Every object a query, mutation or subscription can return, with its fields.
Every object type in the schema, A to Z. Pick fields from these tables when you write a selection set. A field that takes arguments lists them in its description.
A capability set attached to one project, folder or app. It REPLACES the team role's set inside that node, and may grant more than the role does.
A single audit-log event in the active team's timeline.
| Field | Type | Description |
|---|
actor | String | |
actorProvider | String | The git host actor is a login on, when a webhook push wrote this row (github, gitlab, bitbucket, gitea). Null for a person on this instance and for an actor with no host, like system. |
actorUser | VarAuthor | |
actorUserId | ID | |
appId | ID | |
createdAt | String | |
cursor | String | |
databaseId | ID | |
id | ID | |
message | String | |
teamId | ID | |
type | ActivityType | |
A newly registered server + its one-time agent install command.
| Field | Type | Description |
|---|
installCommand | String | Paste-on-the-server command to provision the agent. Shown once; embeds a single-use token. |
server | Server | |
A PERSONAL API token: it belongs to the person who minted it, and nobody else can list, edit or revoke it. Only the prefix is ever exposed - the raw token is shown once at creation and only its hash is persisted.
| Field | Type | Description |
|---|
appIds | [String!] | Individually-named apps in the scope. |
capabilities | [String!] | What this token itself may do. Its effective power is this set intersected with what its creator can still do in the team, so a token can never outlive the access of the member who minted it. |
createdAt | String | |
expired | Boolean | Whether the expiry above has passed. Answered by the server, so a client with a wrong clock cannot disagree about whether a credential still works. |
expiresAt | String | When this token stops working. Null means never, which is what a token minted before expiries existed still is. An expired token resolves to nothing everywhere - the API, MCP and deploy hooks alike. |
folderIds | [String!] | Whole folders in the scope: every app in them and in the folders nested under them. Most apps live in a folder, so this is usually the level a scope is drawn at. |
id | ID | |
instanceAdmin | Boolean | The token may administer the whole instance (users, servers and the global environment), not just its team. Mutually exclusive with a project scope. |
lastUsedAt | String | |
mcp | Boolean | Whether this credential drives Deplo over MCP: minted by approving an OAuth consent, or a bearer token that has already called the MCP server. The question a company asks is which of its tokens an AI agent holds, and either shape answers yes. |
name | String | |
oauthClientName | String | Set when this token was minted by connecting an AI client over OAuth rather than from the tokens page. updateToken re-authors it like any other: the client sees the new permissions on its next call. |
prefix | String | |
projectIds | [String!] | Whole projects in the scope: every app in them, now and later. Naming one narrows the token inside that team, so the team-wide permissions it holds (managing members, roles, databases) stop applying there. |
scoped | Boolean | Whether this token is limited at all. False means every team its owner may use API tokens in, and everything in it. |
teamIds | [String!] | Whole teams in the scope: every project and every app in them. |
A deployable application owned by a team.
| Field | Type | Description |
|---|
autoDeploy | Boolean | |
buildFallback | Boolean | Build somewhere else when this app's build server cannot be reached, saying so in the deploy log: the servers marked as a build fallback (the Deplo host by default), then the app's own server. True by default. False fails the deploy instead, for whoever chose a small deploy server on purpose. |
buildServerId | ID | The server that BUILDS this app's image, when that is not serverId. Null is Automatic: a build-only server if the fleet has one this team can reach and its architecture matches, otherwise build where the app runs. Setting it to serverId means 'always build on this app's own server'. Ignored by a compose stack and a docker-image source, neither of which Deplo builds. |
compose | String | |
composeUpArgs | String | Extra flags this app appends to the docker compose up that brings it up, or null for the untouched command. Additive only - the flags that choose the project, stack file or env-file are refused. |
createdAt | String | |
dataCopyError | String | Why this app's data did not arrive, when a migration tried to copy it and could not. Empty for every app that was never migrated and every copy that worked. While it is set, deploying and starting this app are refused - its volumes are empty or half written - and deployWithoutMigratedData is how someone accepts that and unblocks it. |
deployHookEnabled | Boolean | Whether this app's deploy hook answers. The hook URL itself is never a field - read it back with revealAppDeployHook. |
deployments | [Deployment!] | The app's most recent deployments, newest first (capped so a nested query can't fan out over the whole history + per-deployment logs). |
dockerImage | String | |
domainCount | Int | |
folderId | ID | |
framework | String | The JavaScript framework backing this app ("nextjs", "astro", "nestjs", ...), or null when none was found or the app doesn't build with one of the auto-detecting builders (Nixpacks / Railpack). Detected on every deploy, unless setAppFramework has corrected it - in which case that choice is what this returns. |
frameworkDetected | String | What the LAST DEPLOY actually read from the source, ignoring any correction. Equals framework unless the user overrode it. |
healthCheck | HealthCheck | The health check baked into this app's compose, or null when it has none. |
id | ID | |
latestDeployment | Deployment | |
logo | String | |
name | String | |
ports | [PublishedPort!] | Host ports this app publishes. Empty for a compose stack, which publishes its own in its compose file. |
productionUrl | String | |
projectId | ID | The Project container this app belongs to, if any. |
resources | ResourceLimits | Per-app resource caps applied at deploy time, or null when the app has no limits set. |
rollbackKeep | Int | How many previous deployments this app can be rolled back to (0-20, default 3). Retention: its server keeps this many of the app's images behind the running one. 0 means there is nothing to go back to. |
serverId | ID | |
slug | String | |
source | DeploySource | |
status | AppStatus | |
teamId | ID | |
updatedAt | String | |
volumes | [Volume!] | Persistent volumes mounted into this app. |
One app together with all of its env vars.
| Field | Type | Description |
|---|
id | ID | |
name | String | |
slug | String | |
An ephemeral deploy of one App for one open pull request, running as its own stack deplo-<slug>__pr-<n> with its own URL. Not an App and not an Environment.
| Field | Type | Description |
|---|
appId | ID | |
approved | Boolean | A fork's pull request only builds once a member with deploy approves it. |
approvedSha | String | |
author | String | |
baseBranch | String | |
closed | Boolean | |
createdAt | String | |
headBranch | String | |
headRepo | String | |
host | String | |
id | ID | |
isFork | Boolean | The head lives in a repository the operator does not control, so its code is untrusted and it never receives secret-typed variables. |
latestDeploymentId | ID | |
prNumber | Int | |
pullRequestUrl | String | |
status | String | blocked | queued | building | active | error | idle. |
title | String | |
updatedAt | String | |
url | String | |
Everything the Pull requests page renders in one read: whether previews can work at all, the branch they watch, the app's settings, and the previews.
| Field | Type | Description |
|---|
appId | ID | |
autoDeploy | Boolean | |
baseDomain | String | |
branch | String | Pull requests must target this branch to get a preview. |
buildDrafts | Boolean | |
comment | Boolean | |
enabled | Boolean | |
forkPolicy | String | |
githubSettingsUrl | String | |
https | Boolean | |
maxActive | Int | |
port | Int | |
previews | [AppPreview!] | |
requiredLabels | [String!] | |
serverId | String | |
ttlDays | Int | |
unavailable | String | null => previews work. Otherwise the ONE reason they cannot: not-github | no-installation | app-needs-update | disabled. |
What an app's containers are ACTUALLY doing on the host, read live from the owning agent. App.status only records the last thing the control plane asked for (deploy / start / stop), so it keeps saying 'active' for an app that has been crash-looping since its deploy succeeded.
| Field | Type | Description |
|---|
containers | [RuntimeContainer!] | |
missing | [String!] | Declared services with NO container on the host - the failure the running/total counts cannot see, because a container that was never created is not there to be counted as stopped. |
restarting | Int | |
running | Int | |
total | Int | |
unhealthy | Int | Containers that are running and failing their own healthcheck - up, listening, and broken. |
unreachable | Boolean | The agent did not answer: the counts are unknown, not zero. |
A shared variable as seen from one app. linked is the explicit opt-in (the only thing that injects - ADR-0012); inScope/scope say whether an availability scope suggests it here.
| Field | Type | Description |
|---|
autoInject | Boolean | It lands here with no link and cannot be removed from this app. |
id | ID | |
inScope | Boolean | An availability scope (team / environment / project) covers this app. |
key | String | |
linked | Boolean | The app opted in - the var injects on its next deploy. |
masked | Boolean | |
ownerTeamName | String | The team behind an auto-injected variable. |
scope | String | The most specific covering scope: teamWide | environment | project. |
targets | [EnvTarget!] | |
type | EnvVarType | |
updatedAt | String | |
updatedBy | VarAuthor | |
value | String | Masked for secrets, like SharedVar.value. |
The file behind a File storage entry, where a path that does not exist yet is a normal answer rather than an error.
| Field | Type | Description |
|---|
path | String | |
state | String | |
text | String | |
What a transfer of this app would cost, plus the teams that could take it.
| Field | Type | Description |
|---|
appName | String | |
backupCount | Int | Backup schedules targeting this app - removed on transfer, because they point at the current team's backup destination. |
gitConnectionLabel | String | The git connection authenticating this app's clone, or null. It is always dropped on transfer - a token is owned by the current team and cannot be assumed to reach the repository from another one. |
githubConnected | Boolean | |
homeLabel | String | Where the app currently sits in its team ("folder Marketing"), or null at the top level. It leaves that home on transfer. |
serverName | String | |
sharedVarCount | Int | Shared variables linked to this app. The links do not survive the move (the variables belong to the current team). |
targets | [AppTransferTarget!] | |
A team the viewer could hand this app to - one of their OWN other teams where they hold the deploy capability.
