cheapest way of serving it: placement puts a tenant’s own hardware first and then follows commercial preference, never price. `cheapest` and `saving_vs_chosen_minor` are how the difference is reported rather than silently applied. Both are withheld when the options span currencies, because 4000 SEK is not cheaper than 500 EUR. A viable option with no recorded wholesale rate is counted in `unpriced` rather than dropped, since a shorter list of dearer options reads as a complete one.

Returns

PriceComparison

The margin rules that turn cost into published price

The price book (`CLD-MKT-003`, `CLD-FIN-012`): one margin rule per provider and meter, saying how the wholesale cost basis becomes the price a customer is charged — a percentage margin, a fixed uplift, or none — plus the platform fee. Staff-only: it names the upstream and the markup ProjectX takes, which is the supply chain and the commercial position, never shown to a customer. Append-only. A rule change closes the open entry and appends a new one, so a reissued invoice for a past period reprices to the margin that was in effect then rather than today’s. Both open and closed entries are returned, because repricing history needs the closed ones. The same rule feeds the quote path and the invoice path, so a published price and the invoice line for the same hour are the same number by construction.

Returns

PriceBook

Set the margin rule for a provider and meter

Sets the margin rule for one provider and meter (`CLD-MKT-003`, `CLD-FIN-012`). Append-only: this closes the open rule and appends the new one, effective from now, so nothing reprices a closed period. The margin is a percentage (0–1000), a fixed uplift in minor units, or none; a negative fee or an out-of-range percentage is refused, because a typo here lands on an invoice. Takes effect immediately for both quotes and invoices, which read the same rule.

Body

SetPriceBookEntry

Returns

PriceBookEntry

Promotional discounts on the margin

Returns

PromotionList

Delete a promotion

Record a promotional discount

A time-bounded discount on the margin (`CLD-MKT-004`) — a launch offer or a win-back. It cuts the margin only, never the cost or the platform fee, so a promotion can never price below what ProjectX paid the upstream plus its running cost. Applies to one customer when `tenant` is set, or to everybody. Outside its window it does nothing, so an expired promotion reprices to the standard margin without an edit; a customer-specific promotion wins over an everybody one.

Body

SetPromotion

Returns

Promotion

ProjectX regions with the offerings backing them (staff)

Machine classes with the offerings behind them (staff)

The mapping itself: which upstream SKU in which upstream region on which substrate serves each ProjectX class. Staff-only, because it is the supplier list.

Upstream providers and their manifests (staff)

Retained and narrowed to staff by ADR-009. Customers order from `/v1/cloud/catalog`; this is the mapping behind it, which staff need in order to open a case with the upstream on a customer’s behalf.

Returns

ProviderList

One provider’s capability manifest (staff)

Upstream regions and the substrates serving them (staff)

Upstream region handles, so staff-only. The customer answer is the `regions` array of `/v1/cloud/catalog`, which is in ProjectX vocabulary.

Message queues

Returns

QueueList

Create a message queue

Creates a durable managed queue for decoupling producers from consumers (`CLD-ORCH-013`), with a visibility timeout and retention window. Answers on a ProjectX endpoint.

Body

CreateQueue

Returns

Queue

Delete a message queue

One message queue

Returns

Queue

Container registries

Returns

RegistryList

Create a container registry

Creates a private container registry (`CLD-ORCH-011`). The reply carries a ProjectX registry endpoint a `docker push`/`pull` addresses; repositories and immutable-tag policy are set on create.

Body

CreateRegistry

Returns

Registry

Delete a container registry

One container registry

Returns

Registry

List resellers (staff)

The multi-level reseller tree (`CLD-RSL-001`). Staff-only: a reseller reads its own record and customers through the scoped endpoints, not this one.

Create or update a reseller

A reseller is the commercial layer above a set of tenants (`CLD-RSL-001`), naming who resells to them, whose brand they see (`brandingScopeId`, resolved by the platform branding service) and on what branded domain (`CLD-RSL-002`). A parent must already exist so a chain is built top-down, and a branded domain is unique across resellers. Staff-only.

