Object types

Every object type in the schema, A to Z. Pick fields from these tables when you write a selection set. A field that takes arguments lists them in its description.

AccessNodeGrant

A capability set attached to one project, folder or app. It REPLACES the team role's set inside that node, and may grant more than the role does.

Field	Type	Description
`capabilities`	`[Capability!]`
`kind`	`AccessNodeKind`
`name`	`String`
`nodeId`	`ID`

Activity

A single audit-log event in the active team's timeline.

Field	Type	Description
`actor`	`String`
`actorProvider`	`String`	The git host `actor` is a login on, when a webhook push wrote this row (`github`, `gitlab`, `bitbucket`, `gitea`). Null for a person on this instance and for an actor with no host, like `system`.
`actorUser`	`VarAuthor`
`actorUserId`	`ID`
`appId`	`ID`
`createdAt`	`String`
`cursor`	`String`
`databaseId`	`ID`
`id`	`ID`
`message`	`String`
`teamId`	`ID`
`type`	`ActivityType`

AddServerPayload

A newly registered server + its one-time agent install command.

Field	Type	Description
`installCommand`	`String`	Paste-on-the-server command to provision the agent. Shown once; embeds a single-use token.
`server`	`Server`

A PERSONAL API token: it belongs to the person who minted it, and nobody else can list, edit or revoke it. Only the prefix is ever exposed - the raw token is shown once at creation and only its hash is persisted.

Field	Type	Description
`appIds`	`[String!]`	Individually-named apps in the scope.
`capabilities`	`[String!]`	What this token itself may do. Its effective power is this set intersected with what its creator can still do in the team, so a token can never outlive the access of the member who minted it.
`createdAt`	`String`
`expired`	`Boolean`	Whether the expiry above has passed. Answered by the server, so a client with a wrong clock cannot disagree about whether a credential still works.
`expiresAt`	`String`	When this token stops working. Null means never, which is what a token minted before expiries existed still is. An expired token resolves to nothing everywhere - the API, MCP and deploy hooks alike.
`folderIds`	`[String!]`	Whole folders in the scope: every app in them and in the folders nested under them. Most apps live in a folder, so this is usually the level a scope is drawn at.
`id`	`ID`
`instanceAdmin`	`Boolean`	The token may administer the whole instance (users, servers and the global environment), not just its team. Mutually exclusive with a project scope.
`lastUsedAt`	`String`
`mcp`	`Boolean`	Whether this credential drives Deplo over MCP: minted by approving an OAuth consent, or a bearer token that has already called the MCP server. The question a company asks is which of its tokens an AI agent holds, and either shape answers yes.
`name`	`String`
`oauthClientName`	`String`	Set when this token was minted by connecting an AI client over OAuth rather than from the tokens page. `updateToken` re-authors it like any other: the client sees the new permissions on its next call.
`prefix`	`String`
`projectIds`	`[String!]`	Whole projects in the scope: every app in them, now and later. Naming one narrows the token inside that team, so the team-wide permissions it holds (managing members, roles, databases) stop applying there.
`scoped`	`Boolean`	Whether this token is limited at all. False means every team its owner may use API tokens in, and everything in it.
`teamIds`	`[String!]`	Whole teams in the scope: every project and every app in them.

App

A deployable application owned by a team.

Field	Type	Description
`autoDeploy`	`Boolean`
`buildFallback`	`Boolean`	Build somewhere else when this app's build server cannot be reached, saying so in the deploy log: the servers marked as a build fallback (the Deplo host by default), then the app's own server. True by default. False fails the deploy instead, for whoever chose a small deploy server on purpose.
`buildServerId`	`ID`	The server that BUILDS this app's image, when that is not `serverId`. Null is Automatic: a build-only server if the fleet has one this team can reach and its architecture matches, otherwise build where the app runs. Setting it to `serverId` means 'always build on this app's own server'. Ignored by a compose stack and a docker-image source, neither of which Deplo builds.
`compose`	`String`	The authored compose file. Its inline values are masked unless you can configure the app.
`composeUpArgs`	`String`	Extra flags this app appends to the `docker compose up` that brings it up, or null for the untouched command. Additive only - the flags that choose the project, stack file or env-file are refused.
`createdAt`	`String`
`dataCopyError`	`String`	Why this app's data did not arrive, when a migration tried to copy it and could not. Empty for every app that was never migrated and every copy that worked. While it is set, deploying and starting this app are refused - its volumes are empty or half written - and `deployWithoutMigratedData` is how someone accepts that and unblocks it.
`deployHookEnabled`	`Boolean`	Whether this app's deploy hook answers. The hook URL itself is never a field - read it back with revealAppDeployHook.
`deployments`	`[Deployment!]`	The app's most recent deployments, newest first (capped so a nested query can't fan out over the whole history + per-deployment logs).
`dockerImage`	`String`
`domainCount`	`Int`
`folderId`	`ID`
`framework`	`String`	The JavaScript framework backing this app ("nextjs", "astro", "nestjs", ...), or null when none was found or the app doesn't build with one of the auto-detecting builders (Nixpacks / Railpack). Detected on every deploy, unless setAppFramework has corrected it - in which case that choice is what this returns.
`frameworkDetected`	`String`	What the LAST DEPLOY actually read from the source, ignoring any correction. Equals `framework` unless the user overrode it.
`healthCheck`	`HealthCheck`	The health check baked into this app's compose, or null when it has none.
`id`	`ID`
`latestDeployment`	`Deployment`
`logo`	`String`
`logoTone`	`String`	The plate this app's icon needs to stay visible: "dark" for a mark drawn only in black, "light" for one drawn only in white. Set only when the logo came from a template - an uploaded or detected one is drawn exactly as it is.
`name`	`String`
`ports`	`[PublishedPort!]`	Host ports this app publishes. Empty for a compose stack, which publishes its own in its compose file.
`productionUrl`	`String`
`projectId`	`ID`	The Project container this app belongs to, if any.
`resources`	`ResourceLimits`	Per-app resource caps applied at deploy time, or null when the app has no limits set.
`restartLoopGuard`	`Boolean`	Whether Deplo stops this app's container once it has restarted 10 times in half an hour. On by default; off lets it keep crashing.
`restartLoopStoppedAt`	`String`	When restart loop protection last stopped this app, or null. Cleared by a start or a successful deploy.
`rollbackKeep`	`Int`	How many previous deployments this app can be rolled back to (0-20, default 3). Retention: its server keeps this many of the app's images behind the running one. 0 means there is nothing to go back to.
`serverId`	`ID`
`slug`	`String`
`source`	`DeploySource`
`status`	`AppStatus`
`teamId`	`ID`
`updatedAt`	`String`
`volumes`	`[Volume!]`	Persistent volumes mounted into this app.

AppEnvGroup

One app together with all of its env vars.

Field	Type	Description
`app`	`AppEnvGroupApp`
`vars`	`[EnvVar!]`

AppEnvGroupApp

Field	Type	Description
`id`	`ID`
`name`	`String`
`slug`	`String`

AppPreview

An ephemeral deploy of one App for one open pull request, running as its own stack deplo-<slug>__pr-<n> with its own URL. Not an App and not an Environment.

Field	Type	Description
`appId`	`ID`
`approved`	`Boolean`	A fork's pull request only builds once a member with `deploy` approves it.
`approvedSha`	`String`
`author`	`String`
`baseBranch`	`String`
`closed`	`Boolean`
`createdAt`	`String`
`headBranch`	`String`
`headRepo`	`String`
`host`	`String`
`id`	`ID`
`isFork`	`Boolean`	The head lives in a repository the operator does not control, so its code is untrusted and it never receives secret-typed variables.
`latestDeploymentId`	`ID`
`prNumber`	`Int`
`pullRequestUrl`	`String`
`status`	`String`	blocked \| queued \| building \| active \| error \| idle.
`title`	`String`
`updatedAt`	`String`
`url`	`String`

AppPreviewsView

Everything the Pull requests page renders in one read: whether previews can work at all, the branch they watch, the app's settings, and the previews.

Field	Type	Description
`appId`	`ID`
`autoDeploy`	`Boolean`
`baseDomain`	`String`
`branch`	`String`	Pull requests must target this branch to get a preview.
`buildDrafts`	`Boolean`
`comment`	`Boolean`
`enabled`	`Boolean`
`forkPolicy`	`String`
`githubSettingsUrl`	`String`
`https`	`Boolean`
`maxActive`	`Int`
`port`	`Int`
`previews`	`[AppPreview!]`
`requiredLabels`	`[String!]`
`serverId`	`String`
`ttlDays`	`Int`
`unavailable`	`String`	null => previews work. Otherwise the ONE reason they cannot: not-github \| no-installation \| app-needs-update \| disabled.

AppRuntime

What an app's containers are ACTUALLY doing on the host, read live from the owning agent. App.status only records the last thing the control plane asked for (deploy / start / stop), so it keeps saying 'active' for an app that has been crash-looping since its deploy succeeded.

Field	Type	Description
`containers`	`[RuntimeContainer!]`
`missing`	`[String!]`	Declared services with NO container on the host - the failure the running/total counts cannot see, because a container that was never created is not there to be counted as stopped.
`restarting`	`Int`
`running`	`Int`
`total`	`Int`
`unhealthy`	`Int`	Containers that are running and failing their own healthcheck - up, listening, and broken.
`unreachable`	`Boolean`	The agent did not answer: the counts are unknown, not zero.

AppSharedVar

A shared variable as seen from one app. linked is the explicit opt-in (the only thing that injects - ADR-0012); inScope/scope say whether an availability scope suggests it here.

Field	Type	Description
`autoInject`	`Boolean`	It lands here with no link and cannot be removed from this app.
`id`	`ID`
`inScope`	`Boolean`	An availability scope (team / environment / project) covers this app.
`key`	`String`
`linked`	`Boolean`	The app opted in - the var injects on its next deploy.
`masked`	`Boolean`
`ownerTeamName`	`String`	The team behind an auto-injected variable.
`scope`	`String`	The most specific covering scope: teamWide \| environment \| project.
`targets`	`[EnvTarget!]`
`type`	`EnvVarType`
`updatedAt`	`String`
`updatedBy`	`VarAuthor`
`value`	`String`	Masked for secrets, like SharedVar.value.

AppStorageFile

The file behind a File storage entry, where a path that does not exist yet is a normal answer rather than an error.

Field	Type	Description
`path`	`String`
`state`	`String`
`text`	`String`

AppTransferInfo

What a transfer of this app would cost, plus the teams that could take it.

Field	Type	Description
`appName`	`String`
`backupCount`	`Int`	Backup schedules targeting this app - removed on transfer, because they point at the current team's backup destination.
`cronCount`	`Int`	Cron jobs of this app - removed on transfer.
`databasesLost`	`[String!]`	Databases of the current team this app names by host. They stay behind, so the app stops reaching them once it moves.
`gitConnectionLabel`	`String`	The git connection authenticating this app's clone, or null. It is always dropped on transfer - a token is owned by the current team and cannot be assumed to reach the repository from another one.
`githubConnected`	`Boolean`
`homeLabel`	`String`	Where the app currently sits in its team ("folder Marketing"), or null at the top level. It leaves that home on transfer.
`peopleLosingAccess`	`Int`	People granted this app on its own (a per-app grant or a role scoped to it). Those grants are removed on transfer.
`running`	`Boolean`	True when the app is live: it restarts briefly on the new team's network. Nothing is rebuilt.
`serverName`	`String`
`sharedVarCount`	`Int`	Shared variables linked to this app. The links do not survive the move (the variables belong to the current team).
`targets`	`[AppTransferTarget!]`
`tokensLosingAccess`	`Int`	API tokens limited to this app. They lose it on transfer.

AppTransferTarget

A team the viewer could hand this app to - one of their OWN other teams where they hold the deploy capability.

Field	Type	Description
`avatarUrl`	`String`
`githubFollows`	`Boolean`	True when the repository connection survives the move, because that team has its own GitHub App installed on the repository's account. False => the connection and auto-deploy are dropped and must be reconnected there. Always true when the app has no GitHub connection.
`id`	`ID`
`name`	`String`
`serverAvailable`	`Boolean`	False when the app's server is restricted and not shared with that team - the transfer is refused until an instance admin grants access.

AuthPayload

Field	Type	Description
`requiresTwoFactor`	`Boolean`	The password was correct but the account has 2FA: no session yet. Send a code to `verifyTwoFactorLogin`.
`viewer`	`Viewer`

Backup

A scheduled backup of a database or project to a backup destination.

Field	Type	Description
`appId`	`ID`
`createdAt`	`String`
`databaseId`	`ID`
`databaseName`	`String`
`destinationId`	`ID`
`destinationName`	`String`
`enabled`	`Boolean`
`id`	`ID`
`lastRunAt`	`String`
`lastStatus`	`BackupStatus`
`name`	`String`
`retentionCount`	`Int`	How many backups this schedule keeps at its destination. A count, not a window in days.
`schedule`	`String`	Cron expression.
`serviceName`	`String`
`targetKind`	`BackupTargetKind`
`teamId`	`ID`
`timezone`	`String`	IANA zone the cron is read in. UTC for older schedules.