| Field | Type | Description |
|---|
avatarUrl | String | |
githubFollows | Boolean | True when the repository connection survives the move, because that team has its own GitHub App installed on the repository's account. False => the connection and auto-deploy are dropped and must be reconnected there. Always true when the app has no GitHub connection. |
id | ID | |
name | String | |
serverAvailable | Boolean | False when the app's server is restricted and not shared with that team - the transfer is refused until an instance admin grants access. |
| Field | Type | Description |
|---|
requiresTwoFactor | Boolean | The password was correct but the account has 2FA: no session yet. Send a code to verifyTwoFactorLogin. |
viewer | Viewer | |
A scheduled backup of a database or project to a backup destination.
| Field | Type | Description |
|---|
appId | ID | |
createdAt | String | |
databaseId | ID | |
databaseName | String | |
destinationId | ID | |
destinationName | String | |
enabled | Boolean | |
id | ID | |
lastRunAt | String | |
lastStatus | BackupStatus | |
name | String | |
retentionCount | Int | How many backups this schedule keeps at its destination. A count, not a window in days. |
schedule | String | Cron expression. |
serviceName | String | |
targetKind | BackupTargetKind | |
teamId | ID | |
timezone | String | IANA zone the cron is read in. UTC for older schedules. |
Where a team's backup artifacts are kept: an S3-compatible bucket, or a directory on a server in the fleet. Secrets are masked and the recovery key is never a field - it has its own mutation, which records who took it.
| Field | Type | Description |
|---|
accessKeyMasked | String | |
allowPrivateEndpoint | Boolean | Whether this bucket is allowed to live on a private address. Instance-admin only to set. |
bucket | String | |
createdAt | String | |
encrypted | Boolean | Whether artifacts written here are encrypted. Always true for a server destination, and for any bucket connected since bucket artifacts started being encrypted. |
endpoint | String | |
freeBytes | Float | |
id | ID | |
kind | DestinationKind | |
lastTestAt | String | |
lastTestError | String | |
name | String | |
path | String | |
provider | S3Provider | |
recoveryKeySavedAt | String | |
region | String | |
resolvedPath | String | |
s3ExtraArgs | String | Advanced per-store quirk flags, as typed. Null when none. A server whose agent is too old ignores them and Deplo says so. |
serverId | ID | |
serverName | String | |
status | DestinationStatus | |
teamId | ID | |
totalBytes | Float | |
where | String | |
A backup destination as a picker shows it. No credentials, no test history: readable by anyone who may schedule or run a backup, including a member scoped to one folder.
One executed backup - a single dump+upload artifact, and the source for an in-place restore.
| Field | Type | Description |
|---|
appId | ID | |
backupId | ID | The owning schedule, or null for an ad-hoc run. |
databaseId | ID | |
destinationId | ID | |
error | String | |
finishedAt | String | |
id | ID | |
objectKey | String | Object key of the stored artifact. |
sizeBytes | Float | |
startedAt | String | |
status | BackupRunStatus | |
targetKind | BackupTargetKind | |
teamId | ID | |
verified | Boolean | Whether Deplo recorded a checksum when it wrote this artifact, and can therefore prove on restore that the file has not been replaced. False for runs taken before integrity checking shipped. |
An HTTP Basic Auth credential that gates every domain of an app. The password is never a field - read one back with revealBasicAuthPassword.
| Field | Type | Description |
|---|
createdAt | String | |
createdBy | VarAuthor | Who added the credential. |
id | ID | |
imported | Boolean | The credential was carried over from another platform verbatim, so it never went through Deplo's password rules. Shown as a warning next to the user. |
updatedAt | String | |
updatedBy | VarAuthor | Who last changed its password. |
username | String | |
One entry in the 'Build on' picker: a host this team may compile on.
| Field | Type | Description |
|---|
buildFallback | Boolean | Whether this host takes over when an app's own build server cannot be reached. True on the Deplo host by default; setServerBuildFallback is what changes it. |
buildOnly | Boolean | True for a host dedicated to building (it runs no apps). False for an ordinary server that would build for this app in addition to hosting its own. |
hostArch | String | Its CPU architecture ("amd64" | "arm64"), or "" when the agent is too old to report one. An image only runs on a host of the same architecture, so a choice whose arch differs from the app's server must be disabled rather than offered. |
id | ID | |
isDeploHost | Boolean | Whether this is the host running Deplo itself, as opposed to a remote that only runs the deploy agent. |
name | String | |
The outcome of a bulk action: how many apps it ran on, how many refused or failed, and the first failure's message. Apps the caller can't reach are not counted at all.
| Field | Type | Description |
|---|
error | String | |
failed | Int | |
ok | Int | |
One server's Let's Encrypt account, read from that host's own proxy configuration. email is null when Deplo cannot manage certificates there; unavailable says why, in the host's own words.
| Field | Type | Description |
|---|
customCertificates | Int | How many certificates the operator installed on this host themselves (see serverCertificates). |
email | String | |
expiresInDays | Int | Whole days until the first of those expires, negative once one has, null when there are none. Nothing renews a certificate installed by hand, so this is the only warning there is. |
serverId | String | |
serverName | String | |
unavailable | String | |
A service name this stack shares with an app or database already on the destination network, and what the rename would call it.
| Field | Type | Description |
|---|
name | String | |
owner | String | The app or database already answering to the name. |
renamedTo | String | The free name createApp(renameClashes: true) would use. |
Console attach info for an app (no shell probe - fetch the shell label separately via shellLabel).
| Field | Type | Description |
|---|
containerName | String | |
image | String | |
instances | [ConsoleInstance!] | |
running | Boolean | |
A single attachable container in an app's stack.
| Field | Type | Description |
|---|
exposed | Boolean | |
image | String | |
name | String | |
openStdin | Boolean | |
running | Boolean | |
service | String | |
tty | Boolean | |
user | String | |
workdir | String | |
Live resource usage for ONE container of an app/database stack - the Monitoring tab's per-container breakdown. net_* / block_* are cumulative byte counters since the container started.
| Field | Type | Description |
|---|
blockRead | Float | |
blockWrite | Float | |
cpu | Float | |
health | String | The healthcheck verdict when the image defines one: healthy | unhealthy | starting. EMPTY means there is no healthcheck at all, which is not a synonym for healthy. |
memLimit | Float | |
memPct | Float | |
memUsed | Float | |
name | String | |
netNsHost | Boolean | This container is on the host's network (network_mode: host), so net_rx/net_tx are 0 here - its traffic is the machine's, on the server's own network chart. |
netNsId | Float | The container's network namespace. Two containers reporting the same one (a sidecar on network_mode: service:x) read the SAME counters, and the stack total counts them once. 0 from an older agent. |
netRx | Float | |
netTx | Float | |
pids | Int | |
restartCount | Int | How many times docker has restarted this container - what tells a container that is starting from one that has been dying for an hour. |
running | Boolean | |
state | String | Raw docker state: running | restarting | exited | created | paused | dead | removing. Empty from an agent too old to report it. |
A fresh live metrics snapshot for one app/database stack: the aggregate across its containers, plus the per-container breakdown and an unsupported flag (the owning server's agent is too old for per-container metrics - the tab shows 'update the agent').
| Field | Type | Description |
|---|
blockRead | Float | |
blockWrite | Float | |
containers | Int | |
cpu | Float | |
hostCores | Int | The owning machine's core count - see the sample type. |
id | ID | |
instances | [ContainerInstanceMetrics!] | Per-container usage (multi-container stacks). Live only. |
memLimit | Float | |
memPct | Float | |
memUsed | Float | |
netRx | Float | |
netTx | Float | |
online | Boolean | |
pids | Int | |
running | Int | |
ts | Float | |
unsupported | Boolean | |
One buffered aggregate metrics sample for an app/database stack (the sum across its running containers) - what the Monitoring tab's charts seed from. net_* / block_* are cumulative bytes; the client derives bytes/sec from the delta between consecutive samples.
| Field | Type | Description |
|---|
blockRead | Float | |
blockWrite | Float | |
containers | Int | |
cpu | Float | |
hostCores | Int | The owning machine's core count. cpu is a percentage of ONE core (like docker stats and htop), so 299% is three busy cores of this many. 0 before the first frame. |
id | ID | |
memLimit | Float | |
memPct | Float | |
memUsed | Float | |
netRx | Float | |
netTx | Float | |
online | Boolean | |
pids | Int | |
running | Int | |
ts | Float | |
Result of creating a token. raw is the full secret and is returned only here, once - store it now, it cannot be recovered later.
| Field | Type | Description |
|---|
raw | String | The full token secret. Shown once and never again. |
token | ApiToken | |
A command run inside one container of an App or a Database, on a cron schedule, in the job's own timezone. Running it produces a CronRun.