Body

PutReseller

The customers a reseller may see

Invariant 8 (`CLD-RSL-007`): a reseller sees its own customers and those of any reseller beneath it, and nothing else. A reseller outside the caller’s subtree is reported not-found rather than forbidden, because confirming it exists is itself the leak. `caller` is the reseller the principal acts for.

Unlink a customer from a reseller

Link a tenant to a reseller as one of its customers

A reseller’s margin, sliced by tenant, meter or substrate

The reseller’s margin broken down for the period (`CLD-RSL-006`). `by` is `tenant`, `meter` or `substrate`; substrate is where the work ran and never names the provider. Isolation-guarded like the sub-bill.

A reseller’s sub-bill for a period

What ProjectX bills the reseller (the reseller price for all its customers’ usage) and what the reseller earns (its customers’ price minus that), the same usage rated at two tiers of the price book (`CLD-RSL-004`). No wholesale figure appears — a reseller sees its own economics, not the supply chain’s. `caller` is the reseller the principal acts for; a reseller outside its subtree is not-found.

Revenue and margin by SKU, region, reseller or place

Revenue (what customers paid) and margin (what ProjectX keeps) sliced by SKU, region, reseller or place (`CLD-RSL-008`, plan M8). Never the wholesale cost. Region comes from the substrate and place from the substrate’s region/provider matched against the place registry — both ProjectX-side facts, so no upstream is named. SKU comes from the meter’s attributes. Staff-only, over an explicit tenant set.

Customer churn between two periods

Customers who billed in the prior period and nothing in the current one (`CLD-RSL-008`). A count and a rate over the prior period, computed from two sets rather than a model. Staff-only, over an explicit tenant set.

Monthly recurring revenue as a run-rate

MRR normalised to a 30-day month from the priced usage of a window (`CLD-RSL-008`). A run-rate, labelled as one — a cloud business bills usage, not fixed subscriptions. `reseller` scopes it to that reseller’s customers (isolation-guarded); otherwise `tenants` names the set (staff).

Machine classes that fit what the workloads actually do

One rule in both directions: the smallest class in the same family whose capacity covers the observed peak with headroom. Applied to an over-provisioned machine it finds something smaller; applied to one running hot it finds something larger. A tool that only ever proposes shrinking is read as a cost-cutting instrument and stops being trusted by the people whose services it proposes to shrink. Utilization is converted from a percentage of the current class into absolute capacity before classes are compared — 50% of eight processors is not 50% of two — and a class is only a candidate if the peak sits under 70% of it, because sizing to exactly the peak means the first busy day saturates the machine. Savings are real quotes for both classes, not the current spend scaled by a ratio. Rate cards are rarely linear in the shape, and the ratio is wrong in the direction that flatters the recommendation. `undecided` is part of the answer: a report listing only recommendations would read as "everything else is right-sized" when the truth is usually "not enough readings to say", which is a prompt to install an agent. This reports; it applies nothing. Applying a recommendation is a resize, which this platform does not yet do.

Returns

Rightsizing

Roll a resource back to a prior state

Rolls a resource back where the provider permits. Best-effort and provider-conditional: a version upgrade, a rebuild or a stack re-apply can be reverted; an object delete or a volume shrink cannot. The result says whether it was permitted and, when it was not, why — so the customer knows the change stands rather than getting a silent no-op.

Body

Rollback

Returns

RollbackResult

Fleet rollouts

The base-image and engine-version rollouts across the fleet (plan M8), newest first: what each is rolling, the version it reverts to, and its rings with where each wave is. Filter by `kind` (`base_image`, `engine_version`) or `state`.

Returns

Rollouts

Start a fleet rollout (staff)

Begins rolling a new base image or engine version across the fleet in rings (plan M8). Staff-only. The first ring starts active and the rest wait; advance ring by ring, pause to hold, and roll back to revert the touched waves to the version this replaces. Returns 201.