BackupDestination

Where a team's backup artifacts are kept: an S3-compatible bucket, or a directory on a server in the fleet. Secrets are masked and the recovery key is never a field - it has its own mutation, which records who took it.

Field	Type	Description
`accessKeyMasked`	`String`
`allowPrivateEndpoint`	`Boolean`	Whether this bucket is allowed to live on a private address. Instance-admin only to set.
`bucket`	`String`
`createdAt`	`String`
`encrypted`	`Boolean`	Whether artifacts written here are encrypted. Always true for a server destination, and for any bucket connected since bucket artifacts started being encrypted.
`endpoint`	`String`
`freeBytes`	`Float`
`id`	`ID`
`kind`	`DestinationKind`
`lastTestAt`	`String`
`lastTestError`	`String`
`name`	`String`
`path`	`String`
`provider`	`S3Provider`
`recoveryKeySavedAt`	`String`
`region`	`String`
`resolvedPath`	`String`
`s3ExtraArgs`	`String`	Advanced per-store quirk flags, as typed. Null when none. A server whose agent is too old ignores them and Deplo says so.
`serverId`	`ID`
`serverName`	`String`
`status`	`DestinationStatus`
`teamId`	`ID`
`totalBytes`	`Float`
`where`	`String`

BackupDestinationOption

A backup destination as a picker shows it. No credentials, no test history: readable by anyone who may schedule or run a backup, including a member scoped to one folder.

Field	Type	Description
`encrypted`	`Boolean`
`id`	`ID`
`kind`	`DestinationKind`
`name`	`String`
`recoveryKeySavedAt`	`String`
`serverId`	`ID`
`status`	`DestinationStatus`
`where`	`String`

BackupRun

One executed backup - a single dump+upload artifact, and the source for an in-place restore.

Field	Type	Description
`appId`	`ID`
`backupId`	`ID`	The owning schedule, or null for an ad-hoc run.
`databaseId`	`ID`
`destinationId`	`ID`
`error`	`String`
`finishedAt`	`String`
`id`	`ID`
`objectKey`	`String`	Object key of the stored artifact.
`sizeBytes`	`Float`
`startedAt`	`String`
`status`	`BackupRunStatus`
`targetKind`	`BackupTargetKind`
`teamId`	`ID`
`verified`	`Boolean`	Whether Deplo recorded a checksum when it wrote this artifact, and can therefore prove on restore that the file has not been replaced. False for runs taken before integrity checking shipped.

BasicAuthUser

An HTTP Basic Auth credential that gates every domain of an app. The password is never a field - read one back with revealBasicAuthPassword.

Field	Type	Description
`createdAt`	`String`
`createdBy`	`VarAuthor`	Who added the credential.
`id`	`ID`
`imported`	`Boolean`	The credential was carried over from another platform verbatim, so it never went through Deplo's password rules. Shown as a warning next to the user.
`updatedAt`	`String`
`updatedBy`	`VarAuthor`	Who last changed its password.
`username`	`String`

BuildServerChoice

One entry in the 'Build on' picker: a host this team may compile on.

Field	Type	Description
`buildFallback`	`Boolean`	Whether this host takes over when an app's own build server cannot be reached. True on the Deplo host by default; setServerBuildFallback is what changes it.
`buildOnly`	`Boolean`	True for a host dedicated to building (it runs no apps). False for an ordinary server that would build for this app in addition to hosting its own.
`hostArch`	`String`	Its CPU architecture ("amd64" \| "arm64"), or "" when the agent is too old to report one. An image only runs on a host of the same architecture, so a choice whose arch differs from the app's server must be disabled rather than offered.
`id`	`ID`
`isDeploHost`	`Boolean`	Whether this is the host running Deplo itself, as opposed to a remote that only runs the deploy agent.
`name`	`String`

BulkAppActionResult

The outcome of a bulk action: how many apps it ran on, how many refused or failed, and the first failure's message. Apps the caller can't reach are not counted at all.

Field	Type	Description
`error`	`String`
`failed`	`Int`
`ok`	`Int`

CertificateAccount

One server's Let's Encrypt account, read from that host's own proxy configuration. email is null when Deplo cannot manage certificates there; unavailable says why, in the host's own words.

Field	Type	Description
`customCertificates`	`Int`	How many certificates the operator installed on this host themselves (see `serverCertificates`).
`email`	`String`
`expiresInDays`	`Int`	Whole days until the first of those expires, negative once one has, null when there are none. Nothing renews a certificate installed by hand, so this is the only warning there is.
`serverId`	`String`
`serverName`	`String`
`unavailable`	`String`

ComposeNameClash

A service name this stack shares with an app or database already on the destination network, and what the rename would call it.

Field	Type	Description
`name`	`String`
`owner`	`String`	The app or database already answering to the name.
`renamedTo`	`String`	The free name `createApp(renameClashes: true)` would use.

ConsoleInfo

Console attach info for an app (no shell probe - fetch the shell label separately via shellLabel).

Field	Type	Description
`containerName`	`String`
`image`	`String`
`instances`	`[ConsoleInstance!]`
`running`	`Boolean`

ConsoleInstance

A single attachable container in an app's stack.

Field	Type	Description
`exposed`	`Boolean`
`image`	`String`
`name`	`String`
`openStdin`	`Boolean`
`running`	`Boolean`
`service`	`String`
`tty`	`Boolean`
`user`	`String`
`workdir`	`String`

ContainerInstanceMetrics

Live resource usage for ONE container of an app/database stack - the Monitoring tab's per-container breakdown. net_* / block_* are cumulative byte counters since the container started.

Field	Type	Description
`blockRead`	`Float`
`blockWrite`	`Float`
`cpu`	`Float`
`health`	`String`	The healthcheck verdict when the image defines one: healthy \| unhealthy \| starting. EMPTY means there is no healthcheck at all, which is not a synonym for healthy.
`memLimit`	`Float`
`memPct`	`Float`
`memUsed`	`Float`
`name`	`String`
`netNsHost`	`Boolean`	This container is on the host's network (`network_mode: host`), so net_rx/net_tx are 0 here - its traffic is the machine's, on the server's own network chart.
`netNsId`	`Float`	The container's network namespace. Two containers reporting the same one (a sidecar on `network_mode: service:x`) read the SAME counters, and the stack total counts them once. 0 from an older agent.
`netRx`	`Float`
`netTx`	`Float`
`pids`	`Int`
`restartCount`	`Int`	How many times docker has restarted this container - what tells a container that is starting from one that has been dying for an hour.
`running`	`Boolean`
`state`	`String`	Raw docker state: running \| restarting \| exited \| created \| paused \| dead \| removing. Empty from an agent too old to report it.

ContainerMetrics

A fresh live metrics snapshot for one app/database stack: the aggregate across its containers, plus the per-container breakdown and an unsupported flag (the owning server's agent is too old for per-container metrics - the tab shows 'update the agent').

Field	Type	Description
`blockRead`	`Float`
`blockWrite`	`Float`
`containers`	`Int`
`cpu`	`Float`
`hostCores`	`Int`	The owning machine's core count - see the sample type.
`id`	`ID`
`instances`	`[ContainerInstanceMetrics!]`	Per-container usage (multi-container stacks). Live only.
`memLimit`	`Float`
`memPct`	`Float`
`memUsed`	`Float`
`netRx`	`Float`
`netTx`	`Float`
`online`	`Boolean`
`pids`	`Int`
`running`	`Int`
`ts`	`Float`
`unsupported`	`Boolean`

ContainerMetricsSample

One buffered aggregate metrics sample for an app/database stack (the sum across its running containers) - what the Monitoring tab's charts seed from. net_* / block_* are cumulative bytes; the client derives bytes/sec from the delta between consecutive samples.

Field	Type	Description
`blockRead`	`Float`
`blockWrite`	`Float`
`containers`	`Int`
`cpu`	`Float`
`hostCores`	`Int`	The owning machine's core count. `cpu` is a percentage of ONE core (like `docker stats` and htop), so 299% is three busy cores of this many. 0 before the first frame.
`id`	`ID`
`memLimit`	`Float`
`memPct`	`Float`
`memUsed`	`Float`
`netRx`	`Float`
`netTx`	`Float`
`online`	`Boolean`
`pids`	`Int`
`running`	`Int`
`ts`	`Float`

CreateTokenPayload

Result of creating a token. raw is the full secret and is returned only here, once - store it now, it cannot be recovered later.

Field	Type	Description
`raw`	`String`	The full token secret. Shown once and never again.
`token`	`ApiToken`

CronJob

A command run inside one container of an App or a Database, on a cron schedule, in the job's own timezone. Running it produces a CronRun.

Field	Type	Description
`appId`	`ID`
`command`	`String`
`createdAt`	`String`
`databaseId`	`ID`
`description`	`String`
`enabled`	`Boolean`
`envKeys`	`[String!]`	The NAMES of the job's extra variables. The values are write-only and have no read path.
`id`	`ID`
`keepRuns`	`Int`
`lastRunAt`	`String`
`lastStatus`	`String`
`lastSuccessAt`	`String`	The last time it actually worked. Separate from lastRunAt so a job quietly skipped for a week (its container is stopped) is visible.
`maxAttempts`	`Int`	Launches per scheduled fire. 1 means no retry.
`name`	`String`
`nextRunAt`	`String`	Computed, never stored, from the clock of whoever asked. Null while the job is disabled. It is a snapshot, not a countdown: re-read it rather than letting an old answer age into the past.
`overlap`	`String`	skip \| allow - what happens when the previous run is still going.
`running`	`Boolean`	A run of this job is in flight. Not the same as lastStatus, which is written when a run SETTLES and so never says `running`.
`schedule`	`String`	5-field cron.
`service`	`String`	Compose service to run in. Null means the target's own container - the only possibility for a database. Never a container name: a redeploy mints new ones, so it is resolved live before every attempt.
`shell`	`String`	sh \| bash.
`targetKind`	`String`	app \| database.
`timeoutSeconds`	`Int`	Per ATTEMPT - it is the agent's exec deadline. timeout x attempts is capped at 24 hours.
`timezone`	`String`	IANA zone the schedule is read in. NOT UTC unless you say so.
`updatedAt`	`String`
`user`	`String`
`workdir`	`String`

CronJobsView

Everything a Cron jobs page renders in one read.

Field	Type	Description
`enabled`	`Boolean`	The per-target master switch. While false the scheduler skips every job here, and the jobs themselves are untouched.
`jobs`	`[CronJob!]`
`primaryService`	`String`	Where a job that names no service runs: the service the app's domain routes to, else the first declared. Null for a database.
`services`	`[String!]`	Compose services a job can target. Empty for a database.
`targetId`	`ID`
`targetKind`	`String`

CronRun

One scheduled fire of a cron job, retries included.

Field	Type	Description
`actor`	`String`
`attempt`	`Int`	0-based. The output below is this attempt's, not the first's.
`command`	`String`
`container`	`String`
`error`	`String`	Why it failed or was skipped. Not command output.
`exitCode`	`Int`
`finishedAt`	`String`
`id`	`ID`
`jobId`	`ID`
`maxAttempts`	`Int`
`retrying`	`Boolean`	Running, but waiting out a retry backoff rather than executing.
`scheduledFor`	`String`
`startedAt`	`String`
`status`	`String`	running \| succeeded \| failed \| timedout \| skipped \| lost. `skipped` never started (the container was stopped, or the previous run was still going) and `lost` means the outcome is unknown - the agent restarted mid-run. Neither is a failure.
`stderr`	`String`
`stdout`	`String`	Last 16 KiB - the tail.
`trigger`	`String`	schedule \| manual.

Database

A provisioned database container owned by a team. The connection string is masked; reveal it with the revealConnection mutation.

Field	Type	Description
`connectionStringMasked`	`String`
`createdAt`	`String`
`customCommand`	`String`	Expert override: replaces the container command verbatim (redis's default command carries --requirepass - omit it and auth is off). Null unless you can configure databases: a command can carry a password.
`customImage`	`String`	Expert override: the full image ref replacing the derived engine image; the version field is inert while set.
`dataCopyError`	`String`	Why this database's data did not arrive, when a migration tried to copy it and could not. Empty in the common case. While it is set, restarting and redeploying are refused: an engine started on the emptied volume initialises a NEW database over the old one's place. `startWithoutMigratedData` accepts that; `rebuildDatabase` also clears it, since a factory reset makes the empty volume the intended state.
`dbName`	`String`
`environmentId`	`ID`	The Environment this database lives in, which is also the network it answers on. Null => the team's top level.
`exposedPort`	`Int`
`exposedPublicly`	`Boolean`
`host`	`String`
`id`	`ID`
`logo`	`String`	Uploaded display logo as an image data-URI, or null to fall back to the engine's own brand mark (which is what the UI draws by default).
`mounts`	`[DatabaseMount!]`	Expert override: the engine's own config files, written next to the stack and bind-mounted into the container. Empty for almost every database, and for anyone who can't configure databases - a config file can carry a password. Saving them applies immediately.
`name`	`String`	Display name, editable with renameDatabase. Not the container's identity - `host` is, and it is fixed at creation.
`port`	`Int`
`resources`	`ResourceLimits`	Per-database resource caps applied at provision/redeploy time, or null when no limits are set.
`restartLoopGuard`	`Boolean`	Whether Deplo stops this database's container once it has restarted 10 times in half an hour. On by default.
`restartLoopStoppedAt`	`String`	When restart loop protection last stopped this database, or null. Cleared by a start or a restart.
`serverId`	`ID`
`sizeMb`	`Int`
`status`	`DatabaseStatus`
`teamId`	`ID`
`type`	`DatabaseType`
`username`	`String`
`version`	`String`

DatabaseMount

One config file of a database: its name in the stack's files directory, its body, and where it is mounted inside the container.