| Field | Type | Description |
|---|
appId | ID | |
command | String | |
createdAt | String | |
databaseId | ID | |
description | String | |
enabled | Boolean | |
envKeys | [String!] | The NAMES of the job's extra variables. The values are write-only and have no read path. |
id | ID | |
keepRuns | Int | |
lastRunAt | String | |
lastStatus | String | |
lastSuccessAt | String | The last time it actually worked. Separate from lastRunAt so a job quietly skipped for a week (its container is stopped) is visible. |
maxAttempts | Int | Launches per scheduled fire. 1 means no retry. |
name | String | |
nextRunAt | String | Computed, never stored, from the clock of whoever asked. Null while the job is disabled. It is a snapshot, not a countdown: re-read it rather than letting an old answer age into the past. |
overlap | String | skip | allow - what happens when the previous run is still going. |
running | Boolean | A run of this job is in flight. Not the same as lastStatus, which is written when a run SETTLES and so never says running. |
schedule | String | 5-field cron. |
service | String | Compose service to run in. Null means the target's own container - the only possibility for a database. Never a container name: a redeploy mints new ones, so it is resolved live before every attempt. |
shell | String | sh | bash. |
targetKind | String | app | database. |
timeoutSeconds | Int | Per ATTEMPT - it is the agent's exec deadline. timeout x attempts is capped at 24 hours. |
timezone | String | IANA zone the schedule is read in. NOT UTC unless you say so. |
updatedAt | String | |
user | String | |
workdir | String | |
Everything a Cron jobs page renders in one read.
| Field | Type | Description |
|---|
enabled | Boolean | The per-target master switch. While false the scheduler skips every job here, and the jobs themselves are untouched. |
jobs | [CronJob!] | |
primaryService | String | Where a job that names no service runs: the service the app's domain routes to, else the first declared. Null for a database. |
services | [String!] | Compose services a job can target. Empty for a database. |
targetId | ID | |
targetKind | String | |
One scheduled fire of a cron job, retries included.
| Field | Type | Description |
|---|
actor | String | |
attempt | Int | 0-based. The output below is this attempt's, not the first's. |
command | String | |
container | String | |
error | String | Why it failed or was skipped. Not command output. |
exitCode | Int | |
finishedAt | String | |
id | ID | |
jobId | ID | |
maxAttempts | Int | |
retrying | Boolean | Running, but waiting out a retry backoff rather than executing. |
scheduledFor | String | |
startedAt | String | |
status | String | running | succeeded | failed | timedout | skipped | lost. skipped never started (the container was stopped, or the previous run was still going) and lost means the outcome is unknown - the agent restarted mid-run. Neither is a failure. |
stderr | String | |
stdout | String | Last 16 KiB - the tail. |
trigger | String | schedule | manual. |
A provisioned database container owned by a team. The connection string is masked; reveal it with the revealConnection mutation.
| Field | Type | Description |
|---|
connectionStringMasked | String | |
createdAt | String | |
customCommand | String | Expert override: replaces the container command verbatim (redis's default command carries --requirepass - omit it and auth is off). |
customImage | String | Expert override: the full image ref replacing the derived engine image; the version field is inert while set. |
dataCopyError | String | Why this database's data did not arrive, when a migration tried to copy it and could not. Empty in the common case. While it is set, restarting and redeploying are refused: an engine started on the emptied volume initialises a NEW database over the old one's place. startWithoutMigratedData accepts that; rebuildDatabase also clears it, since a factory reset makes the empty volume the intended state. |
dbName | String | |
environmentId | ID | The Environment this database lives in, which is also the network it answers on. Null => the team's top level. |
exposedPort | Int | |
exposedPublicly | Boolean | |
host | String | |
id | ID | |
logo | String | Uploaded display logo as an image data-URI, or null to fall back to the engine's own brand mark (which is what the UI draws by default). |
mounts | [DatabaseMount!] | Expert override: the engine's own config files, written next to the stack and bind-mounted into the container. Empty for almost every database. Saving them applies immediately - the container is recreated. |
name | String | Display name, editable with renameDatabase. Not the container's identity - host is, and it is fixed at creation. |
port | Int | |
resources | ResourceLimits | Per-database resource caps applied at provision/redeploy time, or null when no limits are set. |
serverId | ID | |
sizeMb | Int | |
status | DatabaseStatus | |
teamId | ID | |
type | DatabaseType | |
username | String | |
version | String | |
One config file of a database: its name in the stack's files directory, its body, and where it is mounted inside the container.
| Field | Type | Description |
|---|
content | String | |
filePath | String | |
mountPath | String | |
Exactly what permanently deleting an account would take with it - read live so the confirmation states facts, not warnings.
| Field | Type | Description |
|---|
blockedReason | String | Non-null => this account can't be deleted at all; the reason to show. |
createdAppCount | Int | |
foundedTeams | [DeleteUserTeamImpact!] | Teams they founded that still have other members - deleted only on request. |
keptTeams | [DeleteUserKeptTeam!] | Teams that keep everything, minus this membership. |
name | String | |
ownedAppCount | Int | |
ownedFolderCount | Int | |
ownedProjectCount | Int | |
soloTeams | [DeleteUserTeamImpact!] | Teams where they are the ONLY member - always deleted with the account, since nobody would be left who could ever open them. |
tokenCount | Int | |
userId | ID | |
username | String | |
vacatedTeams | [String!] | Surviving teams whose last member/team manager this account is. The delete hands that capability to their longest-standing remaining member. |
| Field | Type | Description |
|---|
name | String | |
teamId | ID | |
What a completed account deletion actually removed.
| Field | Type | Description |
|---|
appsDeleted | Int | |
databasesDeleted | Int | |
teamsDeleted | Int | |
username | String | |
A team affected by deleting a user, and what it holds.
| Field | Type | Description |
|---|
appCount | Int | |
databaseCount | Int | |
name | String | |
otherMemberCount | Int | |
teamId | ID | |
Deplo's published releases, newest first.
One published release of Deplo, as the changelog renders it.
| Field | Type | Description |
|---|
body | String | |
current | Boolean | |
name | String | |
prerelease | Boolean | |
publishedAt | String | |
tag | String | |
url | String | |
A single build + release of an app.
| Field | Type | Description |
|---|
appId | ID | |
branch | String | |
buildDurationMs | Int | |
canRollback | Boolean | This app can be put back on this deployment: it succeeded, it built an image, that image is still on the app's current server, and it is not the one already running. |
commitAuthor | String | |
commitMessage | String | |
commitSha | String | |
createdAt | String | |
creator | String | |
creatorProvider | String | The git host creator is a login on, when a webhook push started this build (github, gitlab, bitbucket, gitea). Null when somebody on this instance ran it. |
creatorUser | VarAuthor | |
deployKey | String | The stack this build owns: the app slug for production, <slug>__pr-<n> for a pull request preview. |
environment | DeploymentEnvironment | |
id | ID | |
logs | [LogLine!] | Build logs for this deployment (most recent lines, capped). |
prNumber | Int | The pull request number, denormalized so it survives the preview itself being reaped. Null for a production build. |
previewId | ID | The pull request preview this build belongs to, or null for production. |
queuePosition | Int | 1-based position in the owning server's build queue while this deployment is queued (1 = next to build); null once it starts building or finishes. |
readyAt | String | |
rollbackOf | ID | Set when this deploy was a rollback: the deployment whose image it re-ran. Null when it built its own. |
startedAt | String | When the build was claimed off the queue and started running - the origin buildDurationMs is measured from, and what a live build timer counts up from. Null while still queued. |
status | DeploymentStatus | |
url | String | |
What deleting this destination takes with it: the schedules that point at it, the run history, and how many stored backup files it holds.
| Field | Type | Description |
|---|
artifacts | Int | |
runs | Int | |
schedules | Int | |
A completed connection test: the destination with its badge repainted, plus the verdict. Callers MUST read report.ok - a failed probe is a normal result, not a mutation error.
The instance-wide Docker cleanup schedule. One policy, not one per server: a host opts OUT via excludedServerIds, so a newly added server cannot silently go un-swept. Until it is saved once it reads as the defaults (ENABLED, daily at 04:00 UTC, every scope), so a fresh install sweeps its hosts without anyone finding this setting first; a saved row (including an explicit disable) always wins.
| Field | Type | Description |
|---|
enabled | Boolean | |
excludedServerIds | [String!] | Servers the SCHEDULED sweep skips. A manual runDockerCleanupNow ignores this list - the operator standing in front of the button has already made that decision. |
keepImagesPerApp | Int | unused_app_images only: how many of the newest images to keep for an app that CANNOT be rolled back - a compose stack, a prebuilt image, a pull request preview. An app Deplo builds is governed by its own App.rollbackKeep instead, which the sweep sends per app. |
minAgeHours | Int | Only reclaim objects older than this. 0 = no age filter. |
schedule | String | 5-field cron expression, evaluated in UTC. Rejected on save if it does not parse. |
scopes | [DockerCleanupScope!] | What the sweep reclaims. Empty = nothing, and the policy cannot be enabled. |
updatedAt | String | Null until the policy has been saved once. |
One executed sweep on one server. A run that could not even start (an unprovisioned host, an agent offline or too old) is still recorded, as failed: the history never lies about an attempt.
| Field | Type | Description |
|---|
actor | String | The user who ran it, or "Scheduler" for a scheduled sweep. |
error | String | |
finishedAt | String | |
id | ID | |
items | [DockerCleanupRunItem!] | The per-scope breakdown, in the scope allow-list's order. |
reclaimedBytes | Float | |
serverId | ID | Null once the server is removed - serverName is what keeps the row readable. |
serverName | String | |
startedAt | String | |
status | DockerCleanupRunStatus | |
trigger | DockerCleanupTrigger | |
One scope's outcome in an executed run. Counts only - the history keeps how much was reclaimed, not which objects.
| Field | Type | Description |
|---|
error | String | |
itemsRemoved | Int | |
reclaimedBytes | Float | |
scope | DockerCleanupScope | |
skipped | Boolean | |
A routable hostname attached to an app (Traefik router).
