Input types

Every input type in the schema, A to Z. A ! on the type means the field is required.

AddMemberInput

Field	Type	Description
`capabilities`	`[Capability!]`
`role`	`Role`	One of `member`, `owner`, `viewer`.
`roleId`	`String`
`userId`	`String!`

AddRegistryInput

Field	Type	Description
`name`	`String!`
`password`	`String!`
`registryUrl`	`String`
`type`	`RegistryType!`	One of `dockerhub`, `generic`, `ghcr`, `gitlab`.
`username`	`String!`

AddServerInput

Register a remote server. Provisioned by a call-home bootstrap (no SSH-in): you run the returned install command on the box.

Field	Type	Description
`allTeams`	`Boolean`
`buildOnly`	`Boolean`
`host`	`String!`
`importOnly`	`Boolean`
`name`	`String!`
`storageOnly`	`Boolean`
`teamIds`	`[String!]`

AppEnvInput

An initial environment variable for a new app.

Field	Type	Description
`key`	`String!`
`type`	`String`	"plain" or "secret". Omitted is plain - nothing is typed secret on your behalf; a secret is write-only from the moment it lands.
`value`	`String!`

AppPreviewSettingsInput

Field	Type	Description
`autoDeploy`	`Boolean`	Rebuild a preview when its pull request gets a new commit.
`baseDomain`	`String`	e.g. `preview.example.com`, with a wildcard DNS record pointing here. Empty clears it back to the zero-configuration nip.io default.
`buildDrafts`	`Boolean`	Build a pull request that is still a draft.
`comment`	`Boolean`	Post the preview URL as a comment on the pull request.
`enabled`	`Boolean`
`forkPolicy`	`String`	deny \| approve \| allow.
`https`	`Boolean`	Serve previews over HTTPS. Needs a preview domain.
`maxActive`	`Int`
`port`	`Int`	Container port. Empty => the app's build port.
`requiredLabels`	`String`	Newline-separated labels a pull request must carry. Empty => no filter.
`serverId`	`String`	Where previews run. Empty => the app's own server.
`ttlDays`	`Int`

BuildConfigInput

Partial build configuration; only the provided fields are changed.

Field	Type	Description
`buildCache`	`Boolean`	Reuse the owning server's Docker layer cache between builds of this app (default true). False rebuilds every layer from scratch each time.
`buildCommand`	`String`
`buildMethod`	`String`
`includeFilesOutsideRoot`	`Boolean`
`installCommand`	`String`
`outputDir`	`String`
`port`	`Int`
`rootDir`	`String`
`runtimeVersion`	`String`
`settings`	`JSON`
`skipUnchangedDeployments`	`Boolean`
`startCommand`	`String`

ComposeNameClashesInput

Field	Type	Description
`compose`	`String!`
`environmentId`	`String`
`folderId`	`String`
`projectId`	`String`
`serverId`	`String`

ConnectGitProviderInput

Field	Type	Description
`allowPrivateEndpoint`	`Boolean`	Allow an address inside the deployment, for a git server on your own network. Instance-admin only; refused otherwise.
`baseUrl`	`String!`	Origin of the git host. A bare domain becomes https://; a path or embedded credentials are refused.
`label`	`String!`
`provider`	`String!`	gitlab \| bitbucket \| gitea \| git.
`token`	`String!`	Access token. Write-only.
`username`	`String`	Basic-auth username for the clone. Defaults per provider.

CreateAppFromTemplateInput

Field	Type	Description
`deploy`	`Boolean`	Request the first deployment. Defaults to false; a token also needs deploy_apps.
`environmentId`	`String`
`folderId`	`String`
`name`	`String`	The new App name. Omitted uses the template name.
`projectId`	`String`
`serverId`	`String`
`templateSlug`	`String!`	The catalog template slug from templateVariants.
`variantSlug`	`String`	The variant slug. Omitted uses the "default" variant.