Body

StartRollout

Returns

Rollout

One fleet rollout

Returns

Rollout

Advance a rollout to its next ring (staff)

Completes the active ring and starts the next (plan M8); completing the last ring lands the rollout `completed`. Staff-only. Refused on a paused or finished rollout.

Returns

Rollout

Pause a rollout (staff)

Stops a rollout from advancing without reverting anything (plan M8): the active ring stays active, the fleet it has reached stays on the target. Staff-only. Resume to continue.

Returns

Rollout

Resume a paused rollout (staff)

Lets a paused rollout advance again from exactly where it was held (plan M8). Staff-only.

Returns

Rollout

Roll a rollout back to its previous version (staff)

Terminal (plan M8): marks the rollout `rolled_back` and reverts every wave already touched (active or completed) to the version this rollout replaced — the fleet goes back to `previous`. A wave that never started has nothing to revert and stays pending. Staff-only.

Returns

Rollout

Scheduled operations

Returns

ScheduledOperationList

Schedule an operation

Records a patch window or scaling-calendar entry: a cron expression says when, an action says what, and a target says to which resource or scope. The platform’s sweep runs due schedules. A paused schedule is skipped without being deleted, so a maintenance calendar can be turned off for a freeze and back on after.

Body

CreateScheduledOperation

Returns

ScheduledOperation

Delete a scheduled operation

One scheduled operation

Returns

ScheduledOperation

Pause or resume a scheduled operation

Body

SetScheduledState

Returns

ScheduledOperation

Score a signup for fraud and abuse

Scores a signup against a handful of signals — a throwaway email, a burst of signups from one address, a payment country that does not match billing, a known-abuse marker — and decides allow / review / deny (`CLD-MKT-008`). A single weak signal only nudges the score; a strong or combined one crosses the review or deny line, so the fraud ring is caught at the door without turning away the real customer on a Gmail address. Every signal that fired is on the result with its points and a sentence, so a refused signup can be told why in terms it can appeal, and a fraud team can see what moved the score. The signals are gathered by the caller and passed in; this makes no external calls and its answer is reproducible from its inputs. A `deny` is a clean refusal; a `review` routes the account to the onboarding review queue.

Body

ScreenSignup

Returns

ScreeningResult

Secret bindings

Returns

SecretBindingList

Bind a vault secret to a workload

Injects a vault secret into a workload through ProjectX workload identity rather than a static credential. The binding records which secret, which workload, and the environment variable it lands under — never the value, which stays in the vault and is handed to the workload at run time when it authenticates as its ProjectX identity. Nothing to leak, and rotation is a vault change rather than a redeploy.

Body

BindSecret

Returns

SecretBinding

Revoke a secret binding

One secret binding

Returns

SecretBinding

Security groups

Returns

SecurityGroupList

Create a security group

Creates a named, reusable firewall rule set in a ProjectX region (`CLD-NET-004`). The rules use one model across providers; attach the group to resources to apply them.

Body

CreateSecurityGroup

Returns

SecurityGroup

Delete a security group

One security group

Returns

SecurityGroup

Replace a security group’s rules

Replaces the whole rule set on a security group (`CLD-NET-004`). Every resource that references the group picks up the change.

Body

SetSecurityGroupRules

Returns

SecurityGroup

This tenant’s serverless isolation slices

Every isolation slice the caller’s tenant holds across the fleet’s pools (plan M6): the namespace each runs in, and for staff the network policy and the vault path of the per-tenant encryption key (never the key). Scoped to the token’s tenant.

Returns

TenantIsolations

The serverless fleet’s warm pools

The operator-managed warm serverless capacity (plan M6): one pool per place and region, with the warm/min/max sizing, how many nodes are busy, and the derived warm headroom and utilisation. A customer picking where their serverless work runs reads this too; the driver behind a pool (`provider`) is shown to staff only (ADR-009). Filter by `place`, `region` or `state`.

