Input types

Every input type in the schema, A to Z. A ! on the type means the field is required.

AddMemberInput

Field	Type	Description
`capabilities`	`[Capability!]`
`role`	`Role`	One of `member`, `owner`, `viewer`.
`roleId`	`String`
`userId`	`String!`

AddRegistryInput

Field	Type	Description
`name`	`String!`
`password`	`String!`
`registryUrl`	`String`
`type`	`RegistryType!`	One of `dockerhub`, `generic`, `ghcr`, `gitlab`.
`username`	`String!`

AddServerInput

Register a remote server. Provisioned by a call-home bootstrap (no SSH-in): you run the returned install command on the box.

Field	Type	Description
`allTeams`	`Boolean`
`buildOnly`	`Boolean`
`host`	`String!`
`importOnly`	`Boolean`
`name`	`String!`
`storageOnly`	`Boolean`
`teamIds`	`[String!]`

AppEnvInput

An initial environment variable for a new app.

Field	Type	Description
`key`	`String!`
`type`	`String`	"plain" or "secret". Omitted is plain - nothing is typed secret on your behalf; a secret is write-only from the moment it lands.
`value`	`String!`

AppPreviewSettingsInput

Field	Type	Description
`autoDeploy`	`Boolean`	Rebuild a preview when its pull request gets a new commit.
`baseDomain`	`String`	e.g. `preview.example.com`, with a wildcard DNS record pointing here. Empty clears it back to the zero-configuration generated default.
`buildDrafts`	`Boolean`	Build a pull request that is still a draft.
`comment`	`Boolean`	Post the preview URL as a comment on the pull request.
`enabled`	`Boolean`
`forkPolicy`	`String`	deny \| approve \| allow.
`https`	`Boolean`	Serve previews over HTTPS. Needs a preview domain.
`maxActive`	`Int`
`port`	`Int`	Container port. Empty => the app's build port.
`requiredLabels`	`String`	Newline-separated labels a pull request must carry. Empty => no filter.
`serverId`	`String`	Where previews run. Empty => the app's own server.
`ttlDays`	`Int`

BuildConfigInput

Partial build configuration; only the provided fields are changed.

Field	Type	Description
`buildCache`	`Boolean`	Reuse the owning server's Docker layer cache between builds of this app (default true). False rebuilds every layer from scratch each time.
`buildCommand`	`String`
`buildMethod`	`String`
`includeFilesOutsideRoot`	`Boolean`
`installCommand`	`String`
`outputDir`	`String`
`port`	`Int`
`rootDir`	`String`
`runtimeVersion`	`String`
`settings`	`JSON`
`skipUnchangedDeployments`	`Boolean`
`startCommand`	`String`

ComposeNameClashesInput

Field	Type	Description
`compose`	`String!`
`environmentId`	`String`
`folderId`	`String`
`projectId`	`String`
`serverId`	`String`

ConnectGitProviderInput

Field	Type	Description
`allowPrivateEndpoint`	`Boolean`	Allow an address inside the deployment, for a git server on your own network. Instance-admin only; refused otherwise.
`baseUrl`	`String!`	Origin of the git host. A bare domain becomes https://; a path or embedded credentials are refused.
`label`	`String!`
`provider`	`String!`	gitlab \| bitbucket \| gitea \| git.
`token`	`String!`	Access token. Write-only.
`username`	`String`	Basic-auth username for the clone. Defaults per provider.

CreateAppFromTemplateInput

Field	Type	Description
`deploy`	`Boolean`	Request the first deployment. Defaults to false; a token also needs deploy_apps.
`environmentId`	`String`
`folderId`	`String`
`name`	`String`	The new App name. Omitted uses the template name.
`projectId`	`String`
`serverId`	`String`
`templateSlug`	`String!`	The catalog template slug from templateVariants.
`variantSlug`	`String`	The variant slug. Omitted uses the "default" variant.