CreateAppInput

Field	Type	Description
`autoDeploy`	`Boolean`
`autoDomain`	`String`
`autoDomainPath`	`String`
`build`	`BuildConfigInput`
`buildServerId`	`String`	Where the app COMPILES, when that is not where it runs. Omitted is Automatic - a build-only server if the fleet has one.
`compose`	`String`
`composePort`	`Int`
`composeService`	`String`
`composeUpArgs`	`String`	Extra flags appended to `docker compose up` for a compose stack. Validated against the same allow-list the app's settings use.
`dockerImage`	`String`
`env`	`[AppEnvInput!]`
`environmentId`	`String`
`extraDomains`	`[ExtraDomainInput!]`
`folderId`	`String`
`logo`	`String`
`mounts`	`[MountInput!]`
`name`	`String!`
`projectId`	`String`
`renameClashes`	`Boolean`	Rename a service whose name a neighbour on the destination network already answers to (`db` becomes `db-2`), carrying its references, instead of refusing the stack. See `composeNameClashes`.
`repo`	`GitRepoInput`
`serverId`	`String`
`sharedVarIds`	`[String!]`	Shared variables to link to the new app, so its FIRST deploy already carries them (ADR-0012: linking is the injection, and it is opt-in).
`source`	`DeploySource!`	One of `COMPOSE`, `DOCKER_IMAGE`, `GIT`, `GITHUB`, `UPLOAD`.

CreateBackupInput

Field	Type	Description
`appId`	`String`
`databaseId`	`String`
`destinationId`	`String!`
`name`	`String!`
`retentionCount`	`Int!`
`schedule`	`String!`
`targetKind`	`BackupTargetKind`	One of `app`, `database`.
`timezone`	`String`

CreateDatabaseInput

Field	Type	Description
`dbName`	`String`
`environmentId`	`ID`
`exposedPort`	`Int`
`exposedPublicly`	`Boolean`
`name`	`String!`
`password`	`String`
`serverId`	`ID`
`type`	`DatabaseType!`	One of `clickhouse`, `mariadb`, `mongodb`, `mysql`, `postgres`, `redis`.
`username`	`String`
`version`	`String!`

CreateDestinationInput

Field	Type	Description
`accessKey`	`String`
`allowPrivateEndpoint`	`Boolean`
`bucket`	`String`
`endpoint`	`String`
`kind`	`DestinationKind!`	One of `s3`, `server`.
`name`	`String!`
`path`	`String`
`provider`	`S3Provider`	One of `AWS`, `BACKBLAZE_B2`, `CLOUDFLARE_R2`, `DIGITALOCEAN`, `MINIO`, `OTHER`, `WASABI`.
`region`	`String`
`s3ExtraArgs`	`String`
`secretKey`	`String`
`serverId`	`String`

CreateRoleInput

Field	Type	Description
`capabilities`	`[Capability!]`
`description`	`String`
`name`	`String!`
`requireTwoFactor`	`Boolean`
`scope`	`RoleScopeInput`

CreateTokenInput

Field	Type	Description
`appIds`	`[String!]`
`capabilities`	`[Capability!]`
`expiresAt`	`String`
`folderIds`	`[String!]`
`instanceAdmin`	`Boolean`
`name`	`String!`
`projectIds`	`[String!]`
`teamIds`	`[String!]`

CronJobEnvInput

One extra variable for a job. The value is encrypted at rest and reaches the host inside the mTLS RPC - it is never readable back.

Field	Type	Description
`key`	`String!`
`value`	`String`	Omit (or null) when editing to keep the stored value of an existing variable.

CronJobInput

Every field is optional so one input serves create and edit; create requires name, schedule and command.

Field	Type	Description
`command`	`String`
`description`	`String`
`enabled`	`Boolean`
`env`	`[CronJobEnvInput!]`	Replaces the job's variables wholesale when present.
`keepRuns`	`Int`	10 to 500.
`maxAttempts`	`Int`	1 to 4. 1 means no retry.
`name`	`String`
`overlap`	`String`	skip \| allow.
`schedule`	`String`	5-field cron.
`service`	`String`	Empty => the target's own container.
`shell`	`String`	sh \| bash.
`timeoutSeconds`	`Int`	Per attempt, 1s to 24h.
`timezone`	`String`	IANA zone, e.g. Europe/Rome.
`user`	`String`
`workdir`	`String`

One config file to write next to the database's stack and bind-mount into its container. filePath is relative to the stack's files directory; mountPath is the absolute path inside the container and may not be inside the engine's data directory.