Field	Type	Description
`content`	`String`
`filePath`	`String`
`mountPath`	`String`

DatabaseTransferInfo

What a transfer of this database would cost, plus the teams that could take it.

Field	Type	Description
`backupCount`	`Int`	Backup schedules for this database - removed on transfer, because they write to the current team's storage. Backups already taken stay.
`cronCount`	`Int`	Cron jobs for this database - removed on transfer.
`databaseName`	`String`
`environmentName`	`String`	The Environment it sits in, or null at the top level. It lands at the top level of the new team.
`running`	`Boolean`
`serverName`	`String`
`targets`	`[DatabaseTransferTarget!]`
`usedBy`	`[String!]`	Apps of the current team whose variables or compose name this database's host. They stop reaching it once it leaves.

DatabaseTransferTarget

A team the viewer could hand this database to - one of their own other teams where they hold move_databases.

Field	Type	Description
`avatarUrl`	`String`
`id`	`ID`
`name`	`String`
`nameTaken`	`Boolean`	True when that team already has a database with this name - the transfer is refused until one of them is renamed.
`serverAvailable`	`Boolean`	False when the database's server is not shared with that team - the transfer is refused until an instance admin grants access.

DeleteUserImpact

Exactly what permanently deleting an account would take with it - read live so the confirmation states facts, not warnings.

Field	Type	Description
`blockedReason`	`String`	Non-null => this account can't be deleted at all; the reason to show.
`createdAppCount`	`Int`
`foundedTeams`	`[DeleteUserTeamImpact!]`	Teams they founded that still have other members - deleted only on request.
`keptTeams`	`[DeleteUserKeptTeam!]`	Teams that keep everything, minus this membership.
`name`	`String`
`ownedAppCount`	`Int`
`ownedFolderCount`	`Int`
`ownedProjectCount`	`Int`
`soloTeams`	`[DeleteUserTeamImpact!]`	Teams where they are the ONLY member - always deleted with the account, since nobody would be left who could ever open them.
`tokenCount`	`Int`
`userId`	`ID`
`username`	`String`
`vacatedTeams`	`[String!]`	Surviving teams whose last member/team manager this account is. The delete hands that capability to their longest-standing remaining member.

DeleteUserKeptTeam

Field	Type	Description
`name`	`String`
`teamId`	`ID`

DeleteUserResult

What a completed account deletion actually removed.

Field	Type	Description
`appsDeleted`	`Int`
`databasesDeleted`	`Int`
`teamsDeleted`	`Int`
`username`	`String`

DeleteUserTeamImpact

A team affected by deleting a user, and what it holds.

Field	Type	Description
`appCount`	`Int`
`databaseCount`	`Int`
`name`	`String`
`otherMemberCount`	`Int`
`teamId`	`ID`

DeploChangelog

Deplo's published releases, newest first.

Field	Type	Description
`error`	`String`
`releases`	`[DeploRelease!]`

DeploMoveCounts

What the old Deplo holds, and so what a move brings over.

Field	Type	Description
`apps`	`Int`
`databases`	`Int`
`servers`	`Int`
`teams`	`Int`
`users`	`Int`

DeploMoveDatabaseHost

A database on one of the old Deplo's servers, by the address it answers at there.

Field	Type	Description
`host`	`String`	Unique per server only: two databases with the same one cannot land on one server here.
`id`	`String`
`name`	`String`

DeploMovePreview

What a Deplo move would bring here, read from the old Deplo. Nothing has changed on either side yet.

Field	Type	Description
`canStart`	`Boolean`
`counts`	`DeploMoveCounts`
`id`	`String`	The move's id. It is also the key to its public progress page, /moving/<id>.
`peerUrl`	`String`
`problems`	`[String!]`	Everything that blocks the move with each server's `target`, each naming its server. startDeploMove refuses while any remains; a database clash goes with a map that separates them.
`servers`	`[DeploMovePreviewServer!]`
`targets`	`[DeploMoveTargetServer!]`	This Deplo's servers an old server can land on. One the old Deplo also uses is never offered.
`version`	`String`	The old Deplo's version.
`warnings`	`[String!]`	Worth knowing, never blocking.

DeploMovePreviewServer

One of the old Deplo's servers, as a move would take it. It stays with the old Deplo: only what it holds is copied.

Field	Type	Description
`address`	`String`
`agentVersion`	`String`
`apps`	`Int`
`choices`	`[String!]`	The servers here it may land on: one that runs apps for a workload server, one that builds for a build server, any for a storage one. Empty for a migration source.
`databaseHosts`	`[DeploMoveDatabaseHost!]`	Its databases. A map that lands two with the same `host` on one server here is refused.
`databases`	`Int`
`enrolled`	`Boolean`	False for a server that never finished connecting.
`id`	`String`
`isPanelHost`	`Boolean`	The machine the old Deplo itself runs on.
`name`	`String`
`port`	`Int`
`problem`	`String`	What keeps the move from starting because of this server, in one sentence.
`reachable`	`Boolean`	The old Deplo reached it just now. Its apps' data can only be copied while it does.
`role`	`DeploMoveServerRole`
`target`	`String`	The server here it lands on unless startDeploMove's map says otherwise. Null for a migration source, which is never copied.

DeploMoveReadiness

Whether this Deplo can receive a Deplo move right now.

Field	Type	Description
`ready`	`Boolean`
`reason`	`String`	Why not, in one sentence: a move only goes into a fresh Deplo, one at a time.

DeploMoveServer

Where one of the old Deplo's servers landed here.

Field	Type	Description
`id`	`String`	The old Deplo's server id.
`name`	`String`
`targetId`	`String`	The server here that takes its place. Null: not copied.
`targetName`	`String`

DeploMoveStatus

A Deplo move into this Deplo, as its progress page shows it. Read by its id alone: the copy signs everyone out.

Field	Type	Description
`canCancel`	`Boolean`	Until the move is done, even while it runs: the old Deplo starts what it paused, and this Deplo goes back to setup. Once the copy landed, only for an instance admin.
`canFinishWithoutSource`	`Boolean`	The copy landed and the move stopped, and the viewer is an instance admin, so it can finish without the old Deplo. finishDeploMoveWithoutSource still refuses while the old Deplo answers.
`canRetry`	`Boolean`
`canSkip`	`Boolean`	An app or database failed and the viewer is an instance admin: skipDeploMoveWorkload leaves it out so the rest finishes.
`createdAt`	`String`
`error`	`String`	Why the move stopped, or a note left by a cancel or by finishing without the old Deplo. Empty otherwise.
`finishedAt`	`String`
`id`	`String`
`needsAdminSignIn`	`Boolean`	The copy landed, so cancelling, finishing or skipping needs an instance admin signed in here, and the viewer is not one.
`peerUrl`	`String`	The old Deplo's address.
`rowsCopied`	`Int`
`servers`	`[DeploMoveServer!]`	The server map the move was started with.
`setupPath`	`String`	After a cancel that left this Deplo without an account: the link that sets it up again.
`state`	`DeploMoveState`
`steps`	`[DeploMoveStep!]`
`unreadable`	`Int`	Saved secrets the old Deplo could not open. They came across as they were and have to be entered again.
`workloads`	`[DeploMoveWorkload!]`	Listed once the database copy lands.

DeploMoveStep

Field	Type	Description
`key`	`DeploMoveStepKey`
`state`	`DeploMoveStepState`

DeploMoveTargetServer

One of this Deplo's own servers, as a place an old server can land.

Field	Type	Description
`address`	`String`
`canHostWorkloads`	`Boolean`	It runs apps and databases: not a storage, build or migration-source server.
`id`	`String`
`isThisMachine`	`Boolean`	The machine this Deplo itself runs on.
`name`	`String`

DeploMoveWorkload

One app or database the move deploys here and fills with its data, databases first.

Field	Type	Description
`error`	`String`	Why it failed or was left out, or for a copied one what was not copied. Empty otherwise.
`id`	`String`
`kind`	`DeploMoveWorkloadKind`
`name`	`String`
`state`	`DeploMoveWorkloadState`

DeploRelease

One published release of Deplo, as the changelog renders it.

Field	Type	Description
`available`	`Boolean`	Newer than the running version, so installing an update brings it in.
`body`	`String`
`current`	`Boolean`
`name`	`String`
`prerelease`	`Boolean`
`publishedAt`	`String`
`tag`	`String`
`url`	`String`

DeploUpdateStarted

An update the host has STARTED. Deplo restarts as it lands, so there is no completion to report here.

Field	Type	Description
`logPath`	`String`
`version`	`String`

Deployment

A single build + release of an app.

Field	Type	Description
`appId`	`ID`
`branch`	`String`
`buildDurationMs`	`Int`
`canRollback`	`Boolean`	This app can be put back on this deployment: it succeeded, it is not the one already running, and either its image is still on the app's current server or its commit can be rebuilt (see `rollbackRebuilds`).
`commitAuthor`	`String`
`commitMessage`	`String`
`commitSha`	`String`
`createdAt`	`String`
`creator`	`String`
`creatorProvider`	`String`	The git host `creator` is a login on, when a webhook push started this build (`github`, `gitlab`, `bitbucket`, `gitea`). Null when somebody on this instance ran it.
`creatorUser`	`VarAuthor`
`deployKey`	`String`	The stack this build owns: the app slug for production, `<slug>__pr-<n>` for a pull request preview.
`environment`	`DeploymentEnvironment`
`id`	`ID`
`logs`	`[LogLine!]`	Build logs for this deployment (most recent lines, capped). With `after`, only the lines after that many, oldest first. Arguments: `after: Int`.
`prNumber`	`Int`	The pull request number, denormalized so it survives the preview itself being reaped. Null for a production build.
`previewId`	`ID`	The pull request preview this build belongs to, or null for production.
`queuePosition`	`Int`	1-based position in the owning server's build queue while this deployment is `queued` (1 = next to build); null once it starts building or finishes.
`readyAt`	`String`
`rollbackOf`	`ID`	Set when this deploy was a rollback: the deployment it went back to, whose image it re-ran or whose commit it rebuilt. Null otherwise.
`rollbackRebuilds`	`Boolean`	Rolling back to this deployment rebuilds its commit, because its image is no longer kept on the server. Takes minutes instead of seconds.
`startedAt`	`String`	When the build was claimed off the queue and started running - the origin `buildDurationMs` is measured from, and what a live build timer counts up from. Null while still queued.
`status`	`DeploymentStatus`
`url`	`String`

DestinationRemovalImpact

What deleting this destination takes with it: the schedules that point at it, the run history, and how many stored backup files it holds.

Field	Type	Description
`artifacts`	`Int`
`runs`	`Int`
`schedules`	`Int`

DestinationTestResult

A completed connection test: the destination with its badge repainted, plus the verdict. Callers MUST read report.ok - a failed probe is a normal result, not a mutation error.

Field	Type	Description
`destination`	`BackupDestination`
`report`	`S3TestReport`

DockerCleanupPolicy

The instance-wide Docker cleanup schedule. One policy, not one per server: a host opts OUT via excludedServerIds, so a newly added server cannot silently go un-swept. Until it is saved once it reads as the defaults (ENABLED, daily at 04:00 UTC, every scope), so a fresh install sweeps its hosts without anyone finding this setting first; a saved row (including an explicit disable) always wins.

Field	Type	Description
`enabled`	`Boolean`
`excludedServerIds`	`[String!]`	Servers the SCHEDULED sweep skips. A manual runDockerCleanupNow ignores this list - the operator standing in front of the button has already made that decision.
`keepImagesPerApp`	`Int`	unused_app_images only: how many of the newest images to keep for an app that CANNOT be rolled back - a compose stack, a prebuilt image, a pull request preview. An app Deplo builds is governed by its own `App.rollbackKeep` instead, which the sweep sends per app.
`minAgeHours`	`Int`	Only reclaim objects older than this. 0 = no age filter.
`schedule`	`String`	5-field cron expression, evaluated in UTC. Rejected on save if it does not parse.
`scopes`	`[DockerCleanupScope!]`	What the sweep reclaims. Empty = nothing, and the policy cannot be enabled.
`updatedAt`	`String`	Null until the policy has been saved once.

DockerCleanupRun

One executed sweep on one server. A run that could not even start (an unprovisioned host, an agent offline or too old) is still recorded, as failed: the history never lies about an attempt.