| Field | Type | Description |
|---|
appId | ID | |
appSlug | String | |
certProvider | CertProvider | How this domain's TLS certificate is issued. Set to cloudflare automatically when a DNS check finds the host proxied and it still had no certificate - Cloudflare already serves it over HTTPS. custom serves it over HTTPS from a certificate installed on the owning server (see addServerCertificate) and asks no ACME provider for one. Null on rows written before the field existed (they route as letsencrypt). |
createdAt | String | |
entrypoint | DomainEntrypoint | |
id | ID | |
importedFrom | String | The hostname this domain REPLACED on the platform the app was imported from, or null when it is the address the app always had. An import cannot keep the source's own throwaway host (it carries that server's IP) nor a name another team here already serves, so the route is re-hosted onto an address Deplo mints - this is what the app's Domains section reads to say which address became which. Cleared by dismissImportedDomains. |
middlewares | [String!] | |
name | String | |
pathPrefix | String | |
port | Int | |
primary | Boolean | |
proxied | Boolean | The owner's declaration that a proxy (a CDN, a reverse proxy, a load balancer) answers for this hostname. Its A records then name the proxy, never this server, so the DNS check can only ever settle misconfigured - this is what keeps the host routed anyway, and makes its URL https (the proxy terminates TLS). The declared twin of the cloudflare status, which is detected from Cloudflare's published ranges. |
redirectTo | String | Hostname this domain answers a permanent 301 to (the canonical half of its www / non-www pair), or null when it serves the app itself. |
service | String | |
serviceName | String | |
source | String | |
ssl | Boolean | |
status | DomainStatus | DNS verification state. Only valid is confirmed: cloudflare means the host is proxied and its origin cannot be checked from DNS, so it is routed but unverified. A misconfigured host is off the router unless proxied declares another proxy answers for it. See the DomainStatus enum. |
stripPrefix | Boolean | |
What a .env import wrote, and what it deliberately left alone.
| Field | Type | Description |
|---|
added | Int | Variables created or updated. |
skippedSecrets | Int | Lines whose key already exists as a secret. A secret cannot be edited, so those were left untouched. |
A per-Project, first-class isolated deploy target (Development/Preview/Production + custom). kind is its well-known role; slug and gitBranch drive the deploy pipeline (wired in a later phase).
| Field | Type | Description |
|---|
createdAt | String | |
gitBranch | String | |
id | ID | |
isDefault | Boolean | |
kind | String | |
name | String | |
position | Int | |
projectId | ID | |
slug | String | |
updatedAt | String | |
A single environment variable. Secret values are masked unless revealed.
Output of an exec'd console command.
| Field | Type | Description |
|---|
detach | Boolean | |
output | String | |
One server's headline reading for the Monitoring page's fleet list, plus a thinned CPU/memory trace.
| Field | Type | Description |
|---|
agentVersion | String | |
containers | Int | |
cpu | Float | |
diskPct | Float | |
expectedAgentVersion | String | |
memPct | Float | |
online | Boolean | Whether the buffer holds a reading at all. |
serverId | ID | |
source | String | |
spark | [FleetSpark!] | Oldest first, at most 30 points. |
ts | Float | Newest sample time, epoch ms. 0 means nothing has been measured - the row says so rather than drawing zeros. |
One thinned point of a fleet row's sparkline.
| Field | Type | Description |
|---|
cpu | Float | |
mem | Float | |
ts | Float | |
A team-wide grouping of apps on the Overview. Apps reference their folder via App.folderId; folders nest via parentId (a tree).
| Field | Type | Description |
|---|
appCount | Int | |
capabilities | [String!] | The current caller's effective capabilities on this folder (bounded by their team caps). |
color | String | |
createdAt | String | |
id | ID | |
isOwner | Boolean | Whether the caller owns this folder or is a folder super-user (manage_team / admin). |
name | String | |
ownerUserId | ID | |
parentId | ID | |
subfolderCount | Int | |
teamId | ID | |
updatedAt | String | |
A user's access to a folder: the owner (isOwner=true, implicit) or a grantee the owner has shared it with, plus their effective capabilities.
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | |
capabilities | [String!] | |
folderId | ID | |
isOwner | Boolean | |
name | String | |
userId | ID | |
username | String | |
A team member who could be granted access to a folder (used to populate the Share dialog's picker).
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | |
name | String | |
userId | ID | |
username | String | |
A team's stored credentials for one git host that is not GitHub. The token is never exposed.
| Field | Type | Description |
|---|
accountLogin | String | |
allowPrivateEndpoint | Boolean | The address points inside the deployment, which only an instance admin can allow. False for every ordinary connection. |
appCount | Int | Apps whose clone this connection authenticates. |
avatarUrl | String | |
baseUrl | String | |
createdAt | String | |
hasApi | Boolean | False for a plain git server: it can carry credentials but cannot list repositories or register a webhook. |
health | String | ok | failing. Re-derived by the maintenance sweep and by testGitConnection, so a revoked token surfaces before a deploy fails on it. |
healthError | String | The provider's own refusal when health is failing. |
id | ID | |
label | String | |
lastCheckedAt | String | |
provider | String | gitlab | bitbucket | gitea | git. |
tokenExpiresAt | String | |
username | String | |
A GitHub App connected to a team (no secrets exposed).
| Field | Type | Description |
|---|
appId | Int | |
createdAt | String | |
htmlUrl | String | |
id | ID | |
installations | [GithubInstallation!] | Installations of this App. |
name | String | |
slug | String | |
Inputs for the browser's self-submitting form that creates a GitHub App.
| Field | Type | Description |
|---|
actionUrl | String | |
manifest | String | |
state | String | |
An installation of a connected GitHub App on a user or org.
| Field | Type | Description |
|---|
accountLogin | String | |
accountType | String | |
appName | String | Name of the connected GitHub App this installation is of. |
avatarUrl | String | |
id | ID | |
installationId | Int | |
An open pull request on the app's repository.
| Field | Type | Description |
|---|
authorLogin | String | |
baseRef | String | |
draft | Boolean | |
fromFork | Boolean | |
headRef | String | |
htmlUrl | String | |
number | Int | |
title | String | |
updatedAt | String | |
A repository the installation can list and clone.
| Field | Type | Description |
|---|
defaultBranch | String | |
fullName | String | |
name | String | |
private | Boolean | |
updatedAt | String | |
url | String | |
A git host Deplo can connect to, other than GitHub (beta).
| Field | Type | Description |
|---|
defaultBaseUrl | String | |
defaultUsername | String | |
hasApi | Boolean | |
id | String | |
label | String | |
tokenHelpUrl | String | Where to create the token. Pass the connection's own baseUrl for a self-hosted host. Arguments: baseUrl: String. |
tokenScopes | String | The scopes to tick when creating the token, as one line. |
A repository a connection can list and clone.
| Field | Type | Description |
|---|
defaultBranch | String | |
fullName | String | |
name | String | |
private | Boolean | |
updatedAt | String | |
url | String | |
A registered user in the instance-wide Users list (no email exposed).
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | Resolved profile picture: uploaded image, else Gravatar, else null for the monogram. |
canExposePorts | Boolean | |
canMountHostVolumes | Boolean | |
createdAt | String | |
isInstanceAdmin | Boolean | |
isInstanceOwner | Boolean | Owns the instance. Their account is editable only by themselves. |
name | String | |
suspended | Boolean | |
teamCount | Int | |
userId | ID | |
username | String | |
What Deplo writes into the app's compose healthcheck:. Docker runs it inside the container and the agent reports the verdict, which is what the status dot follows. Null on an app that has none.
| Field | Type | Description |
|---|
command | String | |
intervalS | Int | |
path | String | |
port | Int | The port INSIDE the container. Null means the app's own port. |
retries | Int | |
startPeriodS | Int | |
timeoutS | Int | |
type | HealthCheckType | |
The answer to 'are these host ports free on that server?'.
| Field | Type | Description |
|---|
checked | Boolean | False when the server could not be asked at all, in which case inUse is empty and says nothing. |
inUse | [Int!] | The subset of the requested ports that is taken. |
reason | String | Why the check could not run. Null when it did. |
Settings that belong to this Deplo instance rather than to a team or a host: the address the panel answers on, and what version it runs.
| Field | Type | Description |
|---|
deploHostId | String | |
deploHostIp | String | The IPv4 an A record for the panel's domain should point at. |
deploHostName | String | |
gravatarEnabled | Boolean | Whether a person with no uploaded picture falls back to their Gravatar. The panel never dials gravatar.com itself - it only computes the address, and each viewer's browser fetches it. |
logMaxDays | Int | How far back the log viewer's time range may reach, in days. Instance-wide because the logs live on the host, which several teams share. It bounds what may be ASKED for and nothing else: docker rotates its json-file logs by size, so no setting here makes the host actually hold that much. |
panelFallbackUrl | String | The generated address the panel also answers on, over https (https://deplo-<hexip>.nip.io). Always on and not a setting: it is the way back in when the panel's domain, its DNS or its certificate stops working, and it resolves to this server with nothing to set up. Null only when Deplo cannot work out an address of its own that anyone else could reach. |
panelUrl | String | The address Deplo uses for itself right now. Every install command, deploy hook URL and invite link is built from it. |
panelUrlSource | String | stored (set here), environment (DEPLO_PUBLIC_URL, set at install time) or request (derived from the browser's own host, which is a guess). |
storedPanelUrl | String | |
version | String | |
| Field | Type | Description |
|---|
level | String | |
text | String | |
ts | String | |
Lighter container list for the logs viewer (no shell probe).
| Field | Type | Description |
|---|
instances | [ConsoleInstance!] | |
logMaxDays | Int | How far back the time range may reach, in days (instance setting). A bound on what may be asked for, not a promise the host still holds it: docker rotates its logs by size. |
running | Boolean | |
streamable | Boolean | A real container exists on the host, so its logs can be streamed - whether it is running, restarting or exited. Attach on this, not on running: a crash-looping container is the one whose logs you need. |
supportsTimeline | Boolean | The owning host's agent can narrow a log stream by time (logs.timerange). False on an older agent, which still streams but only honours tail - the viewer greys out the time-range control rather than offering a window the host would silently ignore. |
unreachable | Boolean | The owning server's agent could not be reached. |
The active team's MCP policy: whether AI agents may drive it at all. What an agent may DO is decided by its API token's capabilities and by its owner's manage_mcp in the team, and by nothing here.
| Field | Type | Description |
|---|
enabled | Boolean | |
A team as the MCP server names it: whether the team allows agents at all, and whether the caller may connect theirs.
| Field | Type | Description |
|---|
canConnect | Boolean | Whether the caller holds manage_mcp in this team. |
id | ID | |
mcpEnabled | Boolean | The team's own MCP switch. |
name | String | |
slug | String | |
A user's membership in the active team (no email exposed).
