BorealHost

Add a cron job to a site. Requires: API key with write scope. Args: slug: Site identifier schedule: Cron schedule (e.g. "*/5 * * * *", "0 2 * * *") command: Command to execute Returns: {"added": true, "result": {...}}

Add a DNS record to a domain. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") record_type: "A", "AAAA", "CNAME", "MX", "TXT", or "SRV" value: Record value (e.g. "1.2.3.4" for A, "mail.example.com" for MX) subdomain: Subdomain part (e.g. "www", "mail"). Empty for apex domain. priority: MX priority (required for MX records) The DNS provider manages the effective TTL and does not expose a per-record value through this service. Returns: {"success": true, "record": {"id": "...", "type": "A", "subdomain": "www", "value": "1.2.3.4"}} Errors: VALIDATION_ERROR: Missing value, invalid record type NOT_FOUND: Domain not found

Add an IP firewall rule (allow or deny) and reload Nginx. Supports IPv4, IPv6, and CIDR notation. Max 100 rules per site. If a rule already exists for the IP, the action is updated. Requires: API key with write scope. Args: slug: Site identifier ip: IP address or CIDR (e.g. "1.2.3.4", "10.0.0.0/8", "2001:db8::/32") action: "deny" (block) or "allow" (whitelist). Default: "deny" Returns: {"added": true, "ip": "1.2.3.4", "action": "deny"}

Add an alias on the same domain, preserving existing aliases.

Publish a container port on the node's public IP (TCP or UDP). This is how inbound UDP reaches a container. There is no other way: the container's own address is private, and the IP allow/deny rules of add_firewall_rule cannot route anything. PORT PRESERVATION MATTERS. Leave external_port at 0 and a port is allocated from 10000-19999 — your service becomes reachable, but on a DIFFERENT number. That is fine for HTTP or ssh and broken for every protocol that carries its own port inside the payload: STUN, TURN, RTP/WebRTC, SIP, WireGuard, QUIC. For those, pass external_port equal to internal_port. A media server needs a contiguous span, not one port — pass internal_port_end. A span is always published unchanged and counts as ONE rule against your limit. Some ports are refused because the host or its neighbours already answer on them: 22, 80, 443, 2222, 9201, 51820, and the bands 9210-9250, 9310-9350 and 20000-20099. The last one is why the "forward UDP 20000-20999 for Janus" recipe printed in most Nextcloud Talk guides will not work here — pick a span above it, e.g. 20100-20599. Requires: API key with write scope. Args: slug: Site identifier internal_port: Port your service listens on inside the container protocol: "tcp" or "udp". Default: "tcp" label: Free-text note shown in the panel external_port: Publish on this exact port; 0 allocates one from the pool internal_port_end: End of a contiguous range (inclusive); 0 means one port Returns: {"id": "...", "external_port": 3478, "internal_port": 3478, "protocol": "udp", "status": "active", "public_address": "203.0.113.5:3478", "port_preserved": true}

Add an HTTP redirect rule to a site. Requires: API key with write scope. Args: slug: Site identifier source_path: Path to redirect, must start with "/" (e.g. "/old-page") target_url: Destination URL redirect_type: 301 (permanent, default) or 302 (temporary) Returns: {"id", "source_path", "target_url", "redirect_type"}

Provision a site into a slot a plan you ALREADY PAY FOR includes. Two different things can be meant by "create a site". Buying one is the checkout flow (create_checkout → update → complete). This is the other: most plans include several sites, and this uses one of them at no extra cost. site_starter includes 5, site_plus 8, site_pro 12, and the agency plans more. `whoami` and `list_sites` show what the account already holds. ⚠ Prefer this over buying a second subscription when a slot is free. Sites under ONE subscription share one CPU pool, one disk quota and one rate-limit bucket — that shared budget is what the plan sells. Two subscriptions split it, so the customer pays twice for capacity they had. Requires: API key with write scope, on the account that owns the plan. Args: slug: Sub-domain for the new site (lowercase, digits, hyphens) subscription_id: The subscription whose slot to use client_name: Display name for the site (optional) domain: Custom domain; defaults to <slug>.borealhost.ai site_type: wordpress (default) | php | php-nodb | static-site. Choose here rather than provisioning WordPress and calling set_site_type afterwards — that installs a WordPress you then abandon in the docroot, and it costs a minute of provisioning. Returns: {"subscription_id": "uuid", "provisioning_job_id": "uuid", "slug": "my-second-site", "domain": "my-second-site.borealhost.ai", "status": "provisioning"} Poll get_site_status(slug) until it reports active. Errors: VALIDATION_ERROR: Plan includes a single site, slug taken, or every slot is in use (the message reports used/total) NOT_FOUND: Unknown subscription, or it belongs to another account