Returns

ServerlessPools

Size a serverless pool for a place and region (staff)

Defines or re-sizes the warm serverless capacity for one place and region (plan M6). Staff-only. The region must be one the place advertises; one pool per place+region, so re-defining updates the sizing. A warm count outside the floor and ceiling, or a floor above the ceiling, is refused.

Body

DefineServerlessPool

Returns

ServerlessPool

One serverless fleet pool

Returns

ServerlessPool

Re-size or set the state of a serverless pool (staff)

Adjusts a pool’s warm/min/max sizing and/or moves it between `active`, `draining` and `disabled` (plan M6). Staff-only. A sizing that leaves the floor above the ceiling, or the warm count outside the range, is refused; a disabled pool takes no new tenant isolations.

Body

ServerlessPoolPatch

Returns

ServerlessPool

Provision this tenant’s isolation slice in a pool

Carves the caller’s tenant a per-tenant isolation slice in a serverless pool (plan M6): a Kubernetes namespace, a network policy fencing it off, and a per-tenant encryption key referenced by its vault path (never the key itself). The tenant comes from the token; the body names the workspace. Idempotent per tenant per pool. The network policy and the key path are shown to staff only (ADR-009). Refused on a disabled pool.

Body

IsolateTenant

Returns

TenantIsolation

Every self-service signup, newest first (staff only)

The super admin’s signups list (`OC-CUS-003`): who signed up, as which org, where the signup stands and the screening score. Never the payment token — the presentation drops it. Staff only; anybody else gets a 404.

Begin a self-service signup

Starts a signup (`CLD-MKT-006`): records the email, the org name and how the first user will authenticate (email, social or passkey — the mechanism is Keycloak’s, this records the choice), and issues a signup id. The account starts `email_pending`; nothing is created and nothing is charged until the email is verified and the flow is completed. Held by the signup edge, not a customer principal, because it runs before there is a tenant.

Body

BeginSignup

Returns

Signup

One signup

Returns

Signup

Complete a verified signup

Screens the signup and, on a clear result, creates the org and first user and enrols the account on the conservative onboarding tier — no human in the loop (`CLD-MKT-006`, `CLD-MKT-008`, `CLD-MKT-009`). A `deny` refuses it cleanly, creating nothing; a `review` stops it in the review queue for a human. The velocity signal — how many signups this email has started — is read here, so a ring hammering one address is caught. Extra signals the edge gathered (a disposable-domain check, a payment-vs-billing geo lookup) are passed in the body.

Body

CompleteSignup

Returns

Signup

Capture a payment method

Attaches a payment method to a signup (`CLD-MKT-007`). A processor token and the display fields — brand and last four — never a card number: the domain refuses a token that looks like a PAN outright, because the one thing this platform must never hold is a card number. The token is what the processor charges and we cannot; the brand and last four are what the customer sees to recognise their card.

Body

CapturePayment

Returns

Signup

Send the verification email again

Issues a new verification link and invalidates the previous one (A5). At most once a minute and five times per signup, so the public form cannot be used to mail somebody who never asked.

Returns

Signup

Approve or reject a signup held in review

A reviewer’s decision on a signup screening held for a human (`CLD-MKT-008`). `approve` provisions it exactly as an auto-cleared one would; `reject` refuses it. Staff-only.

Body

DecideSignupReview

Returns

Signup

Verify the email address of a signup

Proves the signup’s email address with the token from the verification link (A5). Compared in constant time against a stored hash, refused after 24 hours, single-use. A signup cannot be completed until this has succeeded. Called by the signup edge when the person follows the link.

Body

VerifySignup

Returns

Signup

Issue a sign-up proof-of-work challenge

Hands the sign-up edge a hashcash-style proof-of-work challenge to solve before `begin` (`CLD-MKT-006`). This is bot deterrence — a cost per attempt that sheds an automated flood — not fraud screening (that is `complete`’s risk score) and not a CAPTCHA (there is no third-party challenge). The edge grinds a nonce whose `sha256(challenge:nonce)` has the required leading zero bits and relays `{ challenge, nonce }` to `begin`. Harmless when proof of work is not required; the edge may always fetch one. Held by the signup edge, like `begin`.

