Schemas

RepoRefs

RepoTreeEntry

RepoTree

RepoBlob

RepoCommit

RepoName

It becomes a URL path segment, so it cannot contain .. or a slash. The authoritative rule is the CHECK in migration 0032 (if validation lives only in the application, maintenance scripts bypass it), and what is here is a copy of it. It cannot begin with a dot. It is wider than a project name (a hostname label) — uppercase letters, dots and underscores are allowed.

Type: string

RepoVisibility

Defaulting to private is deliberate — if the default were open, the direction of a mistake would be a leak. public opens anonymous clone (§5.1).

Type: string

TokenScope

A token inherits the user's permissions but can only lower them (§5.2). There is no arithmetic in the upward direction.

Type: string

Repo

RefUpdate

SSHKey

AccessToken

AccessTokenCreated

Slug

It becomes one label of a hostname, so it follows the DNS rules. The project name goes into <name>.lvh.me verbatim, so without this check you could create a project that can never be reached.

Type: string

Error

Session

User

Org

OrgMembership

Type: Org & object

Notification

Project

ProjectDetail

Type: Project & object

Placement

ProjectOverview

The project home screen (getProjectOverview).

OverviewDeployment

A deploy row in the overview. It has the same shape as Deployment (including actor).

Type: Deployment

OverviewDatabase

OverviewFeatures

Whether the resources turned on by declaration have been granted (docs/provisioning.md). The "next step" on the home screen uses this to pick what has not been turned on.

Deployment

DatabaseEndpoint

DatabaseTokenMeta

DatabaseToken

ConnectInfo

DatabaseConnect

DatabaseExport

DatabaseGenerations

GenerationRow

One backup generation. The field names are the same as GenerationRow in internal/backupproto. The actor metadata, the generation the node reports to the CP and the record carried by this API must use the same names, so that editing one of them does not make another silently read 0.

RestoreRequest

DeleteRequest

OperationStarted

The answer means the multi-step operation was queued (202). It does not mean it finished — follow the progress at …/database/operations/{opId}.

Operation

Manifest

The runlot.json inside the bundle. It never travels as an HTTP body, but it is part of the contract, so it is documented here — the CLI writes it, cp-public reads it, and the config generator consumes it.

ManifestTriggers

Scheduled execution. Carried into the bundle exactly as written in runlot.json. It has the same shape as wrangler’s triggers because people migrating copy those three lines verbatim.

Cron is the only trigger we know today, but this is an object so that adding queues or email later does not change what users write.

ManifestModule

Role

The roles are nested — whatever a viewer can do a member can do too, and whatever a member can do an admin can do too (cp/internal/public/public.go roleRank).

Type: string

Member

InviteState

expired 는 시각 비교의 결과이지 열이 아니다 — 초대는 만료되었다고 표시되지 않고, 만료 시각이 지났을 뿐이다.

Type: string

Invite

토큰이 없다. 평문 토큰은 메일에만 실리고, cp-public 은 그 열을 읽지도 못한다 (마이그레이션 0043 의 열 단위 GRANT).

InviteView

토큰을 든 사람에게 보이는 초대 (인증 없이 답한다).

SecretName

Becomes env.<NAME> in the worker. DB·ASSETS (the uppercase counterparts of the env.db·env.assets bindings) and the RUNLOT_ prefix are reserved — the first two are already bindings, and the last is the namespace the node writes into the process environment (docs/phase6.md B4).

Type: string

SecretMeta

SecretList

LogEvent

One line of the log stream. type tells them apart — line is one line of output, ping is the 15-second heartbeat, and end is why the server ended the stream.

Usage

UsageRow

EmailStatus

The project's email state (docs/email.md §5).

MailLogEntry

One row of the mail log (docs/email.md §6.1).

MailLogPage

BillingStatus

PlanLimits

요금제 하나의 한도 (docs/limits.md §1)

StorageStatus

The state of the project's dedicated object storage (docs/storage.md §7).

Objects are not part of DB generations — runlot pg restore does not roll files back (§4.6). Read-after-write is guaranteed, but list can lag.