Inject your SSH public key into a site's container for direct SSH access. The key is appended to /home/admin/.ssh/authorized_keys. Only available for VPS/dedicated plans. Requires: API key with write scope. Args: slug: Site identifier public_key: SSH public key string. Supported types: ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256/384/521 Returns: {"success": true, "message": "SSH key added", "ssh_command": "ssh admin@184.107.x.x"} Errors: VALIDATION_ERROR: Invalid or unsupported key format FORBIDDEN: Plan does not support SSH

Create and route a subdomain of a site-linked domain. Creates the DNS A record (if absent) pointing at the site's server, then configures the nginx vhost and SSL certificate on that server. The domain must already be linked to a site (see link_domain). Idempotent: if the DNS record already exists and points at the site's server, the nginx/SSL steps are (re)applied — safe to re-call, e.g. to retry SSL after DNS propagation. May take up to 3 minutes when a certificate is issued. Requires: API key with write scope. Args: domain_name: Registrable domain linked to a site (e.g. "example.com") subdomain: Subdomain label only, no dots (e.g. "blog") Returns: {"fqdn": "blog.example.com", "domain": "example.com", "site": "my-site", "message": "..."} Errors: NOT_FOUND: Domain not found VALIDATION_ERROR: Domain not linked to a site, invalid label, or an existing record points at a different server

Turn an instance you are ALREADY running into a persistent volume. Use this when you launched something, set it up, and then decided you want to keep it. Nothing reboots and no data moves — the machine you have becomes the volume, and you can detach it afterwards to stop paying for compute while keeping the machine. Beats creating a volume and rebuilding. Only instances launched with an ssh_public_key qualify. One launched with your own user_data carries only your key, and a key cannot be added to a machine we cannot already log into — check "managed_ssh" on the instance. Requires: API key with write scope, and an active subscription. Args: instance_id: A running lsw.* instance you own name: Label for the volume (defaults to the instance name) Returns: Volume dict with state "attached", wrapping that same instance. No snapshot exists yet — the first one is taken on detach or snapshot. Errors: CONFLICT: Not running, already a volume, BorealHost Metal, or launched without BorealHost management access

Restore a detached volume onto a fresh instance — optionally a new type. Pass a different instance_type to move the same machine to different hardware: this is the closest thing to changing instance type that the provider allows, since it has no resize API at all. The restore runs at first boot and the machine reboots into itself, so the instance answers SSH BEFORE it is ready. Poll get_compute_volume and give it a few minutes (measured: ~6 min for a 10 GB GPU machine end to end). The machine keeps its SSH host keys, so your client will not warn about a changed host identity. Requires: API key with write scope. Args: volume_id: A volume in state "detached" ssh_public_key: Required — installed via cloud-init at boot instance_type: Defaults to the type it last ran on root_disk_size: GB. May grow, never shrink below the volume's size. Returns: Volume dict with state "attached" and a new instance. Errors: CONFLICT: Volume is not detached, or has no snapshot yet

List one bounded page of immediate children in a backup directory. This returns names and metadata only, never file contents. Use ``next_cursor`` from the response as ``cursor`` to request the next page. Requires: API key with read scope. Args: slug: Site identifier backup_id: UUID of a completed backup path: Absolute directory path as it existed in the backup cursor: Resume after this entry name (optional) limit: Maximum entries, from 1 through 100 Errors: SNAPSHOT_SCOPE_CHANGED: The path is allowed by today's schedule but was not included when this backup was created; choose an included path or a newer backup.