Field	Type	Description
`actor`	`String`	The user who ran it, or "Scheduler" for a scheduled sweep.
`error`	`String`
`finishedAt`	`String`
`id`	`ID`
`items`	`[DockerCleanupRunItem!]`	The per-scope breakdown, in the scope allow-list's order.
`reclaimedBytes`	`Float`
`serverId`	`ID`	Null once the server is removed - `serverName` is what keeps the row readable.
`serverName`	`String`
`startedAt`	`String`
`status`	`DockerCleanupRunStatus`
`trigger`	`DockerCleanupTrigger`

DockerCleanupRunItem

One scope's outcome in an executed run. Counts only - the history keeps how much was reclaimed, not which objects.

Field	Type	Description
`error`	`String`
`itemsRemoved`	`Int`
`reclaimedBytes`	`Float`
`scope`	`DockerCleanupScope`
`skipped`	`Boolean`

Domain

A routable hostname attached to an app (Traefik router).

Field	Type	Description
`appId`	`ID`
`appSlug`	`String`
`certProvider`	`CertProvider`	How this domain's TLS certificate is issued. Set to `cloudflare` automatically when a DNS check finds the host proxied and it still had no certificate - Cloudflare already serves it over HTTPS. `custom` serves it over HTTPS from a certificate installed on the owning server (see `addServerCertificate`) and asks no ACME provider for one. Null on rows written before the field existed (they route as `letsencrypt`).
`corsOrigins`	`[String!]`	Browser origins allowed to call this domain (CORS). Empty means CORS is off; `*` allows any.
`createdAt`	`String`
`entrypoint`	`DomainEntrypoint`
`id`	`ID`
`importedFrom`	`String`	The hostname this domain REPLACED on the platform the app was imported from, or null when it is the address the app always had. An import cannot keep the source's own throwaway host (it carries that server's IP) nor a name another team here already serves, so the route is re-hosted onto an address Deplo mints - this is what the app's Domains section reads to say which address became which. Cleared by `dismissImportedDomains`.
`middlewares`	`[String!]`
`name`	`String`
`pathPrefix`	`String`
`port`	`Int`
`primary`	`Boolean`
`proxied`	`Boolean`	The owner's declaration that a proxy (a CDN, a reverse proxy, a load balancer) answers for this hostname. Its A records then name the proxy, never this server, so the DNS check can only ever settle `misconfigured` - this is what keeps the host routed anyway, and makes its URL https (the proxy terminates TLS). The declared twin of the `cloudflare` status, which is detected from Cloudflare's published ranges.
`redirectTo`	`String`	Hostname this domain answers a permanent 301 to (the canonical half of its www / non-www pair), or null when it serves the app itself.
`securityHeaders`	`Boolean`	Adds nosniff, same-origin framing and a strict referrer policy to every response. On for a domain added since the setting existed.
`service`	`String`
`serviceName`	`String`
`source`	`String`
`ssl`	`Boolean`
`status`	`DomainStatus`	DNS verification state. Only `valid` is confirmed: `cloudflare` means the host is proxied and its origin cannot be checked from DNS, so it is routed but unverified. A `misconfigured` host is off the router unless `proxied` declares another proxy answers for it. See the DomainStatus enum.
`stripPrefix`	`Boolean`

EnvImportResult

What a .env import wrote, and what it deliberately left alone.

Field	Type	Description
`added`	`Int`	Variables created or updated.
`skippedSecrets`	`Int`	Lines whose key already exists as a secret. A secret cannot be edited, so those were left untouched.

Environment

A per-Project, first-class isolated deploy target (Development/Preview/Production + custom). kind is its well-known role; slug and gitBranch drive the deploy pipeline (wired in a later phase).

Field	Type	Description
`createdAt`	`String`
`gitBranch`	`String`
`id`	`ID`
`isDefault`	`Boolean`
`kind`	`String`
`name`	`String`
`position`	`Int`
`projectId`	`ID`
`slug`	`String`
`updatedAt`	`String`

EnvVar

A single environment variable. Secret values are masked unless revealed.

Field	Type	Description
`createdAt`	`String`
`createdBy`	`VarAuthor`
`id`	`ID`
`isMasked`	`Boolean`
`key`	`String`
`targets`	`[EnvTarget!]`
`type`	`EnvVarType`
`updatedAt`	`String`
`updatedBy`	`VarAuthor`
`value`	`String`

ExecResult

Output of an exec'd console command.

Field	Type	Description
`detach`	`Boolean`
`output`	`String`

FleetAgent

One server whose agent is older than the fleet version.

Field	Type	Description
`id`	`ID`
`name`	`String`
`update`	`ServerAgentUpdate`
`usable`	`Boolean`	False when the agent is older than `FleetAgents.minimum`: the server refuses everything until it updates.
`version`	`String`

FleetAgents

How far the server agents are from the agent this Deplo is pinned to. Deplo updates every server that is behind on its own, so behind is what it has not carried yet.

Field	Type	Description
`behind`	`[FleetAgent!]`
`expected`	`String`	The agent version this Deplo installs everywhere.
`minimum`	`String`	The oldest agent this Deplo still talks to. Older is unusable until it updates.
`pausedBy`	`String`	The server that took a new agent and did not come back on it. Every other update waits until it recovers.
`total`	`Int`
`updating`	`Boolean`	Deplo is still working on it: some server behind `expected` has not used up its 24 hours of retries.

FleetServerMetrics

One server's headline reading for the Monitoring page's fleet list, plus a thinned CPU/memory trace.

Field	Type	Description
`agentVersion`	`String`
`containers`	`Int`
`cpu`	`Float`
`diskPct`	`Float`
`expectedAgentVersion`	`String`
`memPct`	`Float`
`online`	`Boolean`	Whether the buffer holds a reading at all.
`serverId`	`ID`
`source`	`String`
`spark`	`[FleetSpark!]`	Oldest first, at most 30 points.
`ts`	`Float`	Newest sample time, epoch ms. 0 means nothing has been measured - the row says so rather than drawing zeros.

FleetSpark

One thinned point of a fleet row's sparkline.

Field	Type	Description
`cpu`	`Float`
`mem`	`Float`
`ts`	`Float`

Folder

A team-wide grouping of apps on the Overview. Apps reference their folder via App.folderId; folders nest via parentId (a tree).

Field	Type	Description
`appCount`	`Int`
`capabilities`	`[String!]`	The current caller's effective capabilities on this folder (bounded by their team caps).
`color`	`String`
`createdAt`	`String`
`id`	`ID`
`isOwner`	`Boolean`	Whether the caller owns this folder or is a folder super-user (manage_team / admin).
`name`	`String`
`ownerUserId`	`ID`
`parentId`	`ID`
`subfolderCount`	`Int`
`teamId`	`ID`
`updatedAt`	`String`

FolderGrant

A user's access to a folder: the owner (isOwner=true, implicit) or a grantee the owner has shared it with, plus their effective capabilities.

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`
`capabilities`	`[String!]`
`folderId`	`ID`
`isOwner`	`Boolean`
`name`	`String`
`userId`	`ID`
`username`	`String`

FolderShareCandidate

A team member who could be granted access to a folder (used to populate the Share dialog's picker).

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`
`name`	`String`
`userId`	`ID`
`username`	`String`

GitConnection

A team's stored credentials for one git host that is not GitHub. The token is never exposed.

Field	Type	Description
`accountLogin`	`String`
`allowPrivateEndpoint`	`Boolean`	The address points inside the deployment, which only an instance admin can allow. False for every ordinary connection.
`appCount`	`Int`	Apps whose clone this connection authenticates.
`avatarUrl`	`String`
`baseUrl`	`String`
`createdAt`	`String`
`hasApi`	`Boolean`	False for a plain git server: it can carry credentials but cannot list repositories or register a webhook.
`health`	`String`	ok \| failing. Re-derived by the maintenance sweep and by testGitConnection, so a revoked token surfaces before a deploy fails on it.
`healthError`	`String`	The provider's own refusal when health is failing.
`id`	`ID`
`label`	`String`
`lastCheckedAt`	`String`
`provider`	`String`	gitlab \| bitbucket \| gitea \| git.
`tokenExpiresAt`	`String`
`username`	`String`

GithubApp

A GitHub App connected to a team (no secrets exposed).

Field	Type	Description
`appId`	`Int`
`createdAt`	`String`
`htmlUrl`	`String`
`id`	`ID`
`installations`	`[GithubInstallation!]`	Installations of this App.
`name`	`String`
`slug`	`String`

GithubConnectStart

Inputs for the browser's self-submitting form that creates a GitHub App.

Field	Type	Description
`actionUrl`	`String`
`manifest`	`String`
`state`	`String`

GithubInstallation

An installation of a connected GitHub App on a user or org.

Field	Type	Description
`accountLogin`	`String`
`accountType`	`String`
`appName`	`String`	Name of the connected GitHub App this installation is of.
`avatarUrl`	`String`
`id`	`ID`
`installationId`	`Int`

GithubPullRequest

An open pull request on the app's repository.

Field	Type	Description
`authorLogin`	`String`
`baseRef`	`String`
`draft`	`Boolean`
`fromFork`	`Boolean`
`headRef`	`String`
`htmlUrl`	`String`
`number`	`Int`
`title`	`String`
`updatedAt`	`String`

GithubRepo

A repository the installation can list and clone.

Field	Type	Description
`defaultBranch`	`String`
`fullName`	`String`
`name`	`String`
`private`	`Boolean`
`updatedAt`	`String`
`url`	`String`

GitProvider

A git host Deplo can connect to, other than GitHub (beta).

Field	Type	Description
`defaultBaseUrl`	`String`
`defaultUsername`	`String`
`hasApi`	`Boolean`
`id`	`String`
`label`	`String`
`tokenHelpUrl`	`String`	Where to create the token. Pass the connection's own baseUrl for a self-hosted host. Arguments: `baseUrl: String`.
`tokenScopes`	`String`	The scopes to tick when creating the token, as one line.

GitRepoSummary

A repository a connection can list and clone.

Field	Type	Description
`defaultBranch`	`String`
`fullName`	`String`
`name`	`String`
`private`	`Boolean`
`updatedAt`	`String`
`url`	`String`

GlobalUser

A registered user in the instance-wide Users list (no email exposed).

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`	Resolved profile picture: uploaded image, else Gravatar, else null for the monogram.
`canConfigureTraefik`	`Boolean`
`canExposePorts`	`Boolean`
`canMountHostVolumes`	`Boolean`
`createdAt`	`String`
`isInstanceAdmin`	`Boolean`
`isInstanceOwner`	`Boolean`	Owns the instance. Their account is editable only by themselves.
`name`	`String`
`suspended`	`Boolean`
`teamCount`	`Int`
`userId`	`ID`
`username`	`String`

HealthCheck

What Deplo writes into the app's compose healthcheck:. Docker runs it inside the container and the agent reports the verdict, which is what the status dot follows. Null on an app that has none.

Field	Type	Description
`command`	`String`
`intervalS`	`Int`
`path`	`String`
`port`	`Int`	The port INSIDE the container. Null means the app's own port.
`retries`	`Int`
`startPeriodS`	`Int`
`timeoutS`	`Int`
`type`	`HealthCheckType`

HostPortCheck

The answer to 'are these host ports free on that server?'.

Field	Type	Description
`checked`	`Boolean`	False when the server could not be asked at all, in which case `inUse` is empty and says nothing.
`inUse`	`[Int!]`	The subset of the requested ports that is taken.
`reason`	`String`	Why the check could not run. Null when it did.

InstanceSettings

Settings that belong to this Deplo instance rather than to a team or a host: the address the panel answers on, and what version it runs.

Field	Type	Description
`deploHostId`	`String`
`deploHostIp`	`String`	The IPv4 an A record for the panel's domain should point at.
`deploHostName`	`String`
`gravatarEnabled`	`Boolean`	Whether a person with no uploaded picture falls back to their Gravatar. The panel never dials gravatar.com itself - it only computes the address, and each viewer's browser fetches it.
`logMaxDays`	`Int`	How far back the log viewer's time range may reach, in days. Instance-wide because the logs live on the host, which several teams share. It bounds what may be ASKED for and nothing else: docker rotates its json-file logs by size, so no setting here makes the host actually hold that much.
`panelFallbackDisabled`	`Boolean`	Whether that backup address is turned off. It then routes nowhere, and a panel whose domain stops answering is reached again only with `deplo recover panel-address` on the server itself. The address above is what turning it back on would restore.
`panelFallbackUrl`	`String`	The generated address the panel also answers on, over https (https://deplo-<hexip>.deplo.site). On unless an instance admin turned it off: it is the way back in when the panel's domain, its DNS or its certificate stops working, and it resolves to this server with nothing to set up. Null only when Deplo cannot work out an address of its own that anyone else could reach.
`panelUrl`	`String`	The address Deplo uses for itself right now. Every install command, deploy hook URL and invite link is built from it.
`panelUrlSource`	`String`	`stored` (set here), `environment` (DEPLO_PUBLIC_URL, set at install time) or `request` (derived from the browser's own host, which is a guess).
`storedPanelUrl`	`String`
`usageReportLastSentAt`	`String`	When the last Usage report left, or null when none ever has.
`usageReportsEnabled`	`Boolean`	Whether this instance sends Deplo one anonymous Usage report a day: versions, counts and feature switches, keyed by a random instance id, never a hostname, address, name or email. On by default; any instance admin may turn it off, and nothing more is sent from that moment.
`usageReportsForcedOff`	`Boolean`	True when the install set DO_NOT_TRACK=1, which turns reporting off regardless of the switch above. The switch then shows as disabled with that reason rather than hiding.
`version`	`String`

LogLine

Field	Type	Description
`level`	`String`
`text`	`String`
`ts`	`String`

LogsInfo

Lighter container list for the logs viewer (no shell probe).