CreateAppInput

Field	Type	Description
`autoDeploy`	`Boolean`
`autoDomain`	`String`
`autoDomainPath`	`String`
`build`	`BuildConfigInput`
`buildServerId`	`String`	Where the app COMPILES, when that is not where it runs. Omitted is Automatic - a build-only server if the fleet has one.
`compose`	`String`
`composePort`	`Int`
`composeService`	`String`
`composeUpArgs`	`String`	Extra flags appended to `docker compose up` for a compose stack. Validated against the same allow-list the app's settings use.
`deploy`	`Boolean`	Whether to start the first deployment. Defaults to true.
`dockerImage`	`String`
`env`	`[AppEnvInput!]`
`environmentId`	`String`
`extraDomains`	`[ExtraDomainInput!]`
`folderId`	`String`
`logo`	`String`
`logoFromTemplate`	`Boolean`	The logo above is a template's own. Deplo reads it once for the plate that keeps a monochrome mark visible on both themes.
`mounts`	`[MountInput!]`
`name`	`String!`
`projectId`	`String`
`renameClashes`	`Boolean`	Rename a service whose name a neighbour on the destination network already answers to (`db` becomes `db-2`), carrying its references, instead of refusing the stack. See `composeNameClashes`.
`repo`	`GitRepoInput`
`serverId`	`String`
`sharedVarIds`	`[String!]`	Shared variables to link to the new app, so its FIRST deploy already carries them (ADR-0012: linking is the injection, and it is opt-in).
`source`	`DeploySource!`	One of `COMPOSE`, `DOCKER_IMAGE`, `GIT`, `GITHUB`, `UPLOAD`.

CreateBackupInput

Field	Type	Description
`appId`	`String`
`databaseId`	`String`
`destinationId`	`String!`
`name`	`String!`
`retentionCount`	`Int!`
`schedule`	`String!`
`targetKind`	`BackupTargetKind`	One of `app`, `database`.
`timezone`	`String`

CreateDatabaseInput

Field	Type	Description
`dbName`	`String`
`environmentId`	`ID`
`exposedPort`	`Int`
`exposedPublicly`	`Boolean`
`name`	`String!`
`password`	`String`
`serverId`	`ID`
`type`	`DatabaseType!`	One of `clickhouse`, `mariadb`, `mongodb`, `mysql`, `postgres`, `redis`.
`username`	`String`
`version`	`String!`

CreateDestinationInput

Field	Type	Description
`accessKey`	`String`
`allowPrivateEndpoint`	`Boolean`
`bucket`	`String`
`endpoint`	`String`
`kind`	`DestinationKind!`	One of `s3`, `server`.
`name`	`String!`
`path`	`String`
`provider`	`S3Provider`	One of `AWS`, `BACKBLAZE_B2`, `CLOUDFLARE_R2`, `DIGITALOCEAN`, `MINIO`, `OTHER`, `WASABI`.
`region`	`String`
`s3ExtraArgs`	`String`
`secretKey`	`String`
`serverId`	`String`

CreateRoleInput

Field	Type	Description
`capabilities`	`[Capability!]`
`description`	`String`
`name`	`String!`
`requireTwoFactor`	`Boolean`
`scope`	`RoleScopeInput`

CreateTokenInput

Field	Type	Description
`appIds`	`[String!]`
`capabilities`	`[Capability!]`
`expiresAt`	`String`
`folderIds`	`[String!]`
`instanceAdmin`	`Boolean`
`mcpAgent`	`String`	The agent this token is for, as the connect wizard names it ("claude-code", "cursor", ...).
`name`	`String!`
`projectIds`	`[String!]`
`teamIds`	`[String!]`

CronJobEnvInput

One extra variable for a job. The value is encrypted at rest and reaches the host inside the mTLS RPC - it is never readable back.

Field	Type	Description
`key`	`String!`
`value`	`String`	Omit (or null) when editing to keep the stored value of an existing variable.

CronJobInput

Every field is optional so one input serves create and edit; create requires name, schedule and command.

Field	Type	Description
`command`	`String`
`description`	`String`
`enabled`	`Boolean`
`env`	`[CronJobEnvInput!]`	Replaces the job's variables wholesale when present.
`keepRuns`	`Int`	10 to 500.
`maxAttempts`	`Int`	1 to 4. 1 means no retry.
`name`	`String`
`overlap`	`String`	skip \| allow.
`schedule`	`String`	5-field cron.
`service`	`String`	Empty => the target's own container.
`shell`	`String`	sh \| bash.
`timeoutSeconds`	`Int`	Per attempt, 1s to 24h.
`timezone`	`String`	IANA zone, e.g. Europe/Rome.
`user`	`String`
`workdir`	`String`

One config file to write next to the database's stack and bind-mount into its container. filePath is relative to the stack's files directory; mountPath is the absolute path inside the container and may not be inside the engine's data directory.