Flush all caches (Redis + WP object cache). Requires: API key with write scope. Args: slug: Site identifier Returns: {"flushed": true}

Get cache status (Redis, WP object cache, hit rates). Requires: API key with read scope. Args: slug: Site identifier Returns: {"redis_running": true, "object_cache_enabled": true, "hit_rate": 0.95, "memory_used_mb": 12}

Enable or disable the WordPress object cache. Requires: API key with write scope. Args: slug: Site identifier enable: true to enable, false to disable Returns: {"enabled": true}

Abandon an unpaid checkout and expire its Stripe payment link. Use this to clean up abandoned attempts rather than leaving them to sit. A completed checkout is never cancelled here — that would be a refund, and it is refused. Args: checkout_id: Checkout session ID Returns: The checkout, with status "canceled". Errors: VALIDATION_ERROR: Checkout was already paid — cancel the subscription from the panel instead FORBIDDEN: Missing checkout_secret and no owning API key

Cancel a scheduled snapshot. Requires: API key with write scope. Args: slug: Site identifier schedule_id: UUID of the scheduled snapshot to cancel Returns: {"success": true, "message": "Scheduled snapshot cancelled"} Errors: NOT_FOUND: Schedule not found or already executed

Claim an API key using a claim token from the container. After calling request_api_key(), read the claim token from the path that call returned in `claim_path`, on that site's container, and pass it here. The token is single-use — once claimed, it cannot be used again. The API key is automatically activated for this MCP session. Args: claim_token: The claim token string read from the container file Returns: {"api_key": "bh_...", "key_prefix": "bh_...", "site_slug": "my-site", "scopes": ["read", "write"], "message": "API key created and activated..."} Errors: VALIDATION_ERROR: Invalid, expired, or already-claimed token

Clear forwarding; when Sieve exists, requires explicit clear_all_filters=true.

Get Cloudflare proxy (CDN) status for a site. Shows whether traffic is routed through Cloudflare's CDN (orange cloud) or goes direct to origin (grey cloud / DNS-only). Requires: API key with read scope. Args: slug: Site identifier Returns: {"domain": "my-site.borealhost.ai", "has_record": true, "proxied": true, "ip": "1.2.3.4"}

Purge Cloudflare CDN cache for a site. Without urls: purges all cached content for the site's subdomain. With urls: purges only the specified URLs (max 30 per call). Requires: API key with write scope. Args: slug: Site identifier urls: Optional list of specific URLs to purge (e.g. ["https://my-site.borealhost.ai/style.css"]) Returns: {"purged": true, "scope": "host", "domain": "my-site.borealhost.ai"}

Enable or disable Cloudflare CDN proxy for a site. When enabled (orange cloud): traffic goes through Cloudflare's CDN, gets caching, DDoS protection, and SSL termination at the edge. When disabled (grey cloud): traffic goes directly to origin server. Requires: API key with write scope. Args: slug: Site identifier proxied: true to enable CDN proxy, false to disable Returns: {"domain": "my-site.borealhost.ai", "proxied": true, "ip": "1.2.3.4"}

Complete checkout with payment and start site provisioning. The checkout must be in "ready" status. Two payment methods: - "stripe_checkout" (default): Returns a short, chat-safe payment URL. **Present `payment_url` to the human — NOT `stripe_checkout_url`.** The raw Stripe URL has a required `#fragment` that chat UIs routinely strip when rendering markdown links, which causes Stripe to show "page not found". `payment_url` is a short BorealHost redirect that preserves the fragment via HTTP 302. After paying, the human lands on a confirmation page (`confirmation_url`) — not on raw JSON. Then poll get_checkout_status() until status becomes "completed". The API key appears in the first poll after payment (shown once, then cleared). Payment provisions the site; nothing else has to be called to create it. - "stripe_payment_method": Charges a Stripe PaymentMethod directly. Requires payment_method_id. On success, returns the API key immediately. Args: checkout_id: Checkout session ID payment_method: "stripe_checkout" (returns a payment_url for a human), "stripe_payment_method" (card on file), or "wallet" — pay from the account's prepaid balance against THIS key's allowance. Check get_wallet() first: `spendable_cents` is what you may actually spend, and a wallet payment is refused for plans that order dedicated hardware, which are authorised against a verified card payment instead. payment_method_id: Stripe PaymentMethod ID (pm_...). Required only for "stripe_payment_method". Returns (stripe_checkout): {"id": "uuid", "status": "awaiting_payment", "payment_url": "https://borealhost.ai/pay/<id>/?s=<secret>", "confirmation_url": "https://borealhost.ai/pay/<id>/confirmation/?s=...", "stripe_checkout_url": "https://checkout.stripe.com/c/pay/...", "message": "Present payment_url to the human..."} Returns (stripe_payment_method): {"id": "uuid", "status": "completed", "api_key": "bh_...", "api_key_message": "Store this API key securely...", "subscription_id": "uuid", "provisioning_job_id": "uuid"} Errors: VALIDATION_ERROR: Missing payment_method_id for stripe_payment_method FORBIDDEN: Checkout not in "ready" status