Field	Type	Description
`instances`	`[ConsoleInstance!]`
`logMaxDays`	`Int`	How far back the time range may reach, in days (instance setting). A bound on what may be asked for, not a promise the host still holds it: docker rotates its logs by size.
`running`	`Boolean`
`streamable`	`Boolean`	A real container exists on the host, so its logs can be streamed - whether it is running, restarting or exited. Attach on this, not on `running`: a crash-looping container is the one whose logs you need.
`supportsTimeline`	`Boolean`	The owning host's agent can narrow a log stream by time (`logs.timerange`). False on an older agent, which still streams but only honours `tail` - the viewer greys out the time-range control rather than offering a window the host would silently ignore.
`unreachable`	`Boolean`	The owning server's agent could not be reached.

McpSettings

The active team's MCP policy: whether AI agents may drive it at all. What an agent may DO is decided by its API token's capabilities and by its owner's manage_mcp in the team, and by nothing here.

Field	Type	Description
`enabled`	`Boolean`

McpTeam

A team as the MCP server names it: whether the team allows agents at all, and whether the caller may connect theirs.

Field	Type	Description
`canConnect`	`Boolean`	Whether the caller holds `manage_mcp` in this team.
`id`	`ID`
`mcpEnabled`	`Boolean`	The team's own MCP switch.
`name`	`String`
`slug`	`String`

Member

A user's membership in the active team (no email exposed).

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`	Resolved profile picture: uploaded image, else Gravatar, else null for the monogram.
`capabilities`	`[Capability!]`
`createdAt`	`String`
`isInstanceAdmin`	`Boolean`
`isPrimaryOwner`	`Boolean`
`membershipId`	`ID`
`name`	`String`
`role`	`Role`	The member's RANK (only `owner` outranks). For what to show, read `roleName`.
`roleId`	`ID`	The assigned team role, or null when the member holds a hand-picked capability set.
`roleName`	`String`	The assigned role's name, or null for a custom set.
`userId`	`ID`
`username`	`String`

MigrationDataMoveResult

Field	Type	Description
`failed`	`Int`
`moved`	`Int`
`notes`	`[String!]`
`sourceGone`	`Boolean`	The source machine stopped answering part way through - a connection that died, not a volume that could not be read. The caller MUST stop: every service still to come is on the same machine, each one gets stopped on the other platform before its copy is attempted, and carrying on turns one broken host into a whole organisation with no data and its services down on both sides.

MigrationDataService

An already-imported service whose data can still be moved over from the panel.

Field	Type	Description
`notes`	`[String!]`
`path`	`String`
`running`	`Boolean`	Still up over there. Moving the data stops it, which is the point of a cutover.
`sourceId`	`String`
`sourceKind`	`String`
`sourceName`	`String`
`sourceReachable`	`Boolean`	Whether the machine holding this data ANSWERS Deplo right now - a live Hello, not the stored status, which goes green on the agent's outbound call-home and says nothing about the direction a copy needs. False means the copy cannot start at all, and the caller must not begin it: one unreachable machine is one refusal, not one failure per service.
`sourceServerId`	`String`
`targetId`	`String`
`targetKind`	`String`
`targetName`	`String`
`targetServerId`	`String`
`volumes`	`[MigrationDataVolume!]`

MigrationDataVolume

One source volume and the Deplo volume it would be copied into, paired by the path they are mounted at.

Field	Type	Description
`mountPath`	`String`
`note`	`String`	Set when the pairing rests on something weaker than an equal path - a database whose data directory moved between engine versions, for instance.
`sourceVolume`	`String`
`targetVolume`	`String`

MigrationInvite

One person from the source team or organization: either added to the team (they already had a Deplo account) or handed a single-use registration link.

Field	Type	Description
`avatarUrl`	`String`	Their picture, when they already have an account here.
`email`	`String`
`hasAccount`	`Boolean`	Whether that address already has an account here.
`link`	`String`	The single-use registration link to send them, or null when they were added directly.
`message`	`String`
`name`	`String`
`outcome`	`MigrationOutcome`
`sourceRole`	`String`	What they were on the panel, when it says.

MigrationPlan

What an import would do, read from the source instance without writing anything.

Field	Type	Description
`members`	`[MigrationPlanMember!]`
`orgName`	`String`	The team or organization this token reads. A token belongs to one, so importing a second one means a second token.
`otherTeams`	`[String!]`	The panel's other teams, by name - the ones this token does not cover and that need one of their own. Null when the panel cannot say, which on Coolify it never can.
`platform`	`MigrationPlatform`	Which product answered at that address.
`projects`	`[MigrationPlanProject!]`
`servers`	`[MigrationPlanServer!]`
`sourceUrl`	`String`

MigrationPlanEnvironment

Field	Type	Description
`exists`	`Boolean`	An environment of that name is already in the matching project - the panel's `production` maps onto the one every Deplo project starts with.
`name`	`String`
`services`	`[MigrationPlanService!]`
`sourceId`	`String`

MigrationPlanMember

Someone in the team or organization the token reads. Empty when the token belongs to a plain member, which cannot list it.

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`
`email`	`String`
`hasAccount`	`Boolean`
`inTeam`	`Boolean`
`name`	`String`
`sourceRole`	`String`	The role they held over there. Shown, never applied: everyone arrives as a plain member and is promoted on purpose.

MigrationPlanProject

Field	Type	Description
`environments`	`[MigrationPlanEnvironment!]`
`exists`	`Boolean`
`name`	`String`
`sourceId`	`String`

MigrationPlanServer

One machine behind the source instance. The FIRST entry is always the host the source instance itself runs on, whose sourceId is the empty string - the same key the server mapping and the data cutover use for it.

Field	Type	Description
`cloudflare`	`Boolean`	That address resolves into Cloudflare's proxy ranges, so it answers as the proxy: no agent can ever be dialled on it, and the machine's own IP has to be given instead.
`deploServerId`	`String`	The Deplo server at that same address, or null when Deplo has no agent there. Data cannot be copied off a machine Deplo cannot reach: a volume is read by the agent ON its host, and agents cannot dial each other.
`deploServerName`	`String`
`deploServerOnline`	`Boolean`	Whether that server's agent answers. A row a failed attempt left behind sits at the same address and is matched all the same, so this - not the id - is what says the machine is ready to be read.
`ipAddress`	`String`
`name`	`String`
`sourceId`	`String`

MigrationPlanService

One service on the panel (an application, a compose stack, or a database) as it would land here.

Field	Type	Description
`buildsFromSource`	`Boolean`	Whether Deplo would ever compile this. False for a compose stack, a prebuilt image and a database - all of them deploy as they are, so a build server would have nothing to do for them.
`domains`	`[String!]`	The hostnames that would come across. The panel's generated throwaway hosts (traefik.me, sslip.io, nip.io, deplo.site) are already dropped - Deplo mints its own.
`engine`	`String`	Deplo's own engine id for a database (`mongo` over there is `mongodb` here), so a client can show the engine's brand mark. Null for anything that is not a database Deplo has.
`exposedPort`	`Int`	The host port this database publishes over there, so a review can say what will be published and offer another port when that one is taken here. Describes the SOURCE: it is reported whether or not the caller holds the publish-ports grant, and null only for something that is not a database or publishes nothing.
`kind`	`String`	What it is over there: application, compose, or one of the panel's database engines.
`logo`	`String`	The icon this service would arrive with, as an inline data-URI, or null when it has none. Already validated against what Deplo will store, so a client can render it as-is.
`name`	`String`
`notes`	`[String!]`	What will not come across, or will need a look afterwards.
`sourceId`	`String`
`sourceServerId`	`String`	The panel's server it runs on. Empty string means the panel's own host, which has no server row over there.
`status`	`MigrationPlanStatus`
`targetKind`	`String`	app or database, or null when Deplo has no equivalent.

MigrationProjectResult

Field	Type	Description
`created`	`Int`
`failed`	`Int`
`items`	`[MigrationRunItem!]`
`manual`	`Int`
`projectName`	`String`
`skipped`	`Int`

MigrationRecopySource

The panel service a blocked app or database was imported from. Its key is NOT here: a run wipes the token the moment it ends, so copying the data again asks for it once more.

Field	Type	Description
`platform`	`String`
`runId`	`String`
`sourceId`	`String`
`sourceKind`	`String`
`sourceName`	`String`
`sourceUrl`	`String`

MigrationRevertResult

What a revert took back out of Deplo, and what is still here because it could not be removed.

Field	Type	Description
`apps`	`Int`
`databases`	`Int`
`environments`	`Int`
`failed`	`[String!]`	One line per thing that is still here, and why - a host that would not confirm the volume is gone, or a capability the actor does not hold.
`projects`	`Int`
`sharedVars`	`Int`

MigrationRun

One import, kept after the tab that started it is gone. The API key is stored encrypted only for as long as the run needs it, then wiped.

Field	Type	Description
`actor`	`String`
`created`	`Int`
`doneSteps`	`Int`
`error`	`String`
`failed`	`Int`
`finishedAt`	`String`
`heartbeatAt`	`String`	When the control plane driving this run last said it was alive, or null while nothing has picked it up. A run is a row that says `running` whether or not anybody is driving it, so this is the only honest answer to "is it actually doing something": older than 90 seconds (or null) means no runner has it, and the next tick anywhere on the instance will take it over.
`id`	`String`
`items`	`[MigrationRunItem!]`	The report. Only loaded by the single-run query.
`lastPath`	`String`	The last thing this run touched, as `Project / Environment / service`. Filled in only by the live `activeMigration` feed - the history list leaves it null, because a finished run says where it got to with its whole report. It is the only record of a run's POSITION that survives the tab: the loop lives in the browser, and so does the plan that knew how many projects there were.
`manual`	`Int`
`members`	`[MigrationInvite!]`	The people the panel listed on this team, as the run recorded them - who was added, and who was handed a link. Only the session query loads them.
`orgName`	`String`
`phase`	`String`	`config` \| `data` \| `done`. Which half the run is in - the two count different things, so their step numbers are not one scale.
`platform`	`MigrationPlatform`	Which product this run read. Decided once, when it connected.
`sessionId`	`String`	The runs of ONE walk of the wizard share this: several teams of the same panel are several runs, brought over one after another by the control plane. Null on runs made before the queue left the browser.
`skipped`	`Int`
`sourceUrl`	`String`
`startedAt`	`String`
`status`	`String`	running \| done \| failed. A run left open by a closed tab is failed as `Interrupted` by the next one.
`stepLabel`	`String`
`stopRequested`	`Boolean`	Somebody asked it to stop. The runner notices between steps - never mid-call, because a call already sent finishes on the far side whatever this row says.
`teamAvatarUrl`	`String`
`teamId`	`String`	The Deplo team this run landed in.
`teamName`	`String`
`teamSlug`	`String`
`totalSteps`	`Int`

MigrationRunItem

Field	Type	Description
`at`	`String`	When this line happened. Null on rows written before the report became something you can watch. A report read afterwards is a list; read while it runs it is a log, and a log with no times is not one.
`message`	`String`
`outcome`	`MigrationOutcome`
`path`	`String`	Where it was over there: `Project / Environment / service`.
`sourceKind`	`String`
`sourceName`	`String`
`targetId`	`String`
`targetKind`	`String`

MigrationSourceTeam

Which team of the panel one token reads. A token belongs to exactly one team on both products, so bringing several over takes one token each.

Field	Type	Description
`otherTeams`	`[String!]`	The panel's other teams, by name, so the ones no token covers yet can be named. Null means the panel cannot say - always the case on Coolify, whose team listing is filtered down to the token's own team.
`platform`	`MigrationPlatform`
`teamId`	`String`	The team's own id over there, which is how two tokens of ONE team are told apart from two tokens of two teams. Null when the panel would not say.
`teamName`	`String`

MonitoringSettings

Instance-wide monitoring settings (a fleet-scoped singleton, like the Docker cleanup policy).

Field	Type	Description
`saveMetrics`	`Boolean`
`updatedAt`	`String`

MoveCode

A fresh move code. This is the only time it is returned: Deplo keeps only its hash.

Field	Type	Description
`code`	`String`	The `dmove_...` code to paste on the new Deplo. It lets that Deplo read every secret and every app's data, so treat it like the keys to the whole instance.
`expiresAt`	`String`	When the code stops working if no new Deplo has used it. Once used, it lives until the copy finishes or is cancelled.