Returns

SignupChallenge

Snapshots, optionally for one server

`instance` filters to one server. Each snapshot records whether a person took it or a schedule did, because that decides whether retention may prune it: a snapshot taken by hand before a risky change is not a schedule’s to delete.

Returns

SnapshotList

Take a snapshot now

Taken by hand, which is what keeps it out of a schedule’s retention. The record is written before the provider is called, so a copy that lands and then fails to be reported is still something somebody can find.

Body

TakeSnapshot

Returns

Snapshot

Delete a snapshot

The provider’s copy goes first and the record second. Removing the record first would leave a copy nobody is tracking and everybody is paying for, with nothing to find it by.

One snapshot

Returns

Snapshot

Turn a snapshot into a custom image

The resulting image has exactly one location — where the snapshot is — which is why a tenant image is not portable and why ordering from it narrows placement to the regions holding a copy.

Body

PromoteSnapshot

Returns

TenantImage

Snapshot schedules and their retention

Returns

SnapshotScheduleList

Schedule snapshots with a retention policy

Retention needs `keep_last` or `keep_days`; an empty policy is refused rather than read as "keep nothing", because "no retention" and "retention I forgot to fill in" look identical in a request body and mean opposite things to a bill. Whatever the policy says, the newest working snapshot is never pruned — a machine nobody has snapshotted for a month would otherwise have every copy fall outside the window at once.

Body

CreateSnapshotSchedule

Returns

SnapshotSchedule

Stop scheduled snapshots

Removing a schedule stops new snapshots and prunes nothing. The copies it already took survive, because deleting a policy is not a decision to delete the backups taken under it.

One snapshot schedule

Returns

SnapshotSchedule

Interruptible workloads that could run on spot

Which on-demand workloads are shaped to tolerate being reclaimed, so they could run on cheaper spot capacity (`CLD-FIN-009`). A candidate is either tagged as non-production work — `environment=dev`, `test`, `batch` and the like — or runs bursty rather than steady: a machine pinned near its ceiling is serving live load, and losing it mid-request is an outage, so steady load is deliberately left undecided. The saving is the on-demand spend at an assumed spot discount. Like the commitment advice, `assumed_discount_percent` is stated rather than a real per-provider spot rate — spot discounts differ per upstream and naming one would leak the supply chain through the finance surface. `undecided` explains every resource that got no recommendation: already spot, nothing charged, steady load, or no readings and no tag to judge by. This recommends; it moves nothing — ordering spot is a provision with its own permission.

Returns

SpotAdvice

Stacks

Returns

StackList

Instantiate a blueprint as a stack

Instantiates a blueprint with parameter values (`CLD-ORCH-004`). A plan is computed up front — nothing provisions until an explicit apply. A production-tagged stack starts needing approval (`CLD-ORCH-007`).

Body

CreateStack

Returns

Stack

Delete a stack

One stack

Returns

Stack

Apply a stack

Applies the stack’s plan (`CLD-ORCH-004`). Refused for a production stack whose changes are not approved (`CLD-ORCH-007`).

Returns

Stack

Approve or reject a production stack’s changes

Decides a production-tagged stack’s pending changes (`CLD-ORCH-007`). Approving lets the next apply proceed; rejecting blocks it until a re-plan.

Body

DecideApproval

Returns

Stack

Detect drift and optionally remediate

Compares desired against observed state (`CLD-ORCH-003`). When drift is found and the stack has auto-remediation on, desired state is re-applied; otherwise the drift is recorded for a human.

Body

DetectDrift

Returns

Stack

Plan and preview a stack with cost diff

Re-computes the plan and its cost diff without applying (`CLD-ORCH-006`): every resource’s action and the monthly cost delta, so a customer sees the money before committing.