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | Resolved profile picture: uploaded image, else Gravatar, else null for the monogram. |
capabilities | [Capability!] | |
createdAt | String | |
isInstanceAdmin | Boolean | |
isPrimaryOwner | Boolean | |
membershipId | ID | |
name | String | |
role | Role | The member's RANK (only owner outranks). For what to show, read roleName. |
roleId | ID | The assigned team role, or null when the member holds a hand-picked capability set. |
roleName | String | The assigned role's name, or null for a custom set. |
userId | ID | |
username | String | |
| Field | Type | Description |
|---|
failed | Int | |
moved | Int | |
notes | [String!] | |
sourceGone | Boolean | The source machine stopped answering part way through - a connection that died, not a volume that could not be read. The caller MUST stop: every service still to come is on the same machine, each one gets stopped on the other platform before its copy is attempted, and carrying on turns one broken host into a whole organisation with no data and its services down on both sides. |
An already-imported service whose data can still be moved over from the panel.
| Field | Type | Description |
|---|
notes | [String!] | |
path | String | |
running | Boolean | Still up over there. Moving the data stops it, which is the point of a cutover. |
sourceId | String | |
sourceKind | String | |
sourceName | String | |
sourceReachable | Boolean | Whether the machine holding this data ANSWERS Deplo right now - a live Hello, not the stored status, which goes green on the agent's outbound call-home and says nothing about the direction a copy needs. False means the copy cannot start at all, and the caller must not begin it: one unreachable machine is one refusal, not one failure per service. |
sourceServerId | String | |
targetId | String | |
targetKind | String | |
targetName | String | |
targetServerId | String | |
volumes | [MigrationDataVolume!] | |
One source volume and the Deplo volume it would be copied into, paired by the path they are mounted at.
| Field | Type | Description |
|---|
mountPath | String | |
note | String | Set when the pairing rests on something weaker than an equal path - a database whose data directory moved between engine versions, for instance. |
sourceVolume | String | |
targetVolume | String | |
One person from the source team or organization: either added to the team (they already had a Deplo account) or handed a single-use registration link.
| Field | Type | Description |
|---|
email | String | |
link | String | The single-use registration link to send them, or null when they were added directly. |
message | String | |
name | String | |
outcome | MigrationOutcome | |
What an import would do, read from the source instance without writing anything.
| Field | Type | Description |
|---|
members | [MigrationPlanMember!] | |
orgAvatarUrl | String | That team's own picture on the panel, so the wizard draws it rather than a generic mark. Null when the panel keeps none - a Coolify team has no picture at all. |
orgName | String | The team or organization this token reads. A token belongs to one, so importing a second one means a second token. |
otherTeams | [String!] | The panel's other teams, by name - the ones this token does not cover and that need one of their own. Null when the panel cannot say, which on Coolify it never can. |
platform | MigrationPlatform | Which product answered at that address. |
projects | [MigrationPlanProject!] | |
servers | [MigrationPlanServer!] | |
sourceUrl | String | |
| Field | Type | Description |
|---|
exists | Boolean | An environment of that name is already in the matching project - the panel's production maps onto the one every Deplo project starts with. |
name | String | |
services | [MigrationPlanService!] | |
sourceId | String | |
Someone in the team or organization the token reads. Empty when the token belongs to a plain member, which cannot list it.
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | |
email | String | |
hasAccount | Boolean | |
inTeam | Boolean | |
name | String | |
sourceRole | String | The role they held over there. Shown, never applied: everyone arrives as a plain member and is promoted on purpose. |
One machine behind the source instance. The FIRST entry is always the host the source instance itself runs on, whose sourceId is the empty string - the same key the server mapping and the data cutover use for it.
| Field | Type | Description |
|---|
deploServerId | String | The Deplo server at that same address, or null when Deplo has no agent there. Data cannot be copied off a machine Deplo cannot reach: a volume is read by the agent ON its host, and agents cannot dial each other. |
deploServerName | String | |
deploServerOnline | Boolean | Whether that server's agent answers. A row a failed attempt left behind sits at the same address and is matched all the same, so this - not the id - is what says the machine is ready to be read. |
ipAddress | String | |
name | String | |
sourceId | String | |
One service on the panel (an application, a compose stack, or a database) as it would land here.
| Field | Type | Description |
|---|
buildsFromSource | Boolean | Whether Deplo would ever compile this. False for a compose stack, a prebuilt image and a database - all of them deploy as they are, so a build server would have nothing to do for them. |
domains | [String!] | The hostnames that would come across. The panel's generated throwaway hosts (traefik.me, sslip.io, nip.io) are already dropped - Deplo mints its own. |
engine | String | Deplo's own engine id for a database (mongo over there is mongodb here), so a client can show the engine's brand mark. Null for anything that is not a database Deplo has. |
exposedPort | Int | The host port this database publishes over there, so a review can say what will be published and offer another port when that one is taken here. Describes the SOURCE: it is reported whether or not the caller holds the publish-ports grant, and null only for something that is not a database or publishes nothing. |
kind | String | What it is over there: application, compose, or one of the panel's database engines. |
logo | String | The icon this service would arrive with, as an inline data-URI, or null when it has none. Already validated against what Deplo will store, so a client can render it as-is. |
name | String | |
notes | [String!] | What will not come across, or will need a look afterwards. |
sourceId | String | |
sourceServerId | String | The panel's server it runs on. Empty string means the panel's own host, which has no server row over there. |
status | MigrationPlanStatus | |
targetKind | String | app or database, or null when Deplo has no equivalent. |
| Field | Type | Description |
|---|
created | Int | |
failed | Int | |
items | [MigrationRunItem!] | |
manual | Int | |
projectName | String | |
skipped | Int | |
The panel service a blocked app or database was imported from. Its key is NOT here: a run wipes the token the moment it ends, so copying the data again asks for it once more.
| Field | Type | Description |
|---|
platform | String | |
runId | String | |
sourceId | String | |
sourceKind | String | |
sourceName | String | |
sourceUrl | String | |
What a revert took back out of Deplo, and what is still here because it could not be removed.
| Field | Type | Description |
|---|
apps | Int | |
databases | Int | |
environments | Int | |
failed | [String!] | One line per thing that is still here, and why - a host that would not confirm the volume is gone, or a capability the actor does not hold. |
projects | Int | |
sharedVars | Int | |
One import, kept after the tab that started it is gone. The API key is never stored.
| Field | Type | Description |
|---|
actor | String | |
created | Int | |
doneSteps | Int | |
error | String | |
failed | Int | |
finishedAt | String | |
heartbeatAt | String | When the control plane driving this run last said it was alive, or null while nothing has picked it up. A run is a row that says running whether or not anybody is driving it, so this is the only honest answer to "is it actually doing something": older than 90 seconds (or null) means no runner has it, and the next tick anywhere on the instance will take it over. |
id | String | |
items | [MigrationRunItem!] | The report. Only loaded by the single-run query. |
lastPath | String | The last thing this run touched, as Project / Environment / service. Filled in only by the live activeMigration feed - the history list leaves it null, because a finished run says where it got to with its whole report. It is the only record of a run's POSITION that survives the tab: the loop lives in the browser, and so does the plan that knew how many projects there were. |
manual | Int | |
orgName | String | |
phase | String | config | data | done. Which half the run is in - the two count different things, so their step numbers are not one scale. |
platform | MigrationPlatform | Which product this run read. Decided once, when it connected. |
skipped | Int | |
sourceUrl | String | |
startedAt | String | |
status | String | running | done | failed. A run left open by a closed tab is failed as Interrupted by the next one. |
stepLabel | String | |
stopRequested | Boolean | Somebody asked it to stop. The runner notices between steps - never mid-call, because a call already sent finishes on the far side whatever this row says. |
totalSteps | Int | |
| Field | Type | Description |
|---|
at | String | When this line happened. Null on rows written before the report became something you can watch. A report read afterwards is a list; read while it runs it is a log, and a log with no times is not one. |
message | String | |
outcome | MigrationOutcome | |
path | String | Where it was over there: Project / Environment / service. |
sourceKind | String | |
sourceName | String | |
targetId | String | |
targetKind | String | |
Which team of the panel one token reads. A token belongs to exactly one team on both products, so bringing several over takes one token each.