OverviewAppState

Field	Type	Description
`appId`	`ID!`
`neverDeployed`	`Boolean!`
`runtime`	`OverviewRuntime`
`status`	`AppStatus!`

OverviewRuntime

Field	Type	Description
`maxRestartCount`	`Int!`
`restarting`	`Int!`
`running`	`Int!`
`total`	`Int!`
`unhealthy`	`Int!`
`unhealthyContainers`	`[String!]!`
`unreachable`	`Boolean!`

PanelAddressImpact

What moving the panel to a given address would break, counted live and instance-wide. Every number is a fact about right now, so a dialog can name what is lost instead of warning in the abstract. Read-only: nothing here changes anything.

Field	Type	Description
`currentUrl`	`String`
`deployHooks`	`Int`
`gitConnections`	`Int`	Git connections whose webhook is registered against the address the INSTALLER was given, not this setting - so this change does not move them.
`githubApps`	`Int`
`hostChanges`	`Boolean`	Whether the hostname moves. Everything a browser welds to an origin - passkeys, cookies, push subscriptions - dies on this.
`losesHttps`	`Boolean`	https to http. Browsers that already loaded the panel over https keep refusing plain http on that hostname until the HSTS they remember expires.
`mcpConnections`	`Int`
`panelFallbackUrl`	`String`
`passkeyPeople`	`Int`
`passkeys`	`Int`
`pendingServers`	`Int`
`pushSubscriptions`	`Int`
`registrationLinks`	`Int`
`schemeChanges`	`Boolean`
`sessionPeople`	`Int`
`sessions`	`Int`
`url`	`String`

PanelDns

What DNS says about the address the panel answers on.

Field	Type	Description
`host`	`String`
`ipv6`	`String`	This host's public IPv6, when its server agent reports one: what an AAAA record should point at.
`resolved`	`[String!]`
`status`	`String`

PanelHttps

How the Deplo panel itself is served, read live off the router that publishes it. unavailable says why it is not Deplo's to change here - the host is not added as a server, its proxy is not one Deplo installed, or the panel is still published by its own container.

Field	Type	Description
`certificateTrusted`	`Boolean`	Whether a browser accepts the certificate this address serves. False on the generated host, which no public certificate authority issues for, so the browser warns once. Null when it could not be read, which is not the same as untrusted.
`domain`	`String`	The host the panel's route answers on, as the proxy has it.
`enabled`	`Boolean`	Whether the panel is served over https. False means plain http on :80, and it is an advanced opt-out: the only case for it is a panel no certificate can be issued for, on a network Let's Encrypt cannot reach.
`fallbackDomain`	`String`	The generated host the panel also answers on, or null when that IS the address above.
`provider`	`String`	The certificate resolver it is ordered from, named as this host names it. Null when https is off, or when this host orders from nobody and serves a certificate you installed.
`unavailable`	`String`

Passkey

A WebAuthn credential on this account. Carries no key material: the public key and the credential id stay server-side.

Field	Type	Description
`createdAt`	`String`
`id`	`String`
`kind`	`PasskeyKind`
`name`	`String`	The label shown in the list, e.g. "Chrome on macOS".
`usableHere`	`Boolean`	False for a credential minted for a different address of this panel: the browser will not offer it here, so the only thing to do with it is remove it.

PreviewEnvVar

A preview-only variable override. Write-only, like every stored secret: the value is never projected and there is no reveal path.

Field	Type	Description
`key`	`String`
`type`	`String`
`updatedAt`	`String`

Project

A top-level, team-scoped CONTAINER (ADR-0008): folder-like, but it owns Environments and holds folders/apps via their projectId. NOT the deployable app - that is an App. A Project never nests in a Project.

Field	Type	Description
`appCount`	`Int`
`color`	`String`
`createdAt`	`String`
`environmentCount`	`Int`
`environments`	`[Environment!]`
`folderCount`	`Int`
`id`	`ID`
`name`	`String`
`ownerUserId`	`ID`
`slug`	`String`
`teamId`	`ID`
`updatedAt`	`String`

PublishedPort

A host port an app publishes, for what the proxy cannot route - a game server, an SMTP relay, a database the app exposes.

Field	Type	Description
`id`	`ID`
`protocol`	`String`
`published`	`Int`	The port on the host.
`target`	`Int`	The port inside the container.

RecognizedFramework

What Deplo read in a repository before an app exists for it: the JavaScript framework backing it, and the build command the repository declares for ITSELF in its package.json. Never invented from the framework - null means the repo said nothing and the builder decides.

Field	Type	Description
`buildCommand`	`String`	The repository's own build script, spelled for its lockfile's package manager (e.g. "pnpm run build").
`defaultPort`	`Int`	The port this framework's production server binds when nothing tells it otherwise - what a new app's container port defaults to.
`id`	`String`	Stable framework id, e.g. "nextjs" - also the key for its brand mark. Null for a repo with no framework Deplo knows.
`name`	`String`	Display name, e.g. "Next.js".
`startCommand`	`String`	The FRAMEWORK's own production start, for one no builder derives a start for (SvelteKit on adapter-node, AdonisJS). Never the repo's `start` script, which is as often its dev server.
`staticOutput`	`String`	The directory to SERVE, for a framework whose production artifact is a directory no builder serves (Gatsby, Eleventy, Docusaurus, and an Angular workspace, whose path carries its project's name).

RecoveryKey

The private key that decrypts a destination's artifacts. Save it somewhere outside Deplo: it is the only way to read those backups if this instance is lost. Fetching it is recorded in Activity.

Field	Type	Description
`identity`	`String`
`name`	`String`
`recipient`	`String`
`where`	`String`	Where the artifacts this key opens are stored, in one line. It goes into the key file, because whoever reads that file has lost the instance that knew the bucket or the folder.

RegistrationLink

A single-use link to register a new account.

Field	Type	Description
`canReveal`	`Boolean`	The link can still be read back with revealRegistrationLink - pending, unexpired, and minted after the token started being stored encrypted.
`createdAt`	`String`
`createdBy`	`String`
`expiresAt`	`String`
`id`	`ID`
`linkMasked`	`String`	The link with its token blanked, for display while it is covered. Never carries the token.
`mode`	`RegistrationMode`
`status`	`RegistrationLinkStatus`
`teamNames`	`[String!]`
`usedByUsername`	`String`

Registry

A container-image registry credential owned by a team. The password / access token is never exposed - only the connection metadata.

Field	Type	Description
`createdAt`	`String`
`id`	`ID`
`name`	`String`
`registryUrl`	`String`
`type`	`RegistryType`
`username`	`String`

ResourceLimits

Per-container resource caps applied to a workload (an App's containers at deploy time, a Database's container at provision/redeploy time). A null field means that dimension is uncapped. Memory is in MiB, disk in GiB, CPU in milli-CPUs (1000 = one core).

Field	Type	Description
`cpuMilli`	`Int`
`cpuShares`	`Int`
`cpuset`	`String`
`memoryMb`	`Int`
`memoryReservationMb`	`Int`
`nofile`	`Int`
`nproc`	`Int`
`oomScoreAdj`	`Int`
`pidsLimit`	`Int`
`shmSizeMb`	`Int`
`storageGb`	`Int`
`swapMb`	`Int`

RestartedWorkload

One workload that could not be restarted, and why.

Field	Type	Description
`error`	`String`	The failure, verbatim from the host.
`kind`	`String`	"app" or "database".
`name`	`String`

RoleScope

The projects, folders and apps a role reaches. A folder brings its whole subtree. All three empty means it reaches nothing, which is what a scope whose nodes were all deleted becomes.

Field	Type	Description
`appIds`	`[String!]`
`environmentIds`	`[String!]`
`folderIds`	`[String!]`
`projectIds`	`[String!]`

RuntimeContainer

One container of an app, as the host actually has it now.

Field	Type	Description
`exposed`	`Boolean`
`health`	`String`	"healthy" \| "unhealthy" \| "starting", or "" when the image declares no healthcheck, which is not a synonym for healthy.
`name`	`String`
`restartCount`	`Int`	Times docker has restarted this container.
`running`	`Boolean`
`service`	`String`
`startedAtUnix`	`Int`	When it last started, epoch seconds. 0 when it has never started, or when the owning agent predates the field - both mean there is no uptime to show, never 1970.
`state`	`String`	Raw docker state ("running" \| "restarting" \| "exited" \| ...), or "" when the owning agent is too old to report it.

S3TestLogLine

A line of the connection-test log, with the level to render it at.

Field	Type	Description
`level`	`String`
`text`	`String`

S3TestReport

The result of testing a destination: the verdict, the probe sequence, the agent's verbatim output, and the commands that reproduce the same three S3 calls by hand. never => it has not been tested yet.

Field	Type	Description
`command`	`String`
`durationMs`	`Int`
`error`	`String`
`lines`	`[S3TestLogLine!]`
`never`	`Boolean`
`ok`	`Boolean`
`serverName`	`String`
`startedAt`	`String`
`steps`	`[S3TestStep!]`

S3TestStep

One step of the fixed probe sequence the agent performs (pick a server, open the endpoint, head the bucket, write a probe file, remove it).

Field	Type	Description
`detail`	`String`
`key`	`String`
`label`	`String`
`status`	`S3TestStepStatus`

SearchApp

An app a search matched. Deliberately small: enough to recognise it and to read it in full with app(slug:) afterwards.

Field	Type	Description
`id`	`ID`
`logo`	`String`
`name`	`String`
`productionUrl`	`String`
`slug`	`String`
`status`	`AppStatus`
`team`	`SearchTeam`

SearchCron

A cron job a search matched, with the app or database it runs on.

Field	Type	Description
`enabled`	`Boolean`
`id`	`ID`
`name`	`String`
`schedule`	`String`
`targetKind`	`String`
`targetName`	`String`
`targetRef`	`String`	The app's SLUG or the database's ID - the deep link, either way.
`team`	`SearchTeam`

SearchDatabase

A database a search matched.

Field	Type	Description
`id`	`ID`
`logo`	`String`
`name`	`String`
`status`	`DatabaseStatus`
`team`	`SearchTeam`
`type`	`DatabaseType`

SearchDomain

A domain a search matched, with the app that serves it.

Field	Type	Description
`appName`	`String`
`appSlug`	`String`
`id`	`ID`
`name`	`String`
`status`	`DomainStatus`
`team`	`SearchTeam`

SearchEnvironment

An environment a search matched, with the project it is in.

Field	Type	Description
`id`	`ID`
`kind`	`String`
`name`	`String`
`projectId`	`ID`
`projectName`	`String`
`slug`	`String`
`team`	`SearchTeam`

SearchFolder

A folder a search matched. Folders have no slug: open one by id.

Field	Type	Description
`appCount`	`Int`
`id`	`ID`
`name`	`String`
`team`	`SearchTeam`

SearchMember

A team member a search matched. Name and username only - a search must never turn a name into an email address.

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`
`name`	`String`
`roleName`	`String`
`team`	`SearchTeam`
`userId`	`ID`
`username`	`String`

SearchProject

A project a search matched.

Field	Type	Description
`appCount`	`Int`
`id`	`ID`
`name`	`String`
`slug`	`String`
`team`	`SearchTeam`

SearchResults

What a search found, grouped by kind. At most 50 of each.

Field	Type	Description
`apps`	`[SearchApp!]`
`cronJobs`	`[SearchCron!]`
`databases`	`[SearchDatabase!]`
`domains`	`[SearchDomain!]`
`environments`	`[SearchEnvironment!]`
`folders`	`[SearchFolder!]`
`members`	`[SearchMember!]`
`projects`	`[SearchProject!]`
`roles`	`[SearchRole!]`
`servers`	`[SearchServer!]`
`templates`	`[SearchTemplate!]`

SearchRole

A team role a search matched, by name or description.

Field	Type	Description
`description`	`String`
`id`	`ID`
`memberCount`	`Int`
`name`	`String`
`team`	`SearchTeam`

SearchServer

A server a search matched. Servers are the one resource shared across teams, so a hit names none.

Field	Type	Description
`host`	`String`
`id`	`ID`
`name`	`String`
`status`	`ServerStatus`

SearchTeam

The team a search hit was found in.

Field	Type	Description
`avatarUrl`	`String`
`id`	`ID`
`name`	`String`
`slug`	`String`

SearchTemplate

A catalogue template a search matched. Public, so it names no team.

Field	Type	Description
`logo`	`String`
`name`	`String`
`slug`	`String`

Server

A connected host running deployments (reached via its agent).