Returns

Stack

Set a component’s baseline status

Records a platform component’s health (`CLD-MKT-015`): operational, degraded or outage, with an optional note. Ops-facing. This is the baseline the public status page shows; an open incident can only make a component worse than its baseline, never better.

Body

SetComponentStatus

Returns

ComponentStatus

Open a status incident

Opens a public incident against a component (`CLD-MKT-015`): a customer-readable title and an impact (degraded or outage) that floors the component’s reported health while it is open. Ops-facing. Re-opening an already-open incident is refused.

Body

OpenStatusIncident

Returns

StatusIncident

Resolve a status incident

Marks an open incident resolved (`CLD-MKT-015`). The component it affected returns to its baseline immediately. Ops-facing.

Returns

StatusIncident

Run a reconcile sweep now

The same sweep the schedule runs. Provided because the answer to “is the drift real” should not require waiting for the next tick.

Returns

ReconcileReport

Substrates this tenant can see

ProjectX-operated substrates plus any the tenant owns. Each carries its deployment model and its metering and access posture, so a console can badge ownership without deriving the rules itself. The driver behind a substrate and its upstream region handle are shown to staff and to byo workspaces only (ADR-009); `residency` is the customer-facing answer to where it is.

Register a substrate

Ownership and operator are separate answers: a customer can own the metal while ProjectX operates the platform on it, and the two combine into different billing and access rules. Both are required and neither is inferred.

Body

RegisterSubstrate

One substrate, with its posture

Drain or retire a substrate

Draining stops new placement and leaves running instances alone. Retiring is refused while instances remain, because their URNs name this substrate.

Body

SubstrateStatePatch

The tickets a reseller may work — its own customers’

Reseller support tooling (`CLD-RSL-005`): a reseller sees the tickets of the customers it may see, and no others (invariant 8). `caller` is the reseller the principal acts for.

List your support tickets, newest first

Open a support ticket

Opens a ticket with an SLA tier (`CLD-BILL-011`). The ball starts in our court, so the SLA clock starts now. The first message is the customer’s opening description.

Body

OpenTicket

One ticket with its messages and SLA

Reply on a ticket — the in-portal chat

A customer reply hands us the ball and starts the SLA clock; a staff reply hands it back and stops it (`CLD-BILL-011`). A message on a closed ticket is refused.

Body

TicketReply

Resolve, close or reopen a ticket

Body

SetTicketState

Block volumes

Returns

VolumeList

Create a block volume

Creates a disk in a ProjectX region that attaches to one machine at a time and outlives it. Which upstream holds the blocks is chosen for the region and is not part of the request or the response (ADR-009).

Body

CreateVolume

Returns

Volume

Delete a block volume

Deletes the volume at the provider first, then the record. Everything on the disk is gone. Refused while the volume is attached — detach it first, so a machine’s disk is never deleted out from under it.

One block volume

Returns

Volume

Attach a volume to a machine

Attaches the volume to an instance in the same region. One machine at a time — a live volume on two machines corrupts the filesystem — and only within the volume’s region, because the blocks are in one place.

Body

AttachVolume

Returns

Volume

Detach a volume from a machine

Returns

Volume

Grow a block volume

Grows the volume. A volume may only grow — a filesystem extends onto new blocks online, but shrinking means moving data off the tail. A request to shrink or keep the same size is refused.

Body

ResizeVolume

Returns

Volume

Snapshots of a volume

Returns

VolumeSnapshotList

Snapshot a block volume

Body

SnapshotVolume

Returns

VolumeSnapshot

VPN gateways

Returns

VpnGatewayList

Create a VPN gateway

Creates a WireGuard or IPsec VPN gateway on a network (`CLD-NET-012`), site-to-site or client mode. Add site-to-site peers with the peers endpoint.

