Schema

RepoRefs

RepoTreeEntry

RepoTree

RepoBlob

RepoCommit

RepoName

Since this becomes a URL path segment, it cannot contain .. or a slash. The source of truth is the CHECK constraint in migration 0032 (keeping validation only in the application would let admin scripts bypass it); what is here is a copy of that. It cannot start with a dot. It is broader than the project name (a hostname label) — uppercase letters, dots, and underscores are allowed.

Type: string

RepoVisibility

Defaulting to private is intentional — if the default were open, the direction of a mistake would be a leak. public means anonymous clone is open (§5.1).

Type: string

TokenScope

A token inherits the user's permissions but can only lower them (§5.2). There is no arithmetic in the raising direction.

Type: string

Repo

RefUpdate

SSHKey

AccessToken

AccessTokenCreated

Slug

Becomes a single label of the hostname, so it follows DNS rules. Since the project name goes directly into <name>.lvh.me, not enforcing this here would let you create a project that exists but is unreachable.

Type: string

Error

Session

User

Org

OrgMembership

Type: Org & object

Notification

Project

ProjectDetail

Type: Project & object

Placement

ProjectOverview

Project home page (getProjectOverview).

OverviewDeployment

A deployment row from the overview. Has the same shape as Deployment (includes actor).

Type: Deployment

OverviewDatabase

OverviewFeatures

Whether a resource enabled by declaration has been granted (docs/provisioning.md). The onboarding "next steps" screen picks the ones not yet enabled this way.

Deployment

DatabaseEndpoint

DatabaseTokenMeta

DatabaseToken

ConnectInfo

DatabaseConnect

DatabaseExport

DatabaseGenerations

GenerationRow

A single backup generation. The field names are the same as GenerationRow in internal/backupproto. The actor metadata, the generation the node reports to the CP, and the records included in this API must use the same names, so that a change in one place is not silently interpreted as 0 elsewhere.

RestoreRequest

DeleteRequest

OperationStarted

This response means the multi-step operation was queued (202). It does not mean it finished — check progress at …/database/operations/{opId}.

Operation

Manifest

The runlot.json inside the bundle. It does not travel in the HTTP body, but it is part of the contract, so it is included here — the CLI writes it, cp-public reads it, and the config generator consumes it.

ManifestTriggers

Scheduled execution (docs/cron.md). It ships in the bundle exactly as the user wrote it in runlot.json — it matches the shape of wrangler's triggers because people migrating over copy those three lines as is.

The only trigger known today is cron, but it is accepted as an object. If a queue or email trigger is added later, the string the user writes must not have to change.

ManifestModule

Role

This is a containment relationship — anything a viewer can do, a member can also do, and anything a member can do, an admin can also do (cp/internal/public/public.go roleRank).

Type: string

Member

OrgHolding

One kind of thing the org still holds (the org_not_empty details).

InviteState

expired is the result of a time comparison, not a column — an invite isn't marked expired, its expiry time has simply passed.

Type: string

Invite

No token. The plaintext token only goes in the email, and cp-public can't even read that column (the column-level GRANT from migration 0043).

InviteView

The invite as seen by whoever holds the token (answered without authentication).

SecretName

Becomes the worker's env.<NAME>. DB and ASSETS (the uppercase counterparts of the env.db and env.assets bindings) and the RUNLOT_ prefix are reserved — the first two are already bindings, and the latter is the namespace Node uses for the process environment (docs/phase6.md B4).

Type: string

SecretMeta

SecretList

LogEvent

A single line of the log stream. Distinguished by type — line is an output line, ping is a 15-second heartbeat, and end is the reason the server ended it.

Usage

UsageRow

AIModel

카탈로그 한 줄 (docs/ai.md §2.3).

AIStatus

AIAutoTopup

AICredit

AILedgerRow

EmailStatus

The project's email status (docs/email.md §5).

MailLogEntry

One line of the email log (docs/email.md §6.1).

MailLogPage

BillingStatus

PlanLimits

The limits for one plan (docs/limits.md §1)

StorageStatus

This is the state of the project's dedicated object storage (docs/storage.md §7).