Field	Type	Description
`content`	`String!`
`filePath`	`String!`
`mountPath`	`String!`

DeleteUserInput

Field	Type	Description
`deleteCreatedApps`	`Boolean`
`deleteFoundedTeams`	`Boolean`
`deleteOwnedWorkspaces`	`Boolean`
`userId`	`String!`

DeploMoveServerMapInput

Where one of the old Deplo's servers lands here. A server left out of the map takes its preview target.

Field	Type	Description
`from`	`String!`	The old Deplo's server id.
`to`	`String`	A server id here, from the preview's `choices`. Ignored for a migration source.

DomainConfigInput

Per-domain routing config; an omitted certProvider means no certificate (plain HTTP), unless the add-time DNS check finds the host proxied through Cloudflare, then it is stored as cloudflare.

Field	Type	Description
`certProvider`	`CertProvider`	One of `cloudflare`, `custom`, `letsencrypt`, `none`.
`corsOrigins`	`[String!]`
`entrypoint`	`DomainEntrypoint`	One of `web`, `websecure`.
`middlewares`	`[String!]`
`pathPrefix`	`String`
`port`	`Int`
`proxied`	`Boolean`
`securityHeaders`	`Boolean`	Omitted means on.
`service`	`String`
`stripPrefix`	`Boolean`
`www`	`DomainWwwRedirect`	One of `none`, `toCounterpart`, `toThis`.

DomainPatchInput

Partial domain edit; only the provided fields are changed. Null clears an override.

Field	Type	Description
`certProvider`	`CertProvider`	One of `cloudflare`, `custom`, `letsencrypt`, `none`.
`corsOrigins`	`[String!]`
`entrypoint`	`DomainEntrypoint`	One of `web`, `websecure`.
`middlewares`	`[String!]`
`name`	`String`
`pathPrefix`	`String`
`port`	`Int`
`proxied`	`Boolean`
`securityHeaders`	`Boolean`
`service`	`String`
`stripPrefix`	`Boolean`
`www`	`DomainWwwRedirect`	One of `none`, `toCounterpart`, `toThis`.

EnvEntryInput

Field	Type	Description
`key`	`String!`
`value`	`String!`

ExecConsoleInput

Field	Type	Description
`appId`	`String!`
`command`	`String!`
`containerName`	`String`

ExecDatabaseConsoleInput

Field	Type	Description
`command`	`String!`
`databaseId`	`String!`

ExtraDomainInput

An extra (non-primary) routed host: the compose service + port it targets, its hostname and the path it answers on. No hostname => one is generated. Registered as an auto Domain row at creation; the domains table is the sole routing source after.

Field	Type	Description
`host`	`String`
`path`	`String`
`port`	`Int!`
`service`	`String!`

GitRepoInput

Field	Type	Description
`branch`	`String!`
`connectionId`	`String`	A git connection (any other host) that authenticates the clone and carries the push webhook.
`installationId`	`String`	A GitHub App installation that authenticates the clone.
`provider`	`String!`	github \| gitlab \| bitbucket \| gitea \| git. Anything else is stored as git.
`repo`	`String!`
`submodules`	`Boolean`
`triggerType`	`String`	"push" or "tag".
`url`	`String!`
`watchPaths`	`[String!]`

HealthCheckInput

A health check to save. Send null instead to turn it off. An http check is asked BY DEPLO through the agent, so it works on any image and never changes routing; a command check runs inside the container as a compose healthcheck:.

Field	Type	Description
`command`	`String`
`intervalS`	`Int!`
`path`	`String`
`port`	`Int`
`retries`	`Int!`
`startPeriodS`	`Int!`
`timeoutS`	`Int!`
`type`	`HealthCheckType!`	One of `command`, `http`.

MigrationPlacementInput

Where one service lands. serviceId is the sourceId a scan reports. Omit buildServerId (or send null) for Automatic - Deplo uses a build server if the fleet has one, and compiles where the app runs otherwise.