Body

CreateVpnGateway

Returns

VpnGateway

Delete a VPN gateway

One VPN gateway

Returns

VpnGateway

Set the gateway’s site-to-site peers

Sets a gateway’s peers (`CLD-NET-012`). The whole set is applied, not a patch. A client-mode gateway takes no peers.

Body

ConfigureVpnGateway

Returns

VpnGateway

Servers in this tenant

Provision a server

Order a ProjectX machine class in a ProjectX region. Which upstream serves it is chosen by the placement resolver and is not part of the request or the response (ADR-009). Returns 202 with an operation URN to poll. Residency obligations carried by the authorization decision narrow the candidate offerings before one is chosen, so a placement the policy forbids is never made rather than made and then unwound.

Body

CreateInstance

Returns

InstanceAccepted

Destroy a server

Returns 202 with an operation to poll. Destroying an already-destroyed instance returns 200 and the record, so a client retrying after a timeout gets the same answer twice.

One server, with what was ordered, what is observed and any drift

Returns

Instance

Clone a server into a copy of it

Makes a new machine that is a copy of this one — same machine class, region, disk layout, GPU partition and spot booking, booted from a copy of this machine’s disk. There is no native provider clone, so this snapshots the source, promotes the snapshot into a private image, and provisions from it; the clone lands in the same region as its source because that is where the captured image lives. Returns 202 with an operation to poll.

Body

CloneInstance

Returns

InstanceAccepted

Open a console on a server

Answers a short-lived single-use **ProjectX** ticket, never the provider’s endpoint. That is not ceremony: a provider console URL carries a token in its query string, and a browser that opens one writes it into history, into referrers, into any proxy in front of it and into any screenshot of the address bar — all four durable. So a customer handed one would learn which upstream runs their machine, permanently, from a feature meant to show them a login prompt (ADR-009). A relay redeems the ticket and connects on the customer’s behalf. Refused with 422 where the substrate behind the workload has no console, naming the capability and not the provider.

Body

OpenConsole

Returns

ConsoleTicket

Mount or unmount virtual media over the BMC

Booting from an ISO over the hardware channel (`CLD-COMP-008`) — the rescue path when the machine’s own storage or network is the thing that is broken. A mount names the image URL the BMC fetches, and the driver validates it is one, because the BMC fetches whatever it is told. What is mounted is what the machine may boot from next, which is why this is a rescue-class grant rather than a convenience. Refused with 422 naming the capability where the substrate has no BMC channel.

Body

MountMedia

Returns

MediaState

Live-migrate a running server to another host

Moves the machine between hosts without a stop, where the substrate behind it can (`CLD-COMP-006`). Nothing you can see changes: the class, the image, the disk and the addresses all stay, and metering runs through — a migration is not a resize and bills nothing new. Refused with 422 naming the capability where the substrate has no live migration, and with 409 for a machine that is not running, because a stopped machine has nothing to keep alive — the verb it wants is a start or a rebind. There is no target-host argument: which host the machine lands on is the estate scheduler’s decision, and the platform has no host vocabulary to offer one in. Returns 202 with an operation to poll.

Returns

InstanceAccepted

Start or stop a server

Synchronous: a power call takes seconds and has nothing to compensate, so it answers with the machine rather than an operation to poll. The desired state is written before the provider is called and is not rolled back on failure — the reconciler already puts power drift back, so a provider that was briefly unreachable converges on the next sweep instead of the instruction being discarded.

Body

PowerInstance

Returns

Instance

Move a workload to another substrate

The move that makes the seven topologies one product (`DEP-TOP-001`, master spec §14.3): the endpoint, the credential format and the API version are unchanged, and the returned URN keeps every segment but the substrate one, so an integration built against the workload keeps working. Everything refusable — a residency policy the target breaks, a capability it lacks — is refused before anything is copied and named in the reply. The move is one audited event naming the source and the target substrate.

Body

RebindInstance

Returns

Instance

Restart a server in place

A restart, not a stop followed by a start. On most upstreams a stop releases the host allocation and a start may land the machine elsewhere with a new address, so composing the two would change a customer’s IP to satisfy a request that never asked for it. Writes no desired state, because a reboot ends in the state it started in. Refused with 409 on a machine that is not running.