| Field | Type | Description |
|---|
otherTeams | [String!] | The panel's other teams, by name, so the ones no token covers yet can be named. Null means the panel cannot say - always the case on Coolify, whose team listing is filtered down to the token's own team. |
platform | MigrationPlatform | |
teamAvatarUrl | String | That team's own picture on the panel, so the wizard draws it rather than a generic mark. Null when the panel keeps none - a Coolify team has no picture at all. |
teamId | String | The team's own id over there, which is how two tokens of ONE team are told apart from two tokens of two teams. Null when the panel would not say. |
teamName | String | |
Instance-wide monitoring settings (a fleet-scoped singleton, like the Docker cleanup policy).
| Field | Type | Description |
|---|
saveMetrics | Boolean | |
updatedAt | String | |
What moving the panel to a given address would break, counted live and instance-wide. Every number is a fact about right now, so a dialog can name what is lost instead of warning in the abstract. Read-only: nothing here changes anything.
| Field | Type | Description |
|---|
currentUrl | String | |
deployHooks | Int | |
gitConnections | Int | Git connections whose webhook is registered against the address the INSTALLER was given, not this setting - so this change does not move them. |
githubApps | Int | |
hostChanges | Boolean | Whether the hostname moves. Everything a browser welds to an origin - passkeys, cookies, push subscriptions - dies on this. |
losesHttps | Boolean | https to http. Browsers that already loaded the panel over https keep refusing plain http on that hostname until the HSTS they remember expires. |
mcpConnections | Int | |
panelFallbackUrl | String | |
passkeyPeople | Int | |
passkeys | Int | |
pendingServers | Int | |
pushSubscriptions | Int | |
registrationLinks | Int | |
schemeChanges | Boolean | |
sessionPeople | Int | |
sessions | Int | |
url | String | |
What DNS says about the address the panel answers on.
| Field | Type | Description |
|---|
host | String | |
resolved | [String!] | |
status | String | |
How the Deplo panel itself is served, read live off the router that publishes it. unavailable says why it is not Deplo's to change here - the host is not added as a server, its proxy is not one Deplo installed, or the panel is still published by its own container.
| Field | Type | Description |
|---|
certificateTrusted | Boolean | Whether a browser accepts the certificate this address serves. False on the generated host, which no public certificate authority issues for, so the browser warns once. Null when it could not be read, which is not the same as untrusted. |
domain | String | The host the panel's route answers on, as the proxy has it. |
enabled | Boolean | Whether the panel is served over https. False means plain http on :80, and it is an advanced opt-out: the only case for it is a panel no certificate can be issued for, on a network Let's Encrypt cannot reach. |
fallbackDomain | String | The generated host the panel also answers on, or null when that IS the address above. |
provider | String | The certificate resolver it is ordered from, named as this host names it. Null when https is off, or when this host orders from nobody and serves a certificate you installed. |
unavailable | String | |
A WebAuthn credential on this account. Carries no key material: the public key and the credential id stay server-side.
| Field | Type | Description |
|---|
createdAt | String | |
id | String | |
kind | PasskeyKind | |
name | String | The label shown in the list, e.g. "Chrome on macOS". |
usableHere | Boolean | False for a credential minted for a different address of this panel: the browser will not offer it here, so the only thing to do with it is remove it. |
A preview-only variable override. Write-only, like every stored secret: the value is never projected and there is no reveal path.
| Field | Type | Description |
|---|
key | String | |
type | String | |
updatedAt | String | |
A top-level, team-scoped CONTAINER (ADR-0008): folder-like, but it owns Environments and holds folders/apps via their projectId. NOT the deployable app - that is an App. A Project never nests in a Project.
| Field | Type | Description |
|---|
appCount | Int | |
color | String | |
createdAt | String | |
environmentCount | Int | |
environments | [Environment!] | |
folderCount | Int | |
id | ID | |
name | String | |
ownerUserId | ID | |
slug | String | |
teamId | ID | |
updatedAt | String | |
A host port an app publishes, for what the proxy cannot route - a game server, an SMTP relay, a database the app exposes.
| Field | Type | Description |
|---|
id | ID | |
protocol | String | |
published | Int | The port on the host. |
target | Int | The port inside the container. |
What Deplo read in a repository before an app exists for it: the JavaScript framework backing it, and the build/start commands the repository declares for ITSELF in its package.json. A command is never invented from the framework - null means the repo said nothing and the builder decides.
| Field | Type | Description |
|---|
buildCommand | String | The repository's own build script, spelled for its lockfile's package manager (e.g. "pnpm run build"). |
defaultPort | Int | The port this framework's production server binds when nothing tells it otherwise - what a new app's container port defaults to. |
id | String | Stable framework id, e.g. "nextjs" - also the key for its brand mark. Null for a repo with no framework Deplo knows. |
name | String | Display name, e.g. "Next.js". |
startCommand | String | The repository's own start script (falling back to serve), spelled the same way. |
The private key that decrypts a destination's artifacts. Save it somewhere outside Deplo: it is the only way to read those backups if this instance is lost. Fetching it is recorded in Activity.
| Field | Type | Description |
|---|
identity | String | |
name | String | |
recipient | String | |
where | String | Where the artifacts this key opens are stored, in one line. It goes into the key file, because whoever reads that file has lost the instance that knew the bucket or the folder. |
A single-use link to register a new account.
| Field | Type | Description |
|---|
canReveal | Boolean | The link can still be read back with revealRegistrationLink - pending, unexpired, and minted after the token started being stored encrypted. |
createdAt | String | |
createdBy | String | |
expiresAt | String | |
id | ID | |
linkMasked | String | The link with its token blanked, for display while it is covered. Never carries the token. |
mode | RegistrationMode | |
status | RegistrationLinkStatus | |
teamNames | [String!] | |
usedByUsername | String | |
A container-image registry credential owned by a team. The password / access token is never exposed - only the connection metadata.
| Field | Type | Description |
|---|
createdAt | String | |
id | ID | |
name | String | |
registryUrl | String | |
type | RegistryType | |
username | String | |
Per-container resource caps applied to a workload (an App's containers at deploy time, a Database's container at provision/redeploy time). A null field means that dimension is uncapped. Memory is in MiB, disk in GiB, CPU in milli-CPUs (1000 = one core).
| Field | Type | Description |
|---|
cpuMilli | Int | |
cpuShares | Int | |
cpuset | String | |
memoryMb | Int | |
memoryReservationMb | Int | |
nofile | Int | |
nproc | Int | |
oomScoreAdj | Int | |
pidsLimit | Int | |
shmSizeMb | Int | |
storageGb | Int | |
swapMb | Int | |
One workload that could not be restarted, and why.
| Field | Type | Description |
|---|
error | String | The failure, verbatim from the host. |
kind | String | "app" or "database". |
name | String | |
The projects, folders and apps a role reaches. A folder brings its whole subtree. All three empty means it reaches nothing, which is what a scope whose nodes were all deleted becomes.
| Field | Type | Description |
|---|
appIds | [String!] | |
environmentIds | [String!] | |
folderIds | [String!] | |
projectIds | [String!] | |
One container of an app, as the host actually has it now.
| Field | Type | Description |
|---|
exposed | Boolean | |
health | String | "healthy" | "unhealthy" | "starting", or "" when the image declares no healthcheck, which is not a synonym for healthy. |
name | String | |
restartCount | Int | Times docker has restarted this container. |
running | Boolean | |
service | String | |
startedAtUnix | Int | When it last started, epoch seconds. 0 when it has never started, or when the owning agent predates the field - both mean there is no uptime to show, never 1970. |
state | String | Raw docker state ("running" | "restarting" | "exited" | ...), or "" when the owning agent is too old to report it. |
A line of the connection-test log, with the level to render it at.
| Field | Type | Description |
|---|
level | String | |
text | String | |
The result of testing a destination: the verdict, the probe sequence, the agent's verbatim output, and the commands that reproduce the same three S3 calls by hand. never => it has not been tested yet.
| Field | Type | Description |
|---|
command | String | |
durationMs | Int | |
error | String | |
lines | [S3TestLogLine!] | |
never | Boolean | |
ok | Boolean | |
serverName | String | |
startedAt | String | |
steps | [S3TestStep!] | |
One step of the fixed probe sequence the agent performs (pick a server, open the endpoint, head the bucket, write a probe file, remove it).
An app a search matched. Deliberately small: enough to recognise it and to read it in full with app(slug:) afterwards.
| Field | Type | Description |
|---|
id | ID | |
logo | String | |
name | String | |
productionUrl | String | |
slug | String | |
status | AppStatus | |
team | SearchTeam | |
A cron job a search matched, with the app or database it runs on.
| Field | Type | Description |
|---|
enabled | Boolean | |
id | ID | |
name | String | |
schedule | String | |
targetKind | String | |
targetName | String | |
targetRef | String | The app's SLUG or the database's ID - the deep link, either way. |
team | SearchTeam | |
A database a search matched.
A domain a search matched, with the app that serves it.
An environment a search matched, with the project it is in.
| Field | Type | Description |
|---|
id | ID | |
kind | String | |
name | String | |
projectId | ID | |
projectName | String | |
slug | String | |
team | SearchTeam | |
A folder a search matched. Folders have no slug: open one by id.
| Field | Type | Description |
|---|
appCount | Int | |
id | ID | |
name | String | |
team | SearchTeam | |
A team member a search matched. Name and username only - a search must never turn a name into an email address.