Field	Type	Description
`buildServerId`	`String`
`exposedPort`	`Int`	A database's host port. Omit the field to keep the port it had over there (what the import has always done); send null to publish nothing; send a number to publish there instead - which is how a review resolves a port something else already holds on the target server. Ignored for anything that is not a database.
`serverId`	`String!`
`serviceId`	`String!`

MigrationQueuedTeamInput

Field	Type	Description
`apiKey`	`String!`	That team's own token - a key reads exactly one team.
`newTeamImage`	`String`
`newTeamName`	`String`
`orgName`	`String`
`servers`	`[MigrationServerChoiceInput!]`
`targets`	`[MigrationRunTargetInput!]!`
`teamId`	`String`	The Deplo team it lands in. Omit to have one created for it now, named by `newTeamName`.

MigrationRunTargetInput

Field	Type	Description
`buildServerId`	`String`
`exposedPort`	`Int`	A database's host port. THREE values, and the difference matters: omitted keeps the source's own, `null` publishes nothing, a number publishes there.
`projectId`	`String!`
`projectName`	`String!`	Shown while the run works through it, so the runner needs no second read of the API for a name.
`serverId`	`String`
`serviceId`	`String!`

MigrationServerChoiceInput

Map one of the panel's servers onto one of ours. from is that server's id, or the empty string for the panel's own host.

Field	Type	Description
`from`	`String!`
`to`	`String!`

MigrationSourceInput

Field	Type	Description
`apiKey`	`String!`	The panel's API key or token. Dokploy: Settings -> Profile -> API/CLI. Coolify: Keys & Tokens -> API tokens, with `root` ticked - a narrower token cannot read values or stop a service, and Deplo refuses it at Connect. Use an owner's or admin's either way: a plain member's is refused. Another Deplo: an API token there, limited to the one team, with Reveal secret values, Start & stop apps and Start & stop databases. Stored encrypted only for as long as the migration needs it, then wiped.
`kind`	`MigrationPlatform`	Read the panel as this product. Omit it and Deplo works out which it is from the address and the token. One of `coolify`, `deplo`, `dokploy`.
`url`	`String!`	The panel's address. Deplo appends the API path itself, so paste the address you open in a browser.

MintRegistrationLinkInput

Field	Type	Description
`mode`	`RegistrationMode!`	One of `existing_teams`, `own_team`.
`teamAssignments`	`[RegistrationTeamAssignmentInput!]`

MountInput

A config file a template materialises into its stack at deploy.

Field	Type	Description
`content`	`String!`
`filePath`	`String!`

NodeGrantInput

One capability set, applied to every node named here. Send several to give different nodes different sets.

Field	Type	Description
`appIds`	`[String!]`
`capabilities`	`[Capability!]!`
`folderIds`	`[String!]`
`projectIds`	`[String!]`

PublishedPortInput

A host port an app publishes.

Field	Type	Description
`id`	`String`
`protocol`	`String`
`published`	`Int!`
`target`	`Int!`

RegistrationTeamAssignmentInput

Field	Type	Description
`capabilities`	`[Capability!]`
`role`	`Role!`	One of `member`, `owner`, `viewer`.
`teamId`	`String!`

ResourceLimitsInput

Per-container resource caps. Every field is optional and independently nullable (null => that dimension is uncapped); the form sends the full set on each save. Memory in MiB, disk in GiB, CPU in milli-CPUs (1000 = one core).

Field	Type	Description
`cpuMilli`	`Int`
`cpuShares`	`Int`
`cpuset`	`String`
`memoryMb`	`Int`
`memoryReservationMb`	`Int`
`nofile`	`Int`
`nproc`	`Int`
`oomScoreAdj`	`Int`
`pidsLimit`	`Int`
`shmSizeMb`	`Int`
`storageGb`	`Int`
`swapMb`	`Int`

RoleScopeInput

The nodes a role reaches. Ticking a project, one of its environments or a folder covers everything inside it, now and later; omit the field entirely for the whole team.

Field	Type	Description
`appIds`	`[String!]`
`environmentIds`	`[String!]`
`folderIds`	`[String!]`
`projectIds`	`[String!]`

SaveSharedVarInput

Create (omit id) or update (provide id) one shared variable. It must be shared with something: ≥1 team, ≥1 environment, ≥1 project, or ≥1 app.