Returns

Instance

Reinstall a server from an image

Everything on the disk is gone. The address and the URN survive, which is why this exists instead of destroy-and-create, and why `confirm` must repeat the machine’s name — a destructive act that only needs a button is one somebody performs by accident. A rebuilt machine has not re-run its first-boot configuration, so the rendered user-data is dropped from the record rather than left there claiming otherwise. Returns 202 with an operation to poll.

Body

RebuildInstance

Returns

InstanceAccepted

Observe one server now and report drift

Read-only against the provider. Power drift is put back; a difference in sku, image or region is reported and left alone, because putting those back means rebuilding the machine and that is a human’s decision.

Returns

DriftReport

Arm or disarm rescue mode

Boots the machine from a recovery image with its own disks attached but not booted from — what somebody reaches for when the installed system will not start. Arming does **not** enter it: every provider here takes effect on the next restart, and the reply says whether one is needed rather than the platform restarting a machine nobody asked it to touch. The one-time root password is returned once and never stored; ask again if you lose it. Rescue is recorded beside the desired spec rather than in it, so the reconciler stops reporting image drift while you are in there instead of trying to put the machine back.

Body

RescueInstance

Returns

RescueGranted

Change a server’s machine class

Names a ProjectX machine class; which upstream SKU it becomes is re-resolved by the same placement resolver that chose the first one, pinned to the substrate the machine already runs on so a resize cannot quietly become a migration. Returns 202 with an operation to poll. There is no reversal step: resizing back is not a safe undo, so a resize that fails halfway leaves the machine `degraded` with the field named in its drift, for a human to decide.

Body

ResizeInstance

Returns

InstanceAccepted

Read the hardware sensors under a server

Out-of-band (`CLD-COMP-008`): the answer comes from the BMC, so it works when the installed system does not — which is the only moment it is needed. Readings, not history: temperatures in Celsius, fans in RPM, draw in watts, each with its unit named, and history belongs to the metrics pipeline rather than to repeated polls of this. Refused with 422 naming the capability where the substrate has no BMC channel.

Returns

SensorReadings

Resources that cost money and do nothing

Stopped servers still being charged for, backups of servers that no longer exist, scheduled backups whose schedule was deleted, and copies of images nobody can order from. Defaults to the month in progress. It reports and ranks; it deletes nothing. Every class is a heuristic — a backup of a destroyed server is usually waste and is occasionally the only copy of something destroyed by mistake, which is exactly when somebody wants it — so acting on a finding goes through the ordinary delete endpoint and the ordinary permission. Only the stopped-server findings carry a figure. Wholesale prices cover compute per hour and there is no storage rate card, so what a backup costs cannot be derived without inventing a number; those findings carry the gigabytes or the number of copies instead, and say why the figure is missing. `not_swept` names the classes this deployment cannot look for yet, because a report that omits a category reads as a clean result for it.

Returns

WasteReport

Tear down a workspace deployment

Deletes the workspace’s data-plane footprint and removes its catalog root. Returns 202 with an operation to poll. Each piece is deleted tolerant of being already gone, so a retried teardown gets the same answer.

Returns

WorkspaceDeploymentAccepted

A workspace’s deployment

The workspace’s place to run, its state and the four pieces of its data-plane footprint. The substrate and each resource’s provider handle are shown to staff only (ADR-009).

Returns

WorkspaceDeployment

Deploy a workspace

Give a workspace a place to run and a region, and provision its data-plane footprint — a private network, an object-storage bucket, a catalog root and a managed Kubernetes compute pool — as an operation. Returns 202 with an operation URN to poll. The place must be enabled and must run in the region; which upstream serves the region is chosen for the place and is not part of the request (ADR-009).

Body

DeployWorkspace

Returns

WorkspaceDeploymentAccepted