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | |
name | String | |
roleName | String | |
team | SearchTeam | |
userId | ID | |
username | String | |
A project a search matched.
| Field | Type | Description |
|---|
appCount | Int | |
id | ID | |
name | String | |
slug | String | |
team | SearchTeam | |
What a search found, grouped by kind. At most 50 of each.
A team role a search matched, by name or description.
| Field | Type | Description |
|---|
description | String | |
id | ID | |
memberCount | Int | |
name | String | |
team | SearchTeam | |
A server a search matched. Servers are the one resource shared across teams, so a hit names none.
| Field | Type | Description |
|---|
host | String | |
id | ID | |
name | String | |
status | ServerStatus | |
The team a search hit was found in.
| Field | Type | Description |
|---|
avatarUrl | String | |
id | ID | |
name | String | |
slug | String | |
A catalogue template a search matched. Public, so it names no team.
| Field | Type | Description |
|---|
logo | String | |
name | String | |
slug | String | |
A connected host running deployments (reached via its agent).
| Field | Type | Description |
|---|
agentPort | Int | |
agentVersion | String | The agent binary version last reported by this server on its last Hello. Null until the server's agent has called home and been provisioned. |
allTeams | Boolean | True (the default) when every team may target this server. False restricts it to teams (Settings -> Servers -> Team access). |
buildFallback | Boolean | Whether this host compiles for an app whose own build server could not be reached. On by default for the Deplo host and off for every other server, until setServerBuildFallback says otherwise. An app opts out of the whole chain with setAppBuildServer's buildFallback. |
cpuCores | Int | |
createdAt | String | |
deployConcurrency | Int | How many deployments this server runs at once (default 1 = strict per-server serialization). Deploys on other servers run in parallel; a same-app deploy never overlaps regardless. Editable via setServerDeployConcurrency (instance-admin). With a build server, the lane belongs to the BUILDER - that is where a deploy's cost is. |
diskGb | Int | |
dockerVersion | String | |
expectedAgentVersion | String | The agent version this server should be running - the latest GitHub release of the agent (DeploCloud/deplo-agent). Resolved at request time and cached; falls back to a built-in version when GitHub is unreachable. |
host | String | |
hostArch | String | This host's CPU architecture ("amd64" | "arm64"), observed from the agent. Empty when the agent is too old to report it. A build server can only build for a host of the SAME architecture. |
id | ID | |
ip | String | |
isDeploHost | Boolean | Whether this is the host running Deplo itself (the dashboard and API), as opposed to a remote that only runs the deploy agent. It cannot be removed, and it is the only server that can restart the Deplo panel. |
lastSeenAt | String | Heartbeat cache (P5) - a hint, not the source of truth. |
memoryMb | Int | |
name | String | |
provisioned | Boolean | True once the server's agent has called home and been trusted. |
role | String | What this server is for: "everything" (the default), "build" (Docker but no proxy; it compiles for other hosts and runs nothing), "storage" (no Docker; it only holds backups) or "import" (a MIGRATION SOURCE: another platform's host, registered by the import wizard to read its volumes, out of every deploy and build picker and swept by nothing). Only the build axis is changeable after installation; "import" is refused by setServerRole in both directions. |
status | ServerStatus | |
statusCheckedAt | String | When status was last OBSERVED by a live agent Hello probe (ISO), or null if it never has been. Read it WITH status: the pair is a timestamped observation, not a standing claim, and a client that shows the status without qualifying its age is showing a value that may be hours old. Never fabricated - a probe that times out or is throttled writes nothing. |
statusMessage | String | Why status is not online - e.g. "The agent is up but Docker is unreachable". Null when online or never probed. Requires instanceAdmin. |
teams | [Team!] | Teams explicitly granted access when allTeams is false (empty otherwise - every team has access). Requires manage_infra. |
traefikEnabled | Boolean | |
type | ServerType | |
uninstallError | String | Why Deplo could not take its agent off this migration source, after it stopped trying (three attempts over several minutes). Empty otherwise. This is the only state that needs a person: surface it verbatim next to the host-side uninstall command. |
uninstallPending | Boolean | Deplo is still trying to take its agent off this migration source, and will try again on its own. Nothing is asked of anyone while this is true. False for every other server. |
A TLS certificate the operator installed on a server themselves, described from the certificate itself. It lives in that host's proxy and nowhere else (Deplo stores no copy), and its private key has no read path at all.
| Field | Type | Description |
|---|
domains | [String!] | Every hostname this certificate is valid for. Traefik picks a certificate by the domain the browser asked for, so these are the domains it will serve on this host. |
expired | Boolean | Whether it is already past its expiry. A certificate can lapse in place long after it was installed, so this is computed, not stored. |
expiresInDays | Int | Whole days left before it expires, negative once it has. Nothing renews these, so the only warning is this number. |
id | String | The certificate's SHA-256 fingerprint, which is also how it is addressed for removal. Nothing is minted: a certificate identifies itself. |
issuer | String | Who signed it. |
notAfter | String | Expires at (ISO-8601). |
notBefore | String | Valid from (ISO-8601). |
subject | String | Its common name, or its first domain when it carries none. |
What a server IS (its hardware, OS and clock) read live from its agent and stored nowhere. Distinct from the usage gauges on Monitoring: this is the make and model, not the load.
| Field | Type | Description |
|---|
arch | String | Machine architecture, e.g. "x86_64". |
canRestartControlPlane | Boolean | Whether the Deplo panel runs in a container on this host that the agent could restart. False when Deplo was started some other way, in which case the restart action is not offered. |
controlPlaneTimeUnixMs | Float | Deplo's own clock when this reading landed (epoch ms). The pair with timeUnixMs is the honest drift measurement: measuring against the browser measures the browser, and a viewer whose laptop is an hour out would see the whole fleet reported as drifting. |
cpuCores | Int | PHYSICAL cores. A 6-core/12-thread chip reports 6 here and 12 in cpuThreads; reporting threads as cores is the usual way a spec sheet overstates a box. |
cpuModel | String | The processor as it names itself, e.g. "AMD Ryzen 5 5600X 6-Core Processor". Empty when the host does not report one. |
cpuThreads | Int | Logical processors - what schedulers and nproc count. |
diskTotalBytes | Float | Size of the filesystem the agent's data lives on, in bytes. |
diskUsedBytes | Float | Used bytes on that filesystem. |
dockerRootDir | String | Where Docker actually keeps images and volumes - on a host with a mounted data disk this is not the root filesystem. |
dockerVersion | String | Docker engine version, empty when the daemon is unreachable. |
kernel | String | Kernel release (uname -r). |
memTotalBytes | Float | Installed RAM, in bytes. |
osPretty | String | The distribution, e.g. "Ubuntu 24.04.1 LTS". |
timeUnixMs | Float | The host's own clock at the moment of the read (epoch ms). Compare it with controlPlaneTimeUnixMs, never with the viewer's clock, to spot a drifting box. |
timezone | String | The host clock's IANA zone, e.g. "Europe/Rome". Empty if it reports none. |
uptimeSec | Float | Seconds since the host booted. |
utcOffsetMinutes | Int | Offset from UTC in MINUTES, not hours - Kathmandu is +345 and Kolkata +330. |
A live resource-usage snapshot for one server (CPU, memory, disk, network, load and running-container count).
| Field | Type | Description |
|---|
agentVersion | String | |
containers | Int | |
cpu | Float | |
cpuCores | Int | |
diskPct | Float | |
diskTotal | Float | |
diskUsed | Float | |
expectedAgentVersion | String | |
load | [Float!] | Load averages over [1m, 5m, 15m]. |
memCache | Float | Buffers + Cached + SReclaimable. |
memFree | Float | MemFree. memUsed is total-available (what free calls used), so this and memCache are what let the tile show the reclaimable half. |
memPct | Float | |
memTotal | Float | |
memUsed | Float | |
netRx | Float | |
netTx | Float | |
online | Boolean | |
serverId | ID | |
source | String | Which sampler produced this frame: "cgroup2" | "docker-stats". Empty when the reading did not come from the telemetry stream. |
traefik | Boolean | |
ts | Float | |
uptimeSec | Int | |
One row of a server readiness report: a single thing Deplo could verify about the host, and what it found.
| Field | Type | Description |
|---|
detail | String | What we found. Drawn from a closed, curated set whenever it describes a failure, never a raw agent error (which would leak the pinned certificate fingerprint and the dial address). |
group | ServerReadinessGroup | |
hint | String | What to do about it. Null on a pass row. |
id | String | Stable row id, e.g. "docker.available" or "build.nixpacks". |
label | String | |
severity | ServerReadinessSeverity | |
A live, never-persisted answer to 'is this host set up to run deployments?'. Assembled from one agent Hello, two host port bind-tests and one host-metrics call, plus the control plane's own record of the server. It is NOT a sixth ServerStatus and nothing gates on it - the deploy gate is and stays the mandatory live Hello pre-flight.