Field	Type	Description
`appIds`	`[String!]`	The per-app links, as a whole set. OMIT to leave the existing links untouched - that is what preserves setSharedVarAppLink's app-side toggle.
`environmentIds`	`[ID!]!`
`id`	`String`
`key`	`String!`
`projectIds`	`[ID!]!`
`targets`	`[EnvTarget!]`	One of `preview`, `production`.
`teamIds`	`[ID!]!`	Teams every app of which gets this variable. ONE team => it is only SUGGESTED there and the per-app link injects (ADR-0012); TWO OR MORE => it is injected into every app of every one of them, with no link, at the lowest precedence. The caller must hold `manage_env` across the whole of every team named here.
`type`	`EnvVarType!`	One of `plain`, `secret`.
`value`	`String!`

ServerCertificateInput

A certificate and the private key it was issued for, as PEM text.

Field	Type	Description
`certificate`	`String!`	The certificate in PEM form. Paste the FULL chain: the certificate followed by any intermediates, which browsers need.
`privateKey`	`String!`	The matching private key in PEM form, without a passphrase. It is sent to the server and is never readable afterwards.

SetMemberAccessInput

Deliberately carries no teamId: the active team is the caller's, and an id here would be a way to write another team's memberships.

Field	Type	Description
`capabilities`	`[Capability!]`
`grants`	`[NodeGrantInput!]`
`granular`	`Boolean!`
`roleId`	`String!`
`userId`	`String!`

SetServerTeamsInput

Set which teams may target a server. allTeams: true opens it to every team (clearing specific grants); false restricts it to teamIds.

Field	Type	Description
`allTeams`	`Boolean!`
`serverId`	`String!`
`teamIds`	`[String!]`

SetUserTeamAccessInput

Field	Type	Description
`grants`	`[NodeGrantInput!]`
`granular`	`Boolean!`
`roleId`	`String!`
`teamId`	`String!`
`userId`	`String!`

ShellLabelInput

Field	Type	Description
`appId`	`String!`
`containerName`	`String`

TraefikLabelInput

Field	Type	Description
`key`	`String!`
`value`	`String!`

UpdateBackupInput

Field	Type	Description
`destinationId`	`String!`
`name`	`String!`
`retentionCount`	`Int!`
`schedule`	`String!`
`timezone`	`String`

UpdateDatabaseImageInput

Field	Type	Description
`customCommand`	`String`
`customImage`	`String`
`version`	`String`

UpdateDatabaseInput

Field	Type	Description
`exposedPort`	`Int`
`exposedPublicly`	`Boolean!`
`serverId`	`ID`

UpdateDockerCleanupPolicyInput

Save the instance-wide cleanup policy. The scopes are a whole-set replace, so a scope left out is a scope no longer reclaimed.

Field	Type	Description
`enabled`	`Boolean!`
`excludedServerIds`	`[String!]`
`keepImagesPerApp`	`Int!`
`minAgeHours`	`Int!`
`schedule`	`String!`
`scopes`	`[DockerCleanupScope!]!`	One of `build_cache`, `dangling_images`, `leftover_app_files`, `leftover_networks`, `orphan_volumes`, `unused_app_images`, `unused_pulled_images`.

UpdateGitConnectionInput

Field	Type	Description
`label`	`String`
`token`	`String`	A replacement token. Omit to keep the stored one.
`username`	`String`

UpdateMemberInput

Field	Type	Description
`capabilities`	`[Capability!]`
`role`	`Role`	One of `member`, `owner`, `viewer`.
`roleId`	`String`
`userId`	`String!`

UpdateRoleInput

Field	Type	Description
`capabilities`	`[Capability!]`
`clearScope`	`Boolean`
`description`	`String`
`id`	`String!`
`name`	`String!`
`requireTwoFactor`	`Boolean`
`scope`	`RoleScopeInput`

UpdateSourceInput

Field	Type	Description
`compose`	`String`
`dockerImage`	`String`
`repo`	`GitRepoInput`
`serverId`	`String`
`source`	`DeploySource!`	One of `COMPOSE`, `DOCKER_IMAGE`, `GIT`, `GITHUB`, `UPLOAD`.

