> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kombify.io/llms.txt
> Use this file to discover all available pages before exploring further.

# List all features grouped by category



## OpenAPI

````yaml /techstack/reference/api/openapi.yaml get /api/v1/features
openapi: 3.1.0
info:
  title: kombify-TechStack API
  description: >
    REST API for kombify-TechStack -- the hybrid cloud control plane for
    homelabs.


    kombify-TechStack manages infrastructure through a spec-driven architecture:

    validate YAML specs via CUE, generate OpenTofu configurations, and manage

    nodes through a gRPC agent protocol.


    ## Authentication


    Authenticated endpoints accept an OIDC/JWKS bearer token or an API key

    where documented. Self-hosted TechStack defaults to Pocket ID as identity

    provider. SaaS routes enter through the edge with Auth0 as the platform

    identity provider. PocketBase session exchange remains legacy migration

    compatibility only.


    ## Response Format


    **Success:** `{ "data": <object>, "meta": { "total": int, "page": int,
    "per_page": int } }`


    **Error:** `{ "error": { "code": "<ERROR_CODE>", "message": "...",
    "details": <any> } }`


    ## Pagination


    List endpoints accept `page` (default: 1) and `per_page` (default: 20, max:
    100) query parameters.
  version: 1.0.0
  contact:
    name: kombify
    url: https://kombify.io
  license:
    name: Apache-2.0 AND GPL-3.0
    url: https://github.com/KombiverseLabs/kombify-TechStack/blob/main/LICENSE
servers:
  - url: https://api.kombify.io/v1/techstack
    description: >-
      Production canonical (via Cloudflare edge gateway, strip-prefix). Clients
      MUST use this projection. The Gateway strips /v1/techstack and re-adds
      /api/v1 at the origin, so it resolves the /api/v1/* paths below cleanly.
  - url: http://localhost:5260
    description: Local development
  - url: https://techstack.kombify.io
    description: Production (direct, no Gateway prefix)
  - url: https://api.kombify.io/v1/orchestrator
    description: >-
      Legacy StackKit-Orchestrator projection of the same origin. RETAINED for
      backward compatibility with existing consumers only. Do NOT use for mobile
      or new clients: combined with the /api/v1/* paths it double-resolves
      (yielding /v1/orchestrator/api/v1/...). Prefer /v1/techstack.
security:
  - bearerAuth: []
tags:
  - name: Health
    description: Health checks and service info (no auth required)
  - name: Instance
    description: Local instance identity and enrollment metadata
  - name: Stacks
    description: Stack lifecycle management (create, provision, deploy, destroy)
  - name: Stacks - Specs
    description: Access persisted specification chain (intent, requirements, unified)
  - name: Stacks - Import/Export
    description: Import and export StackKits stack-spec.yaml configurations
  - name: Stacks - Drift
    description: Infrastructure drift detection and resolution
  - name: Unifier
    description: Spec validation, analysis, unification, and IaC generation pipeline
  - name: StackKits
    description: Infrastructure template catalog
  - name: Add-ons
    description: Add-on detection and registry
  - name: Workers
    description: Worker node registration and management
  - name: Servers
    description: Canonical server lifecycle, connection, and health state
  - name: Inventory
    description: >-
      Owner-scoped sanitized server and service read models for UI, API, and MCP
      clients
  - name: Pre-Checks
    description: Pre-deployment hardware and software validation
  - name: Agents
    description: Connected gRPC agent management and commands
  - name: Jobs
    description: Background job monitoring and SSE streaming
  - name: Discovery
    description: Network device discovery and SSH testing
  - name: Features
    description: Feature flags (read-only; managed centrally via the kombify Admin API)
  - name: Monthly Runtime
    description: Provider-free user API for subscription-backed stack runtime control
  - name: Runtime
    description: Recent runtime/deploy logs (job/deploy progress + container tail)
  - name: Wallet
    description: >-
      Redacted recovery-item wallet with biometric/platform-reauth-gated reveal.
      List responses strip secret/totp; reveal requires a fresh trusted-reauth
      HMAC proof (5-minute window) and is audited server-side.
  - name: Trust
    description: Pairing tokens for worker enrollment
  - name: Client Binding
    description: >-
      Short-lived HTTPS pairing for a second client and normal OIDC account
      handoff
  - name: Tunnel
    description: Cloudflare tunnel management for NAT traversal
  - name: Backups
    description: Database backup management (admin only)
  - name: Auth
    description: Authentication mode and SSO configuration
  - name: Metrics
    description: Prometheus-compatible instance metrics for admin/infra scrapers
  - name: Internal
    description: >-
      Internal SaaS-only APIs, including servicecall-protected executor
      contracts
paths:
  /api/v1/features:
    get:
      tags:
        - Features
      summary: List all features grouped by category
      operationId: listFeatures
      responses:
        '200':
          description: Features by category
          content:
            application/json:
              schema:
                type: object
                properties:
                  security:
                    type: array
                    items:
                      $ref: '#/components/schemas/FeatureState'
                  beta:
                    type: array
                    items:
                      $ref: '#/components/schemas/FeatureState'
                  ux:
                    type: array
                    items:
                      $ref: '#/components/schemas/FeatureState'
components:
  schemas:
    FeatureState:
      type: object
      properties:
        key:
          type: string
        name:
          type: string
        enabled:
          type: boolean
        locked:
          type: boolean
        requires_consent:
          type: boolean
        has_consent:
          type: boolean
        risk_level:
          type: string
        description:
          type: string
        category:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        OIDC/JWKS bearer token. Self-hosted defaults to Pocket ID; SaaS uses
        Auth0 through the edge. PocketBase JWT is legacy migration compatibility
        only.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.