The result of removing a server. Removal revokes the agent's trust and forgets the row - it does NOT uninstall anything on the host, so the uninstall command is always returned.
| Field | Type | Description |
|---|
uninstallCommand | String | Paste-on-the-server command that removes the agent, Traefik and the Deplo network from the host. Deplo cannot do this remotely: revoking trust is precisely what ends its right to command that agent. |
warning | String | A non-blocking hazard the operator must know about (e.g. an App was mid-move off this host, so its data volumes are now stranded there), or null. |
The outcome of restarting everything Deplo runs on a server. Partial success is normal and is reported as such - one wedged stack must not hide that the other twenty came back.
| Field | Type | Description |
|---|
failures | [RestartedWorkload!] | |
restarted | Int | |
skipped | Int | Workloads left alone: the ones already stopped (starting them is a different action than restarting them) and the ones with a deploy in flight, which come back on their own. |
The result of uninstalling the agent from a MIGRATION SOURCE. Unlike ServerRemoval this one DOES touch the host - it is the only case where Deplo installed the agent on a machine that is not part of the fleet, so taking it back off is Deplo's job and not the operator's.
| Field | Type | Description |
|---|
error | String | Why the uninstall did not happen, or null. Surface it verbatim. |
removed | Boolean | True when the host is clean AND the server row is gone. False leaves both in place - the agent is still installed there, and pretending otherwise would strand a running agent nobody can see. |
uninstallCommand | String | The host-side command, returned in both cases: on success so the operator can verify, on failure because it is then the only way through. |
warning | String | A non-blocking hazard, same meaning as on ServerRemoval, or null. |
A shared environment variable (ADR-0010/0012/0027). Secret values are masked. Team / environment / project scopes say who it is AVAILABLE to, and it injects only through explicit per-app links (opt-in) - UNLESS autoInject, which is what reaching more than one team means.
| Field | Type | Description |
|---|
appIds | [ID!] | |
apps | [SharedVarApp!] | |
autoInject | Boolean | Injects into every app of every team it reaches, with no per-app link, at the LOWEST precedence. True when it reaches more than one team. |
createdAt | String | |
createdBy | VarAuthor | |
editable | Boolean | The viewer's team owns it. A variable shared IN from another team is read-only here, and its project/environment/app ids come back empty. |
environmentIds | [ID!] | |
environments | [SharedVarEnvironment!] | |
id | ID | |
key | String | |
masked | Boolean | |
ownerTeam | SharedVarTeam | The owning team; null when the instance owns it. |
projectIds | [ID!] | |
projects | [SharedVarProject!] | |
targets | [EnvTarget!] | Deploy runtimes this variable applies to. |
teamIds | [ID!] | |
teamWide | Boolean | It reaches the VIEWER's team. |
teams | [SharedVarTeam!] | |
type | EnvVarType | |
updatedAt | String | |
updatedBy | VarAuthor | |
value | String | |
| Field | Type | Description |
|---|
id | ID | |
name | String | |
slug | String | |
| Field | Type | Description |
|---|
id | ID | |
name | String | |
projectName | String | |
| Field | Type | Description |
|---|
id | ID | |
name | String | |
slug | String | |
| Field | Type | Description |
|---|
id | ID | |
name | String | |
The takeover this instance is in the middle of. Null on an ordinary install.
| Field | Type | Description |
|---|
dataLoss | [String!] | Services of every finished run that arrived without their data. The cutover stops the old panel for good (its volumes stay on the disk, unread), so requestTakeover refuses unless acceptDataLoss says so. |
error | String | Why the last cutover rolled back, in the installer's words. Null unless the state is failed. |
platform | TakeoverPlatform | |
runId | String | |
seenExternalRequest | Boolean | Whether anything but the installer has ever reached this panel. False means its port is probably closed, not that nobody has looked. |
state | TakeoverState | |
| Field | Type | Description |
|---|
left | [String!] | The ones that would not start, with the reason. |
restarted | Int | How many services were started again on the platform being kept. |
What a takeover of this machine is walking into. Both halves are things that otherwise only show up mid-copy.
| Field | Type | Description |
|---|
agentMessage | String | |
agentReady | Boolean | Whether the agent on this machine answers a live probe. Without it no volume can be read at all. |
diskFreeBytes | Float | |
diskTight | Boolean | The copy writes a second copy of every volume it moves, and this machine has little room for one. A warning with the real numbers, never a refusal. |
diskTotalBytes | Float | |
A team that owns apps, infra and members.
| Field | Type | Description |
|---|
avatarUrl | String | The team's picture, or null for its two-letter monogram. A team has no email, so there is no Gravatar step. |
createdAt | String | |
id | ID | |
name | String | |
plan | TeamPlan | |
requireTwoFactor | Boolean | Whether every member of this team must have two-factor authentication. |
slug | String | |
A team the viewer belongs to, carrying their role and the team size.
| Field | Type | Description |
|---|
avatarUrl | String | |
createdAt | String | |
id | ID | |
memberCount | Int | |
name | String | |
plan | TeamPlan | |
role | String | |
slug | String | |
A named capability set members of the active team can be assigned. Three defaults (owner/member/viewer) plus any number the team authors itself.
| Field | Type | Description |
|---|
builtinKey | Role | Set for one of the three default roles; null for a role the team created. |
capabilities | [Capability!] | Exactly what a member holding this role can do. view is always included. |
createdAt | String | |
description | String | |
id | ID | |
locked | Boolean | The Owner default: always full access, not editable, so a team can never edit its way out of administering itself. |
memberCount | Int | |
modified | Boolean | A default role edited away from what Deplo ships - it can be reset. |
name | String | |
requireTwoFactor | Boolean | Holders of this role must have two-factor authentication; without it they resolve no capabilities at all, over the UI and the API alike. |
scope | RoleScope | Where in the team this role reaches. Null means the whole of it, which is every role until one is limited. A scoped role also loses every capability that only means something team-wide. |
A compact, deployable variant from the public template catalog.
| Field | Type | Description |
|---|
category | String | |
docsUrl | String | |
name | String | |
shortDescription | String | |
templateSlug | String | |
variantName | String | |
variantSlug | String | |
A pending enrolment: the secret to scan and the codes to save. Two-factor is not on until confirmTwoFactorEnrolment succeeds.
| Field | Type | Description |
|---|
recoveryCodes | [String!] | Single-use codes, shown this once and never again. |
totpUri | String | The otpauth:// URI an authenticator app scans. |
Result of checking the upstream GitHub repository for a newer Deplo release.
| Field | Type | Description |
|---|
checkedAt | String | |
current | String | |
error | String | |
latest | String | |
name | String | |
publishedAt | String | |
updateAvailable | Boolean | |
url | String | |
Full per-user detail for the admin editor - the email IS included here.
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | Resolved profile picture: uploaded image, else Gravatar, else null for the monogram. |
canExposePorts | Boolean | |
canMountHostVolumes | Boolean | |
createdAt | String | |
email | String | |
isInstanceAdmin | Boolean | |
isInstanceOwner | Boolean | Owns the instance. Their account is editable only by themselves. |
name | String | |
passkeyCount | Int | How many passkeys they hold. Only above zero is resetUserPasskeys offered. |
suspended | Boolean | |
teams | [UserDetailTeam!] | |
twoFactorEnabled | Boolean | Has an authenticator app enrolled. Only then is resetUserTwoFactor offered. |
userId | ID | |
username | String | |
| Field | Type | Description |
|---|
role | Role | |
teamAvatarUrl | String | |
teamId | ID | |
teamName | String | |
A registered user matched by username/display name when adding members.
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | Resolved profile picture: uploaded image, else Gravatar, else null for the monogram. |
name | String | |
teamAvatarUrl | String | |
teamName | String | |
userId | ID | |
username | String | |
A browser or client currently signed in to the viewer's account. Carries no credential - a session is addressed by its id, never by its token.
| Field | Type | Description |
|---|
browser | String | The client half of label, e.g. "Chrome". Null when the user agent matched nothing. |
createdAt | String | |
current | Boolean | This is the session making the request. It cannot be revoked from here; sign out instead. |
device | DeviceKind | |
expiresAt | String | |
id | ID | |
ipAddress | String | |
label | String | Human description, e.g. "Chrome on macOS". |
lastSeenAt | String | When the session was last refreshed, which stands in for last used. Accurate to about 15 minutes. |
os | String | The platform half of label, e.g. "macOS" or "iPhone". |
What one person can do in one team, as an instance admin sets it.
| Field | Type | Description |
|---|
baseCapabilities | [Capability!] | The set on the membership - their own when they hold one, else their role's. |
customCapabilities | Boolean | That set is theirs, so saving their role no longer rewrites it. |
granular | Boolean | Their reach IS the nodes below: they touch those and nothing else, whatever their role reaches. Stored as the admin's choice, so deleting the last granted node doesn't silently turn it off. |
isFounder | Boolean | The team's primary owner. Their access can't be changed by anyone, instance admins included. |
nodes | [AccessNodeGrant!] | |
rank | String | owner outranks everyone; anything else ranks as a member. |
roleId | ID | |
roleName | String | |
teamId | ID | |
teamName | String | |
The user who created or last modified a variable. Identity only, never an email.
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | Resolved profile picture: uploaded image, else Gravatar, else null for the monogram. Derived server-side, so the address itself never travels. |
id | ID | |
name | String | |
username | String | |
The authenticated principal for the current request.
| Field | Type | Description |
|---|
avatarColor | String | |
avatarUrl | String | Resolved profile picture: uploaded image, else Gravatar, else null for the monogram. |
email | String | |
id | ID | |
isInstanceAdmin | Boolean | |
name | String | |
role | String | |
twoFactorEnabled | Boolean | Whether this account has a verified second factor. Says only that one exists, never anything about it. |
username | String | |
A persistent volume mounted into an app - a docker named volume, an app-files bind, or a host bind mount.
| Field | Type | Description |
|---|
hostPath | String | |
id | ID | |
mountPath | String | |
name | String | |
projectPath | String | |
propagation | MountPropagation | |
readOnly | Boolean | |
service | String | |
type | String | |