Field	Type	Description
`agentPort`	`Int`
`agentUpdate`	`ServerAgentUpdate`	Deplo's update of this server's agent, while one is in flight or has failed. Null otherwise. Requires instanceAdmin.
`agentUsable`	`Boolean`	Whether this Deplo talks to the server's agent at all. False when the agent is older than the minimum this version of Deplo supports: everything on the server is refused until the agent updates, though its apps keep running. True while it is not provisioned yet.
`agentVersion`	`String`	The agent binary version last reported by this server on its last Hello. Null until the server's agent has called home and been provisioned.
`allTeams`	`Boolean`	True (the default) when every team may target this server. False restricts it to `teams` (Settings -> Servers -> Team access).
`buildFallback`	`Boolean`	Whether this host compiles for an app whose own build server could not be reached. On by default for the Deplo host and off for every other server, until setServerBuildFallback says otherwise. An app opts out of the whole chain with setAppBuildServer's buildFallback.
`cpuCores`	`Int`
`createdAt`	`String`
`deployConcurrency`	`Int`	How many deployments this server runs at once (default 1 = strict per-server serialization). Deploys on other servers run in parallel; a same-app deploy never overlaps regardless. Editable via setServerDeployConcurrency (instance-admin). With a build server, the lane belongs to the BUILDER - that is where a deploy's cost is.
`diskGb`	`Int`
`dockerVersion`	`String`
`expectedAgentVersion`	`String`	The agent version this server should be running: the one release of DeploCloud/deplo-agent this Deplo is pinned to. A newer agent is left alone, never downgraded.
`host`	`String`
`hostArch`	`String`	This host's CPU architecture ("amd64" \| "arm64"), observed from the agent. Empty when the agent is too old to report it. A build server can only build for a host of the SAME architecture.
`id`	`ID`
`ip`	`String`
`isDeploHost`	`Boolean`	Whether this is the host running Deplo itself (the dashboard and API), as opposed to a remote that only runs the deploy agent. It cannot be removed, and it is the only server that can restart the Deplo panel.
`lastSeenAt`	`String`	Heartbeat cache (P5) - a hint, not the source of truth.
`memoryMb`	`Int`
`name`	`String`
`provisioned`	`Boolean`	True once the server's agent has called home and been trusted.
`role`	`String`	What this server is for: "everything" (the default), "build" (Docker but no proxy; it compiles for other hosts and runs nothing), "storage" (no Docker; it only holds backups) or "import" (a MIGRATION SOURCE: another platform's host, registered by the import wizard to read its volumes, out of every deploy and build picker and swept by nothing). Only the build axis is changeable after installation; "import" is refused by setServerRole in both directions.
`status`	`ServerStatus`
`statusCheckedAt`	`String`	When `status` was last OBSERVED by a live agent Hello probe (ISO), or null if it never has been. Read it WITH `status`: the pair is a timestamped observation, not a standing claim, and a client that shows the status without qualifying its age is showing a value that may be hours old. Never fabricated - a probe that times out or is throttled writes nothing.
`statusMessage`	`String`	Why `status` is not `online` - e.g. "The agent is up but Docker is unreachable". Null when online or never probed. Requires instanceAdmin.
`teams`	`[Team!]`	Teams explicitly granted access when `allTeams` is false (empty otherwise - every team has access). Only an instance admin sees every team; anyone else sees the active team at most.
`traefikEnabled`	`Boolean`
`type`	`ServerType`
`uninstallError`	`String`	Why Deplo could not take its agent off this migration source, after it stopped trying (three attempts over several minutes). Empty otherwise. This is the only state that needs a person: surface it verbatim next to the host-side uninstall command.
`uninstallPending`	`Boolean`	Deplo is still trying to take its agent off this migration source, and will try again on its own. Nothing is asked of anyone while this is true. False for every other server.

ServerAgentUpdate

Where Deplo's update of one server's agent stands. Deplo retries a failed update on its own (1, 2, 4 ... up to 60 minutes apart) for 24 hours from the first failure; retryServerAgentUpdate tries again now.

Field	Type	Description
`attempts`	`Int`
`failed`	`Boolean`	At least one attempt failed. Only then can an instance admin retry by hand.
`failure`	`String`	Why the last attempt failed: "busy" (a deploy was running), "unreachable", "error", or "no_return" (it took the new agent and did not come back, which pauses every other server). Empty before the first failure.
`firstFailedAt`	`String`
`gaveUp`	`Boolean`	24 hours passed since the first failure: no automatic retry is scheduled.
`lastError`	`String`
`nextRetryAt`	`String`
`running`	`Boolean`	An attempt is in progress; a retry is refused until it ends.

ServerCertificate

A TLS certificate the operator installed on a server themselves, described from the certificate itself. It lives in that host's proxy and nowhere else (Deplo stores no copy), and its private key has no read path at all.

Field	Type	Description
`domains`	`[String!]`	Every hostname this certificate is valid for. Traefik picks a certificate by the domain the browser asked for, so these are the domains it will serve on this host.
`expired`	`Boolean`	Whether it is already past its expiry. A certificate can lapse in place long after it was installed, so this is computed, not stored.
`expiresInDays`	`Int`	Whole days left before it expires, negative once it has. Nothing renews these, so the only warning is this number.
`id`	`String`	The certificate's SHA-256 fingerprint, which is also how it is addressed for removal. Nothing is minted: a certificate identifies itself.
`issuer`	`String`	Who signed it.
`notAfter`	`String`	Expires at (ISO-8601).
`notBefore`	`String`	Valid from (ISO-8601).
`subject`	`String`	Its common name, or its first domain when it carries none.

ServerHostInfo

What a server IS (its hardware, OS and clock) read live from its agent and stored nowhere. Distinct from the usage gauges on Monitoring: this is the make and model, not the load.

Field	Type	Description
`arch`	`String`	Machine architecture, e.g. "x86_64".
`canRestartControlPlane`	`Boolean`	Whether the Deplo panel runs in a container on this host that the agent could restart. False when Deplo was started some other way, in which case the restart action is not offered.
`controlPlaneTimeUnixMs`	`Float`	Deplo's own clock when this reading landed (epoch ms). The pair with timeUnixMs is the honest drift measurement: measuring against the browser measures the browser, and a viewer whose laptop is an hour out would see the whole fleet reported as drifting.
`cpuCores`	`Int`	PHYSICAL cores. A 6-core/12-thread chip reports 6 here and 12 in cpuThreads; reporting threads as cores is the usual way a spec sheet overstates a box.
`cpuModel`	`String`	The processor as it names itself, e.g. "AMD Ryzen 5 5600X 6-Core Processor". Empty when the host does not report one.
`cpuThreads`	`Int`	Logical processors - what schedulers and `nproc` count.
`diskTotalBytes`	`Float`	Size of the filesystem the agent's data lives on, in bytes.
`diskUsedBytes`	`Float`	Used bytes on that filesystem.
`dockerRootDir`	`String`	Where Docker actually keeps images and volumes - on a host with a mounted data disk this is not the root filesystem.
`dockerVersion`	`String`	Docker engine version, empty when the daemon is unreachable.
`kernel`	`String`	Kernel release (uname -r).
`memTotalBytes`	`Float`	Installed RAM, in bytes.
`osPretty`	`String`	The distribution, e.g. "Ubuntu 24.04.1 LTS".
`timeUnixMs`	`Float`	The host's own clock at the moment of the read (epoch ms). Compare it with controlPlaneTimeUnixMs, never with the viewer's clock, to spot a drifting box.
`timezone`	`String`	The host clock's IANA zone, e.g. "Europe/Rome". Empty if it reports none.
`uptimeSec`	`Float`	Seconds since the host booted.
`utcOffsetMinutes`	`Int`	Offset from UTC in MINUTES, not hours - Kathmandu is +345 and Kolkata +330.

ServerMetrics

A live resource-usage snapshot for one server (CPU, memory, disk, network, load and running-container count).

Field	Type	Description
`agentVersion`	`String`
`containers`	`Int`
`cpu`	`Float`
`cpuCores`	`Int`
`diskPct`	`Float`
`diskTotal`	`Float`
`diskUsed`	`Float`
`expectedAgentVersion`	`String`
`load`	`[Float!]`	Load averages over [1m, 5m, 15m].
`memCache`	`Float`	Buffers + Cached + SReclaimable.
`memFree`	`Float`	MemFree. `memUsed` is total-available (what `free` calls used), so this and `memCache` are what let the tile show the reclaimable half.
`memPct`	`Float`
`memTotal`	`Float`
`memUsed`	`Float`
`netRx`	`Float`
`netTx`	`Float`
`online`	`Boolean`
`serverId`	`ID`
`source`	`String`	Which sampler produced this frame: "cgroup2" \| "docker-stats". Empty when the reading did not come from the telemetry stream.
`traefik`	`Boolean`
`ts`	`Float`
`uptimeSec`	`Int`

ServerReadinessCheck

One row of a server readiness report: a single thing Deplo could verify about the host, and what it found.

Field	Type	Description
`detail`	`String`	What we found. Drawn from a closed, curated set whenever it describes a failure, never a raw agent error (which would leak the pinned certificate fingerprint and the dial address).
`group`	`ServerReadinessGroup`
`hint`	`String`	What to do about it. Null on a `pass` row.
`id`	`String`	Stable row id, e.g. "docker.available" or "build.nixpacks".
`label`	`String`
`severity`	`ServerReadinessSeverity`

ServerReadinessReport

A live, never-persisted answer to 'is this host set up to run deployments?'. Assembled from one agent Hello, two host port bind-tests and one host-metrics call, plus the control plane's own record of the server. It is NOT a sixth ServerStatus and nothing gates on it - the deploy gate is and stays the mandatory live Hello pre-flight.

Field	Type	Description
`checkedAt`	`String`	When the probe STARTED (ISO). Never fabricated.
`checks`	`[ServerReadinessCheck!]`
`serverId`	`String`
`serverName`	`String`
`summary`	`String`	One sentence for the banner.
`verdict`	`ServerReadinessVerdict`

ServerRemoval

The result of removing a server. Removal revokes the agent's trust and forgets the row - it does NOT uninstall anything on the host, so the uninstall command is always returned.

Field	Type	Description
`uninstallCommand`	`String`	Paste-on-the-server command that removes the agent, Traefik and the Deplo network from the host. Deplo cannot do this remotely: revoking trust is precisely what ends its right to command that agent.
`warning`	`String`	A non-blocking hazard the operator must know about (e.g. an App was mid-move off this host, so its data volumes are now stranded there), or null.

ServerRestartReport

The outcome of restarting everything Deplo runs on a server. Partial success is normal and is reported as such - one wedged stack must not hide that the other twenty came back.

Field	Type	Description
`failures`	`[RestartedWorkload!]`
`restarted`	`Int`
`skipped`	`Int`	Workloads left alone: the ones already stopped (starting them is a different action than restarting them) and the ones with a deploy in flight, which come back on their own.

ServerUninstall

The result of uninstalling the agent from a MIGRATION SOURCE. Unlike ServerRemoval this one DOES touch the host - it is the only case where Deplo installed the agent on a machine that is not part of the fleet, so taking it back off is Deplo's job and not the operator's.

Field	Type	Description
`error`	`String`	Why the uninstall did not happen, or null. Surface it verbatim.
`removed`	`Boolean`	True when the host is clean AND the server row is gone. False leaves both in place - the agent is still installed there, and pretending otherwise would strand a running agent nobody can see.
`uninstallCommand`	`String`	The host-side command, returned in both cases: on success so the operator can verify, on failure because it is then the only way through.
`warning`	`String`	A non-blocking hazard, same meaning as on ServerRemoval, or null.

ServerWorkload

An app or database placed on a server, with its live status and usage.

Field	Type	Description
`containers`	`[WorkloadContainer!]`
`cpu`	`Float`
`engine`	`String`	A database's engine ("postgres"); null for an app.
`environment`	`String`
`href`	`String`	Its page, or null when the viewer is not in the owning team.
`id`	`ID`
`kind`	`String`	"app" or "database".
`logo`	`String`
`logoTone`	`String`
`memUsed`	`Float`
`name`	`String`
`project`	`String`
`restarts`	`Int`
`status`	`String`	The live status shown on its badge: active, restarting, unhealthy, down, idle, error, ...
`teamAvatarUrl`	`String`
`teamName`	`String`
`teamSlug`	`String`

SharedVar

A shared environment variable (ADR-0010/0012/0027). Secret values are masked. Team / environment / project scopes say who it is AVAILABLE to, and it injects only through explicit per-app links (opt-in) - UNLESS autoInject, which is what reaching more than one team means.

Field	Type	Description
`appIds`	`[ID!]`
`apps`	`[SharedVarApp!]`
`autoInject`	`Boolean`	Injects into every app of every team it reaches, with no per-app link, at the LOWEST precedence. True when it reaches more than one team.
`createdAt`	`String`
`createdBy`	`VarAuthor`
`editable`	`Boolean`	The viewer's team owns it. A variable shared IN from another team is read-only here, and its project/environment/app ids come back empty.
`environmentIds`	`[ID!]`
`environments`	`[SharedVarEnvironment!]`
`id`	`ID`
`key`	`String`
`masked`	`Boolean`
`ownerTeam`	`SharedVarTeam`	The owning team; null when the instance owns it.
`projectIds`	`[ID!]`
`projects`	`[SharedVarProject!]`
`targets`	`[EnvTarget!]`	Deploy runtimes this variable applies to.
`teamIds`	`[ID!]`
`teamWide`	`Boolean`	It reaches the VIEWER's team.
`teams`	`[SharedVarTeam!]`
`type`	`EnvVarType`
`updatedAt`	`String`
`updatedBy`	`VarAuthor`
`value`	`String`

SharedVarApp

Field	Type	Description
`id`	`ID`
`name`	`String`
`slug`	`String`

SharedVarEnvironment

Field	Type	Description
`id`	`ID`
`name`	`String`
`projectName`	`String`

SharedVarProject

Field	Type	Description
`id`	`ID`
`name`	`String`
`slug`	`String`

SharedVarTeam

Field	Type	Description
`id`	`ID`
`name`	`String`

SourceMove

This Deplo's side of a Deplo move, as the old Deplo.

