Generated from the Techstack v0.39.0 release (source
49677b729cb9). For an installed version, techstack api <command> --help is authoritative.techstack api servers detach
Revoke and detach one exact customer-operated BYO server. Retains the terminal canonical server receipt and performs no provider API call.techstack api servers get
Get canonical server lifecycle, connection, health, and channels.techstack api servers list
List canonical Node runtime state. Returns owner-scoped Nodes with canonicalnode_id and
kit_deployment_id identities.
techstack api servers maintenance get
Read one maintenance job of an owned server. Scoped like the POST: the Edge-signedtechstack.servers.maintenance entitlement, the tenant, ownership of the server, and a job that belongs to this server and was requested by the caller. Anything else is 404. Maintenance jobs have their own ledger and are not served by /api/v1/jobs/{id}. There is no log endpoint: the job carries its outcome, and a failure carries its stable code with user guidance.
techstack api servers maintenance run
Queue an owned server OS update plan, OS update or reboot. Requires the Edge-signedtechstack.servers.maintenance entitlement, ownership of the server in the tenant, and current server-bound standing authority for delegated native MCP calls. These three ordinary actions require no fresh MFA or separate owner_approved assertion. The body is decoded strictly: exact lowercase keys, no duplicates, no unknown fields. A replay with the same Idempotency-Key returns the stored receipt before target validation. One reboot or OS update and, separately, one update plan may be active per server; a job not finished by its deadline fails with deadline_exceeded and frees its slot. The action is offered in allowed_actions only when the server agent advertises stackkit.host-maintenance.v1, and reboot only when the server also reports host_boot_id. Refusals are client-error-envelope/v1 documents; 409 reason_code is one of control_plane_host, substrate_node, protected_demo_server, service_locked, maintenance_active, node_operation_active, plan_stale, agent_capability_missing, boot_id_unknown, agent_not_connected, heartbeat_stale, inventory_revision_stale or idempotency_key_reused; 403 carries entitlement_required or maintenance_origin_authority_denied.
techstack api servers network get
Read the server’s network facts and any recorded home network move. The network the server’s kombify Guard last observed (address, gateway, subnet, interface, WiFi network), thenetwork_move record kombify wrote when the server turned up on a different network, and the state of the re-bind that followed. A moved server re-binds itself automatically; can_rebind says whether the owner can start one now.
techstack api servers network rebind
Re-bind a moved server to the network it is on now. Runsstackkit network rebind on the server through its kombify Guard: the node re-detects its LAN address, re-issues the signed LAN DNS custody record and regenerates and re-applies the workspace. The request takes no body. Requires the owner, the Inventory operate grant and the techstack.servers.maintenance entitlement, and a connected Guard (409 server_network_not_ready otherwise). A rebind that is already queued or running answers with its job instead of queueing another.
techstack api servers ports
Get the authenticated owner’s port inventory for one canonical server. Server-detail UI projection over the same central port authority as the Inventory/MCP surface, authorized through the canonical owner-scoped server read boundary.techstack api servers reach set
Publish the server at a kombify.me address, or stop publishing it. Nothing is published by default: a paired server has no public route and the relay carries no traffic. The owner enables it per server with an explicitservice name and target_port (the origin is always the Guard host’s loopback, never another machine) and may withdraw it at any time. The relay authenticates the Guard, not the visitor, so what answers on that port must protect itself. Enabling requires the owner, the techstack.servers.maintenance entitlement and a fresh multi-factor sign-in (reason server_reach_step_up_required); withdrawing is never gated. Responds with the reach section of the server read model; the reconciler then creates or withdraws the route.
techstack api servers security auto-repair get
Read the owner’s approval of automatic security repair. A server without an approval, or with an expired one, is observe-only.techstack api servers security auto-repair set
Approve or withdraw automatic repair of a small safe set of controls. Off by default. An approval names controls from the safe set (allowed_controls: brute-force protection, the firewall policy, kernel parameters and automatic security updates; never the ssh controls), expires within 90 days and never renews itself. While it is in force the control plane repairs a named control that fresh evidence reports drifted, inside the same bounds as an operator repair. Requires the owner, the techstack.servers.maintenance entitlement and a fresh multi-factor sign-in. enabled: false withdraws the approval.
techstack api servers security findings
List the open findings and recent findings history of one server. The findings ledger behind the server’ssecurity, recovery and Guard alerts. One finding is one episode: opened when a fact is first observed wrong, resolved when it is observed right again, with at most one alert (alerted_at) and one resolution. History is kept 90 days.
techstack api servers security repairs list
List the recent security repairs of one server.techstack api servers security repairs request
Repair named drifted host security controls. Requests a bounded repair of controls the fresh host security evidence reports as drifted and automatically repairable. Requires the server’s owner, the Edge-signedtechstack.servers.maintenance entitlement and a fresh multi-factor sign-in (at most 300 seconds old). The repair travels as a typed, journaled Guard command that runs stackkit host security repair --apply for exactly the named controls; StackKits refuses, before changing anything, a change that would cut the management path or lock the owner out. Bounds: one repair per server at a time (409 repair_in_progress), a per-control cooldown (429 repair_cooldown), a daily attempt budget per control (429 repair_attempts_exhausted) and a circuit breaker after consecutive failures (429 repair_circuit_open); the 429 answers carry retry_after. A control that is compliant (409 control_not_drifted), under an approved exception (control_has_exception), manual (control_not_repairable), blocked on an authorized SSH key (needs_authorized_key) or not observed is refused. The body is decoded strictly.
techstack api servers security verify
Ask the kombify Guard for a fresh host security observation. Records that a fresh observation of the host baseline is wanted. The Guard answers at its next check-in (within about a minute) with a new report; nothing on the host changes. The server’ssecurity read model is updated only by that report, never by this request. Another tenant’s or owner’s server is 404; a server without a Guard is 409 guard_not_connected.