Field	Type	Description
`content`	`String!`
`filePath`	`String!`
`mountPath`	`String!`

DeleteUserInput

Field	Type	Description
`deleteCreatedApps`	`Boolean`
`deleteFoundedTeams`	`Boolean`
`deleteOwnedWorkspaces`	`Boolean`
`userId`	`String!`

DomainConfigInput

Per-domain routing config; an omitted certProvider means no certificate (plain HTTP), unless the add-time DNS check finds the host proxied through Cloudflare, then it is stored as cloudflare.

Field	Type	Description
`certProvider`	`CertProvider`	One of `cloudflare`, `custom`, `letsencrypt`, `none`.
`entrypoint`	`DomainEntrypoint`	One of `web`, `websecure`.
`middlewares`	`[String!]`
`pathPrefix`	`String`
`port`	`Int`
`proxied`	`Boolean`
`service`	`String`
`stripPrefix`	`Boolean`
`www`	`DomainWwwRedirect`	One of `none`, `toCounterpart`, `toThis`.

DomainPatchInput

Partial domain edit; only the provided fields are changed. Null clears an override.

Field	Type	Description
`certProvider`	`CertProvider`	One of `cloudflare`, `custom`, `letsencrypt`, `none`.
`entrypoint`	`DomainEntrypoint`	One of `web`, `websecure`.
`middlewares`	`[String!]`
`name`	`String`
`pathPrefix`	`String`
`port`	`Int`
`proxied`	`Boolean`
`service`	`String`
`stripPrefix`	`Boolean`
`www`	`DomainWwwRedirect`	One of `none`, `toCounterpart`, `toThis`.

EnvEntryInput

Field	Type	Description
`key`	`String!`
`value`	`String!`

ExecConsoleInput

Field	Type	Description
`appId`	`String!`
`command`	`String!`
`containerName`	`String`

ExecDatabaseConsoleInput

Field	Type	Description
`command`	`String!`
`databaseId`	`String!`

ExtraDomainInput

An extra (non-primary) routed host: the compose service + port it targets, its hostname and the path it answers on. No hostname => one is generated. Registered as an auto Domain row at creation; the domains table is the sole routing source after.

Field	Type	Description
`host`	`String`
`path`	`String`
`port`	`Int!`
`service`	`String!`

GitRepoInput

Field	Type	Description
`branch`	`String!`
`connectionId`	`String`	A git connection (any other host) that authenticates the clone and carries the push webhook.
`installationId`	`String`	A GitHub App installation that authenticates the clone.
`provider`	`String!`	github \| gitlab \| bitbucket \| gitea \| git. Anything else is stored as git.
`repo`	`String!`
`submodules`	`Boolean`
`triggerType`	`String`	"push" or "tag".
`url`	`String!`
`watchPaths`	`[String!]`

HealthCheckInput

A health check to save. Send null instead to turn it off. An http check needs curl or wget in the image; one that has neither cannot answer, and the container would sit unhealthy.

Field	Type	Description
`command`	`String`
`intervalS`	`Int!`
`path`	`String`
`port`	`Int`
`retries`	`Int!`
`startPeriodS`	`Int!`
`timeoutS`	`Int!`
`type`	`HealthCheckType!`	One of `command`, `http`.

MigrationPlacementInput

Where one service lands. serviceId is the sourceId a scan reports. Omit buildServerId (or send null) for Automatic - Deplo uses a build server if the fleet has one, and compiles where the app runs otherwise.

Field	Type	Description
`buildServerId`	`String`
`exposedPort`	`Int`	A database's host port. Omit the field to keep the port it had over there (what the import has always done); send null to publish nothing; send a number to publish there instead - which is how a review resolves a port something else already holds on the target server. Ignored for anything that is not a database.
`serverId`	`String!`
`serviceId`	`String!`

MigrationRunTargetInput

Field	Type	Description
`buildServerId`	`String`
`exposedPort`	`Int`	A database's host port. THREE values, and the difference matters: omitted keeps the source's own, `null` publishes nothing, a number publishes there.
`projectId`	`String!`
`projectName`	`String!`	Shown while the run works through it, so the runner needs no second read of the API for a name.
`serverId`	`String`
`serviceId`	`String!`

MigrationServerChoiceInput

Map one of the panel's servers onto one of ours. from is that server's id, or the empty string for the panel's own host.