Objects are not part of DB generations — runlot pg restore does not roll back files (§4.6). Read-after-write is guaranteed, but list may lag.

AccessPolicy

Deployment access policy (docs/access.md §3.1). Provides only non-secret state. Passwords and bypass keys are stored only as hashes, and the read API does not return values (docs/access.md §6, the rule for the secret surface).

A project that has never set a policy has mode: public with no updatedAt. The reason for distinguishing the two is that the UI states "this deployment is public" as a status statement (§7).

AccessBypass

A bypass key for automation. It is included only in this response. You cannot view it again, and reissuing it immediately invalidates the previous key (docs/access.md §3.6).

AccessAuthorize

The URL back to the protected deployment. A one-time code (60 seconds, single use, scoped to that project) is included in the query string, and the front exchanges it, sets a cookie, then issues a 302 back to the original URL without the query string. This 302 removes the code from the address bar (docs/access.md §3.4).

AuthProvider

A social login provider you can register a per-project OAuth app for. Currently supported providers are GitHub, Google, and Kakao, and additional providers are added based on demand (docs/auth.md §12 — SAML and OIDC arrive when enterprise customers do).

Type: string

AuthSettings

End-user auth settings (docs/auth.md §9). §12 explicitly does not support the email template editor, MFA, or the device list.

AuthBrand

Branding for the hosted login page (docs/auth.md §4). For finer-grained branding, build your own page and call the JSON endpoint in §5. If all values are empty strings, the project name and default design tokens are used.

AuthProviderMeta

A single registered login provider. Secrets are not included. The client ID is a public value also exposed to the browser, and the client secret is encrypted and never included in any response (secret-surface rule, docs/access.md §6).

AuthStatus

The project's end-user auth status (docs/auth.md §9).

This API does not include the signup table. User data is stored in the runlot_auth schema of the project's Postgres (§6), and this table is handled together with project deletion, pg export, generational backup, and restore. If CP served this table, the data lifecycle would be split.

AuthSettingsPatch

A partial update of the settings. Only the fields you send change. Sending the entire settings object for every single switch change can let two users editing the same settings have a later save overwrite an earlier one.

AuthProviderPut

These are the login provider credentials. Replacement also happens through this same PUT, so both values are required. If you send only the ID and omit the secret, the response cannot confirm whether the previous secret remains.

Hostname

A single hostname attached to the project. state progresses from pending_dns (verifying ownership) → pending_tls (issuing the certificate) → active (connected), and the failure state is error. Only records with active are included in routing.

HostnameVerify

The two lines the customer needs to add to their own DNS. Getting either one right proves ownership — CNAME also handles the connection, so it is the default guidance. CP computes and returns the value (the fallback origin is a deployment setting, so if clients hardcode it, they break the day it changes).

HostnameRecord

HostnameList

Zone

A zone in our authoritative DNS (docs/domains.md §4.3). serial is the rev — it increases on every change, and once publishedSerial catches up, the nameservers are answering with that content.

ZoneDetail

A single zone and all its records.

Type: Zone & object

RRset

A (name, type) value pair. If managedBy is set, the row was created by another layer and is locked in the editor — system (zone's NS), hostname:<host> (app connection), acme (certificate).

ZoneList

DomainAvailability

Availability and value of a single name. No wholesale price is included — cost is a fact about our operations, not the customer's (cp-core provides it alongside, for operators).

DomainContact

The registrant's contact information. It belongs to the customer — ICANN verification email goes to this address, and the domain is suspended if it is not confirmed within 15 days. The UI must state this fact before registration (docs/domains.md §5.5).

Domain

A single domain. Expiration date, lock status, and nameservers are copies of the registrar's source of truth and are synced by domain-sync (every 6 h) (docs/domains.md §5.4).

DomainEvent

A ledger row (append-only). kind is one of purchase, register_attempt, register, register_reconciled, zone, ds, done, renew, lock, unlock, auto_renew, auth_code, state, transfer_out, import, error, and so on. Previous codes and secrets are never stored here.

DomainDetail

Type: Domain & object

DomainList