UpdateTeamInput

Field	Type	Description
`name`	`String`
`requireTwoFactor`	`Boolean`

UpdateTokenInput

Field	Type	Description
`appIds`	`[String!]`
`capabilities`	`[Capability!]`
`expiresAt`	`String`
`folderIds`	`[String!]`
`id`	`String!`
`instanceAdmin`	`Boolean`
`name`	`String!`
`projectIds`	`[String!]`
`teamIds`	`[String!]`

UpdateUserAdminInput

Field	Type	Description
`canConfigureTraefik`	`Boolean`
`canExposePorts`	`Boolean`
`canMountHostVolumes`	`Boolean`
`isInstanceAdmin`	`Boolean!`
`newPassword`	`String`
`suspended`	`Boolean!`
`userId`	`String!`

UpsertEnvInput

Field	Type	Description
`appId`	`String!`
`key`	`String!`
`targets`	`[EnvTarget!]`	One of `preview`, `production`.
`type`	`EnvVarType!`	One of `plain`, `secret`.
`value`	`String!`

UserTeamInput

Field	Type	Description
`roleId`	`String`
`teamId`	`String!`
`userId`	`String!`

VolumeInput

A persistent volume mounted into an app.

Field	Type	Description
`hostPath`	`String`
`id`	`String`
`mountPath`	`String!`
`name`	`String`
`projectPath`	`String`
`propagation`	`MountPropagation`	One of `rshared`, `rslave`.
`readOnly`	`Boolean`
`service`	`String`
`type`	`VolumeKind`	One of `app`, `host`, `named`, `service`.

AddMemberInputCopy Anchor Link

AddRegistryInputCopy Anchor Link

AddServerInputCopy Anchor Link

AppEnvInputCopy Anchor Link

AppPreviewSettingsInputCopy Anchor Link

BuildConfigInputCopy Anchor Link

ComposeNameClashesInputCopy Anchor Link

ConnectGitProviderInputCopy Anchor Link

CreateAppFromTemplateInputCopy Anchor Link

CreateAppInputCopy Anchor Link

CreateBackupInputCopy Anchor Link

CreateDatabaseInputCopy Anchor Link

CreateDestinationInputCopy Anchor Link

CreateRoleInputCopy Anchor Link

CreateTokenInputCopy Anchor Link

CronJobEnvInputCopy Anchor Link

CronJobInputCopy Anchor Link

DatabaseMountInputCopy Anchor Link

DeleteUserInputCopy Anchor Link

DeploMoveServerMapInputCopy Anchor Link

DomainConfigInputCopy Anchor Link

DomainPatchInputCopy Anchor Link

EnvEntryInputCopy Anchor Link

ExecConsoleInputCopy Anchor Link

ExecDatabaseConsoleInputCopy Anchor Link

ExtraDomainInputCopy Anchor Link

GitRepoInputCopy Anchor Link

HealthCheckInputCopy Anchor Link

MigrationPlacementInputCopy Anchor Link

MigrationQueuedTeamInputCopy Anchor Link

MigrationRunTargetInputCopy Anchor Link

MigrationServerChoiceInputCopy Anchor Link

MigrationSourceInputCopy Anchor Link

MintRegistrationLinkInputCopy Anchor Link

MountInputCopy Anchor Link

NodeGrantInputCopy Anchor Link

PublishedPortInputCopy Anchor Link

RegistrationTeamAssignmentInputCopy Anchor Link

ResourceLimitsInputCopy Anchor Link

RoleScopeInputCopy Anchor Link

SaveSharedVarInputCopy Anchor Link

ServerCertificateInputCopy Anchor Link

SetMemberAccessInputCopy Anchor Link

SetServerTeamsInputCopy Anchor Link

SetUserTeamAccessInputCopy Anchor Link

ShellLabelInputCopy Anchor Link

TraefikLabelInputCopy Anchor Link

UpdateBackupInputCopy Anchor Link

UpdateDatabaseImageInputCopy Anchor Link

UpdateDatabaseInputCopy Anchor Link

UpdateDockerCleanupPolicyInputCopy Anchor Link

UpdateGitConnectionInputCopy Anchor Link

UpdateMemberInputCopy Anchor Link

UpdateRoleInputCopy Anchor Link

UpdateSourceInputCopy Anchor Link

UpdateTeamInputCopy Anchor Link

UpdateTokenInputCopy Anchor Link

UpdateUserAdminInputCopy Anchor Link

UpsertEnvInputCopy Anchor Link

UserTeamInputCopy Anchor Link

VolumeInputCopy Anchor Link

On this page