Field	Type	Description
`from`	`String!`
`to`	`String!`

MigrationSourceInput

Field	Type	Description
`apiKey`	`String!`	The panel's API key or token. Dokploy: Settings -> Profile -> API/CLI. Coolify: Keys & Tokens -> API tokens, with `deploy` ticked first, then `read` and `read:sensitive` - without deploy the data step cannot stop a service, without read:sensitive the values and database passwords arrive empty. Use an owner's or admin's either way: a plain member's is refused. Never stored.
`kind`	`MigrationPlatform`	Read the panel as this product. Omit it and Deplo works out which it is from the address and the token. One of `coolify`, `dokploy`.
`url`	`String!`	The panel's address. Deplo appends the API path itself, so paste the address you open in a browser.

MintRegistrationLinkInput

Field	Type	Description
`mode`	`RegistrationMode!`	One of `existing_teams`, `own_team`.
`teamAssignments`	`[RegistrationTeamAssignmentInput!]`

MountInput

A config file a template materialises into its stack at deploy.

Field	Type	Description
`content`	`String!`
`filePath`	`String!`

NodeGrantInput

One capability set, applied to every node named here. Send several to give different nodes different sets.

Field	Type	Description
`appIds`	`[String!]`
`capabilities`	`[Capability!]!`
`folderIds`	`[String!]`
`projectIds`	`[String!]`

PublishedPortInput

A host port an app publishes.

Field	Type	Description
`id`	`String`
`protocol`	`String`
`published`	`Int!`
`target`	`Int!`

RegistrationTeamAssignmentInput

Field	Type	Description
`capabilities`	`[Capability!]`
`role`	`Role!`	One of `member`, `owner`, `viewer`.
`teamId`	`String!`

ResourceLimitsInput

Per-container resource caps. Every field is optional and independently nullable (null => that dimension is uncapped); the form sends the full set on each save. Memory in MiB, disk in GiB, CPU in milli-CPUs (1000 = one core).

Field	Type	Description
`cpuMilli`	`Int`
`cpuShares`	`Int`
`cpuset`	`String`
`memoryMb`	`Int`
`memoryReservationMb`	`Int`
`nofile`	`Int`
`nproc`	`Int`
`oomScoreAdj`	`Int`
`pidsLimit`	`Int`
`shmSizeMb`	`Int`
`storageGb`	`Int`
`swapMb`	`Int`

RoleScopeInput

The nodes a role reaches. Ticking a project, one of its environments or a folder covers everything inside it, now and later; omit the field entirely for the whole team.

Field	Type	Description
`appIds`	`[String!]`
`environmentIds`	`[String!]`
`folderIds`	`[String!]`
`projectIds`	`[String!]`

SaveSharedVarInput

Create (omit id) or update (provide id) one shared variable. It must be shared with something: ≥1 team, ≥1 environment, ≥1 project, or ≥1 app.

Field	Type	Description
`appIds`	`[String!]`	The per-app links, as a whole set. OMIT to leave the existing links untouched - that is what preserves setSharedVarAppLink's app-side toggle.
`environmentIds`	`[ID!]!`
`id`	`String`
`key`	`String!`
`projectIds`	`[ID!]!`
`targets`	`[EnvTarget!]`	One of `preview`, `production`.
`teamIds`	`[ID!]!`	Teams every app of which gets this variable. ONE team => it is only SUGGESTED there and the per-app link injects (ADR-0012); TWO OR MORE => it is injected into every app of every one of them, with no link, at the lowest precedence. The caller must hold `manage_env` across the whole of every team named here.
`type`	`EnvVarType!`	One of `plain`, `secret`.
`value`	`String!`

ServerCertificateInput

A certificate and the private key it was issued for, as PEM text.

Field	Type	Description
`certificate`	`String!`	The certificate in PEM form. Paste the FULL chain: the certificate followed by any intermediates, which browsers need.
`privateKey`	`String!`	The matching private key in PEM form, without a passphrase. It is sent to the server and is never readable afterwards.

SetMemberAccessInput

Deliberately carries no teamId: the active team is the caller's, and an id here would be a way to write another team's memberships.