AccessPolicy

The deployment access policy (docs/access.md §3.1). It exposes state only, never secret values. The password and the bypass key are stored as hashes only, and the read API does not return the values (docs/access.md §6, the rule for secret surfaces).

A project that has never set a policy has mode: public and no updatedAt. The two are kept apart because the UI states "this deployment is public" as a status sentence (§7).

AccessBypass

The bypass key for automation. Included in this response only. It cannot be viewed again, and reissuing invalidates the previous key immediately (docs/access.md §3.6).

AccessAuthorize

The URL that leads back to the protected deployment. A one-time code (60 seconds, single use, scoped to that project) is carried in the query; the front exchanges it, sets the cookie, and then 302s back to the original URL without the query. That 302 is what removes the code from the address bar (docs/access.md §3.4).

AuthProvider

The social login providers for which a per-project OAuth app can be registered. The providers supported today are GitHub, Google and Kakao; more will be added as demand appears (docs/auth.md §12 — SAML and OIDC when enterprise customers arrive).

Type: string

AuthSettings

End-user auth settings (docs/auth.md §9). The email template editor, MFA and the device list are explicitly out of scope in §12.

AuthBrand

Branding for the hosted login page (docs/auth.md §4). If you need finer branding, build your own page and call the JSON endpoints in §5. When every value is an empty string, the project name and the default design tokens are used.

AuthProviderMeta

One registered login provider. The secret is not included. The client ID is a public value that is exposed to the browser anyway, while the client secret is encrypted and appears in no response (the rule for secret surfaces, docs/access.md §6).

AuthStatus

The end-user auth state of the project (docs/auth.md §9).

The user table is not part of this API. User data is stored in the runlot_auth schema of the project's Postgres (§6), and that table is handled together with project deletion, pg export, generation backups and restores. If the CP served this table, the data lifecycle would be split in two.

AuthSettingsPatch

A partial update of the settings. Only the fields you send change. Sending the whole settings object for every single switch would let a later save overwrite an earlier one when two users edit the same settings.

AuthProviderPut

The credentials of a login provider. Replacement goes through the same PUT, so both values are required. If you sent only the ID and omitted the secret, the response could not tell you whether the previous secret survived.

Hostname

One hostname connected to the project. state moves pending_dns (verifying ownership) → pending_tls (issuing the certificate) → active (connected), and the failure state is error. Only active records are in the routing table.

HostnameVerify

The two records the customer has to add to their own DNS. Either one of them is enough to prove ownership — the CNAME also completes the connection, so that is the default guidance. The values are computed and returned by the CP (the fallback origin is a placement setting, so if clients wrote it down themselves they would diverge the day it changes).

HostnameRecord

HostnameList

Zone

One zone in our authoritative DNS (docs/domains.md §4.3). serial is the revision — it goes up on every change, and once publishedSerial catches up, the nameservers are serving that content.

ZoneDetail

One zone and all of its records.

Type: Zone & object

RRset

The set of values for one (name, type) pair. If managedBy is present the row was created by another layer and is locked in the editor — system (the zone's NS), hostname:<host> (app binding), acme (certificate).

ZoneList

DomainAvailability

Availability and price for one name. There is no wholesale price — cost is a fact of our operations, not a fact for the customer (cp-core does return it for operators).

DomainContact

Registrant contact. It belongs to the customer — the ICANN verification mail goes to this address, and if it is not confirmed within 15 days the domain is suspended. The screen must say so before registration (docs/domains.md §5.5).

Domain

One domain. Expiry, lock and nameservers are a copy of the registrar's authoritative record, reconciled by domain-sync (6 h) (docs/domains.md §5.4).

DomainEvent

One ledger line (append-only). kind is one of purchase·register_attempt· register·register_reconciled·zone·ds·done·renew·lock· unlock·auto_renew·auth_code·state·transfer_out·import· error and so on. Transfer codes and secrets are never stored here.

DomainDetail

Type: Domain & object

DomainList