Field	Type	Description
`createdAt`	`String`
`expiresAt`	`String`	Set only while the code is armed: a bound code lives until the copy finishes or is cancelled.
`finishedAt`	`String`	When the copy finished, once it is done.
`id`	`String`
`peerUrl`	`String`	The new Deplo's address, once one has connected with the code.
`startedBy`	`String`
`state`	`SourceMoveState`

StrandedServer

An offline server whose agent the offered Deplo version would refuse.

Field	Type	Description
`id`	`ID`
`name`	`String`
`version`	`String`

Takeover

The takeover this instance is in the middle of. Null on an ordinary install.

Field	Type	Description
`dataLoss`	`[String!]`	Services of every finished run that arrived without their data. The cutover stops the old panel for good (its volumes stay on the disk, unread), so requestTakeover refuses unless acceptDataLoss says so.
`error`	`String`	Why the last cutover rolled back, in the installer's words. Null unless the state is failed.
`platform`	`TakeoverPlatform`
`runId`	`String`
`seenExternalRequest`	`Boolean`	Whether anything but the installer has ever reached this panel. False means its port is probably closed, not that nobody has looked.
`state`	`TakeoverState`

TakeoverCancelResult

Field	Type	Description
`left`	`[String!]`	The ones that would not start, with the reason.
`restarted`	`Int`	How many services were started again on the platform being kept.

TakeoverPreflight

What a takeover of this machine is walking into. Both halves are things that otherwise only show up mid-copy.

Field	Type	Description
`agentMessage`	`String`
`agentReady`	`Boolean`	Whether the agent on this machine answers a live probe. Without it no volume can be read at all.
`diskFreeBytes`	`Float`
`diskTight`	`Boolean`	The copy writes a second copy of every volume it moves, and this machine has little room for one. A warning with the real numbers, never a refusal.
`diskTotalBytes`	`Float`

Team

A team that owns apps, infra and members.

Field	Type	Description
`avatarUrl`	`String`	The team's picture, or null for its two-letter monogram. A team has no email, so there is no Gravatar step.
`createdAt`	`String`
`id`	`ID`
`name`	`String`
`plan`	`TeamPlan`
`requireTwoFactor`	`Boolean`	Whether every member of this team must have two-factor authentication.
`slug`	`String`

TeamMembership

A team the viewer belongs to, carrying their role and the team size.

Field	Type	Description
`avatarUrl`	`String`
`createdAt`	`String`
`id`	`ID`
`memberCount`	`Int`
`name`	`String`
`plan`	`TeamPlan`
`role`	`String`
`slug`	`String`

TeamRole

A named capability set members of the active team can be assigned. Three defaults (owner/member/viewer) plus any number the team authors itself.

Field	Type	Description
`builtinKey`	`Role`	Set for one of the three default roles; null for a role the team created.
`capabilities`	`[Capability!]`	Exactly what a member holding this role can do. `view` is always included.
`createdAt`	`String`
`description`	`String`
`id`	`ID`
`locked`	`Boolean`	The Owner default: always full access, not editable, so a team can never edit its way out of administering itself.
`memberCount`	`Int`
`modified`	`Boolean`	A default role edited away from what Deplo ships - it can be reset.
`name`	`String`
`requireTwoFactor`	`Boolean`	Holders of this role must have two-factor authentication; without it they resolve no capabilities at all, over the UI and the API alike.
`scope`	`RoleScope`	Where in the team this role reaches. Null means the whole of it, which is every role until one is limited. A scoped role also loses every capability that only means something team-wide.

TemplateVariantSummary

A compact, deployable variant from the public template catalog.

Field	Type	Description
`category`	`String`
`docsUrl`	`String`
`name`	`String`
`shortDescription`	`String`
`templateSlug`	`String`
`variantName`	`String`
`variantSlug`	`String`

TwoFactorEnrolment

A pending enrolment: the secret to scan and the codes to save. Two-factor is not on until confirmTwoFactorEnrolment succeeds.

Field	Type	Description
`recoveryCodes`	`[String!]`	Single-use codes, shown this once and never again.
`totpUri`	`String`	The otpauth:// URI an authenticator app scans.

UpdateInfo

Result of checking the upstream GitHub repository for a newer Deplo release.

Field	Type	Description
`canary`	`Boolean`	Whether canary (pre-release) versions count as updates. Off: only stable releases do.
`checkedAt`	`String`
`current`	`String`
`error`	`String`
`latest`	`String`
`name`	`String`
`publishedAt`	`String`
`strandedServers`	`[StrandedServer!]`	Offline servers whose agent is older than the minimum the `latest` Deplo supports. They cannot update while offline, so they stay unusable until they come back and their agent updates. Empty when there is no update or the release does not say.
`updateAvailable`	`Boolean`
`url`	`String`

UsageReportPreview

The Usage report this instance would send right now, built live from the same code that sends it. Nothing stores a sent payload: what is shown here is what leaves.

Field	Type	Description
`instanceId`	`String`	The random id the reports are keyed by - quote it to ask Deplo to erase them. Null until the first send mints one; turning the switch off clears it and the next on mints a fresh one.
`json`	`String`	The whole document, pretty-printed JSON.
`lastSentAt`	`String`

UserDetail

Full per-user detail for the admin editor - the email IS included here.

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`	Resolved profile picture: uploaded image, else Gravatar, else null for the monogram.
`canConfigureTraefik`	`Boolean`
`canExposePorts`	`Boolean`
`canMountHostVolumes`	`Boolean`
`createdAt`	`String`
`email`	`String`
`isInstanceAdmin`	`Boolean`
`isInstanceOwner`	`Boolean`	Owns the instance. Their account is editable only by themselves.
`name`	`String`
`passkeyCount`	`Int`	How many passkeys they hold. Only above zero is `resetUserPasskeys` offered.
`suspended`	`Boolean`
`teams`	`[UserDetailTeam!]`
`twoFactorEnabled`	`Boolean`	Has an authenticator app enrolled. Only then is `resetUserTwoFactor` offered.
`userId`	`ID`
`username`	`String`

UserDetailTeam

Field	Type	Description
`role`	`Role`
`teamAvatarUrl`	`String`
`teamId`	`ID`
`teamName`	`String`

UserSearchResult

A registered user matched by username/display name when adding members.

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`	Resolved profile picture: uploaded image, else Gravatar, else null for the monogram.
`name`	`String`
`teamAvatarUrl`	`String`
`teamName`	`String`
`userId`	`ID`
`username`	`String`

UserSession

A browser or client currently signed in to the viewer's account. Carries no credential - a session is addressed by its id, never by its token.

Field	Type	Description
`browser`	`String`	The client half of `label`, e.g. "Chrome". Null when the user agent matched nothing.
`createdAt`	`String`
`current`	`Boolean`	This is the session making the request. It cannot be revoked from here; sign out instead.
`device`	`DeviceKind`
`expiresAt`	`String`
`id`	`ID`
`ipAddress`	`String`
`label`	`String`	Human description, e.g. "Chrome on macOS".
`lastSeenAt`	`String`	When the session was last refreshed, which stands in for last used. Accurate to about 15 minutes.
`os`	`String`	The platform half of `label`, e.g. "macOS" or "iPhone".

UserTeamAccess

What one person can do in one team, as an instance admin sets it.

Field	Type	Description
`baseCapabilities`	`[Capability!]`	The set on the membership - their own when they hold one, else their role's.
`customCapabilities`	`Boolean`	That set is theirs, so saving their role no longer rewrites it.
`granular`	`Boolean`	Their reach IS the nodes below: they touch those and nothing else, whatever their role reaches. Stored as the admin's choice, so deleting the last granted node doesn't silently turn it off.
`isFounder`	`Boolean`	The team's primary owner. Their access can't be changed by anyone, instance admins included.
`nodes`	`[AccessNodeGrant!]`
`rank`	`String`	`owner` outranks everyone; anything else ranks as a member.
`roleId`	`ID`
`roleName`	`String`
`teamId`	`ID`
`teamName`	`String`

VarAuthor

The user who created or last modified a variable. Identity only, never an email.

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`	Resolved profile picture: uploaded image, else Gravatar, else null for the monogram. Derived server-side, so the address itself never travels.
`id`	`ID`
`name`	`String`
`username`	`String`

Viewer

The authenticated principal for the current request.

Field	Type	Description
`avatarColor`	`String`
`avatarUrl`	`String`	Resolved profile picture: uploaded image, else Gravatar, else null for the monogram.
`email`	`String`
`id`	`ID`
`isInstanceAdmin`	`Boolean`
`name`	`String`
`role`	`String`
`twoFactorEnabled`	`Boolean`	Whether this account has a verified second factor. Says only that one exists, never anything about it.
`username`	`String`

Volume

A persistent volume mounted into an app - a docker named volume, an app-files bind, or a host bind mount.

Field	Type	Description
`hostPath`	`String`
`id`	`ID`
`mountPath`	`String`
`name`	`String`
`projectPath`	`String`
`propagation`	`MountPropagation`
`readOnly`	`Boolean`
`service`	`String`
`type`	`String`

WorkloadContainer

One container of an app or database, from the live stream.

Field	Type	Description
`cpu`	`Float`	Percent, like docker stats.
`health`	`String`	"healthy", "unhealthy" or "starting"; empty when the image has no healthcheck.
`memUsed`	`Float`	Bytes.
`name`	`String`
`restartCount`	`Int`
`state`	`String`	Docker's state: "running", "restarting", "exited", ...

AccessNodeGrantCopy Anchor Link

ActivityCopy Anchor Link

AddServerPayloadCopy Anchor Link

ApiTokenCopy Anchor Link

AppCopy Anchor Link

AppEnvGroupCopy Anchor Link

AppEnvGroupAppCopy Anchor Link

AppPreviewCopy Anchor Link

AppPreviewsViewCopy Anchor Link

AppRuntimeCopy Anchor Link

AppSharedVarCopy Anchor Link

AppStorageFileCopy Anchor Link

AppTransferInfoCopy Anchor Link

AppTransferTargetCopy Anchor Link

AuthPayloadCopy Anchor Link

BackupCopy Anchor Link

BackupDestinationCopy Anchor Link

BackupDestinationOptionCopy Anchor Link

BackupRunCopy Anchor Link

BasicAuthUserCopy Anchor Link

BuildServerChoiceCopy Anchor Link

BulkAppActionResultCopy Anchor Link

CertificateAccountCopy Anchor Link

ComposeNameClashCopy Anchor Link

ConsoleInfoCopy Anchor Link

ConsoleInstanceCopy Anchor Link

ContainerInstanceMetricsCopy Anchor Link

ContainerMetricsCopy Anchor Link

ContainerMetricsSampleCopy Anchor Link

CreateTokenPayloadCopy Anchor Link

CronJobCopy Anchor Link

CronJobsViewCopy Anchor Link

CronRunCopy Anchor Link

DatabaseCopy Anchor Link

DatabaseMountCopy Anchor Link

DatabaseTransferInfoCopy Anchor Link

DatabaseTransferTargetCopy Anchor Link

DeleteUserImpactCopy Anchor Link

DeleteUserKeptTeamCopy Anchor Link

DeleteUserResultCopy Anchor Link

DeleteUserTeamImpactCopy Anchor Link

DeploChangelogCopy Anchor Link

DeploMoveCountsCopy Anchor Link

DeploMoveDatabaseHostCopy Anchor Link

DeploMovePreviewCopy Anchor Link

DeploMovePreviewServerCopy Anchor Link

DeploMoveReadinessCopy Anchor Link

DeploMoveServerCopy Anchor Link

DeploMoveStatusCopy Anchor Link

DeploMoveStepCopy Anchor Link

DeploMoveTargetServerCopy Anchor Link

DeploMoveWorkloadCopy Anchor Link

DeploReleaseCopy Anchor Link

DeploUpdateStartedCopy Anchor Link

DeploymentCopy Anchor Link

DestinationRemovalImpactCopy Anchor Link

DestinationTestResultCopy Anchor Link

DockerCleanupPolicyCopy Anchor Link

DockerCleanupRunCopy Anchor Link

DockerCleanupRunItemCopy Anchor Link

DomainCopy Anchor Link

EnvImportResultCopy Anchor Link

EnvironmentCopy Anchor Link

EnvVarCopy Anchor Link

ExecResultCopy Anchor Link

FleetAgentCopy Anchor Link

FleetAgentsCopy Anchor Link

FleetServerMetricsCopy Anchor Link

FleetSparkCopy Anchor Link

FolderCopy Anchor Link

FolderGrantCopy Anchor Link

FolderShareCandidateCopy Anchor Link

GitConnectionCopy Anchor Link

GithubAppCopy Anchor Link

GithubConnectStartCopy Anchor Link

GithubInstallationCopy Anchor Link

GithubPullRequestCopy Anchor Link

GithubRepoCopy Anchor Link

GitProviderCopy Anchor Link