Field	Type	Description
`capabilities`	`[Capability!]`
`grants`	`[NodeGrantInput!]`
`granular`	`Boolean!`
`roleId`	`String!`
`userId`	`String!`

SetServerTeamsInput

Set which teams may target a server. allTeams: true opens it to every team (clearing specific grants); false restricts it to teamIds.

Field	Type	Description
`allTeams`	`Boolean!`
`serverId`	`String!`
`teamIds`	`[String!]`

SetUserTeamAccessInput

Field	Type	Description
`grants`	`[NodeGrantInput!]`
`granular`	`Boolean!`
`roleId`	`String!`
`teamId`	`String!`
`userId`	`String!`

ShellLabelInput

Field	Type	Description
`appId`	`String!`
`containerName`	`String`

UpdateBackupInput

Field	Type	Description
`destinationId`	`String!`
`name`	`String!`
`retentionCount`	`Int!`
`schedule`	`String!`
`timezone`	`String`

UpdateDatabaseImageInput

Field	Type	Description
`customCommand`	`String`
`customImage`	`String`
`version`	`String`

UpdateDatabaseInput

Field	Type	Description
`exposedPort`	`Int`
`exposedPublicly`	`Boolean!`
`serverId`	`ID`

UpdateDockerCleanupPolicyInput

Save the instance-wide cleanup policy. The scopes are a whole-set replace, so a scope left out is a scope no longer reclaimed.

Field	Type	Description
`enabled`	`Boolean!`
`excludedServerIds`	`[String!]`
`keepImagesPerApp`	`Int!`
`minAgeHours`	`Int!`
`schedule`	`String!`
`scopes`	`[DockerCleanupScope!]!`	One of `build_cache`, `dangling_images`, `leftover_app_files`, `leftover_networks`, `orphan_buildkit_cache`, `unused_app_images`.

UpdateGitConnectionInput

Field	Type	Description
`label`	`String`
`token`	`String`	A replacement token. Omit to keep the stored one.
`username`	`String`

UpdateMemberInput

Field	Type	Description
`capabilities`	`[Capability!]`
`role`	`Role`	One of `member`, `owner`, `viewer`.
`roleId`	`String`
`userId`	`String!`

UpdateRoleInput

Field	Type	Description
`capabilities`	`[Capability!]`
`clearScope`	`Boolean`
`description`	`String`
`id`	`String!`
`name`	`String!`
`requireTwoFactor`	`Boolean`
`scope`	`RoleScopeInput`

UpdateSourceInput

Field	Type	Description
`compose`	`String`
`dockerImage`	`String`
`repo`	`GitRepoInput`
`serverId`	`String`
`source`	`DeploySource!`	One of `COMPOSE`, `DOCKER_IMAGE`, `GIT`, `GITHUB`, `UPLOAD`.

UpdateTeamInput

Field	Type	Description
`name`	`String`
`requireTwoFactor`	`Boolean`

UpdateTokenInput

Field	Type	Description
`appIds`	`[String!]`
`capabilities`	`[Capability!]`
`expiresAt`	`String`
`folderIds`	`[String!]`
`id`	`String!`
`instanceAdmin`	`Boolean`
`name`	`String!`
`projectIds`	`[String!]`
`teamIds`	`[String!]`

UpdateUserAdminInput

Field	Type	Description
`canExposePorts`	`Boolean`
`canMountHostVolumes`	`Boolean`
`isInstanceAdmin`	`Boolean!`
`newPassword`	`String`
`suspended`	`Boolean!`
`userId`	`String!`

UpsertEnvInput

Field	Type	Description
`appId`	`String!`
`key`	`String!`
`targets`	`[EnvTarget!]`	One of `preview`, `production`.
`type`	`EnvVarType!`	One of `plain`, `secret`.
`value`	`String!`

UserTeamInput

Field	Type	Description
`roleId`	`String`
`teamId`	`String!`
`userId`	`String!`

VolumeInput

A persistent volume mounted into an app.

Field	Type	Description
`hostPath`	`String`
`id`	`String`
`mountPath`	`String!`
`name`	`String`
`projectPath`	`String`
`propagation`	`MountPropagation`	One of `rshared`, `rslave`.
`readOnly`	`Boolean`
`service`	`String`
`type`	`String`

On this page