Configure OpenSRS DKIM and merge email DNS, preserving other senders and subdomains.

Start, stop, or restart a site's container. Only for plans with a dedicated container (VPS / split-VPS / dedicated). Shared-hosting sites share a container and cannot restart it. The response reports the observed container state after the action. Requires: API key with write scope. Args: slug: Site identifier action: "start", "stop", or "restart" Returns: {"site", "action", "status": "running|stopped", "observed": true} Errors: VALIDATION_ERROR: Shared-hosting plan or unknown action

Create an alert rule to monitor CPU, memory, or disk usage. When the metric crosses the threshold, a notification is sent via email and/or webhook. Max 10 rules per site. Requires: API key with write scope. Args: slug: Site identifier metric: "cpu", "memory", or "disk" (percentage-based) threshold: Threshold value 0-100 (e.g. 90 for 90%) operator: "gt" (greater than) or "lt" (less than). Default: "gt" severity: "warning" or "critical". Default: "warning" cooldown_minutes: Min minutes between repeated alerts. Default: 30 notify_email: Send email notification. Default: true notify_webhook: Optional webhook URL for POST notifications Returns: {"id": "uuid", "metric": "disk", "threshold": 90, ...}

Create a new API key with specified scopes. Cannot create keys with higher scopes than the current key. Site-scoped keys restrict access to a single site. email_domains restricts the key to email tools on the named domains; use email:read, email:write and optionally email:signon scopes. expires_at is an ISO timestamp; ip_allowlist accepts IP addresses and CIDR networks. Requires: API key with write scope. Args: name: Human-readable name for the key (1-100 chars) scopes: Comma-separated scopes. Options: "read", "read,write", "read,write,admin". Default: "read" site_slug: Optional — restrict the key to a single site. Omit for account-wide access. Returns: {"api_key": "bh_...", "key_id": "uuid", "prefix": "bh_...", "name": "My Key", "scopes": ["read", "write"], "message": "Store this API key securely — it will not be shown again."} Errors: VALIDATION_ERROR: Invalid name, scopes, or max 25 active keys FORBIDDEN: Cannot create keys with higher scopes than current key

Create a B2 cloud-backed snapshot (zero local disk, async). Streams container data directly to Backblaze B2 via restic. No local disk impact — billed separately at cost+5%. Runs in background — returns immediately with status "creating". Poll list_snapshots() to check when status becomes "completed". Only available for VPS plans. Requires: API key with write scope. Args: slug: Site identifier description: Optional description (max 200 chars) Returns: {"id": "uuid", "name": "...", "status": "creating", "storage_type": "b2", "message": "B2 cloud snapshot started. Poll list_snapshots()..."} Errors: VALIDATION_ERROR: Not a VPS plan or max snapshots reached

Create a manual backup (runs asynchronously). The backup starts in the background. Poll list_backups() to check status. Requires: API key with write scope. Args: slug: Site identifier Returns: {"id": "uuid", "status": "pending", "message": "Backup started. Poll list_backups() to check status."}

Start a new checkout session to purchase a hosting plan. No authentication needed. After creating, call update_checkout to set buyer info, then complete_checkout to pay. The response carries a `checkout_secret`, returned ONCE, that every later step of this checkout requires. It is held in memory for this MCP session and sent automatically — but it is gone if the server restarts. If a session key is set, the checkout is owned by that account and the API key authorizes the later steps on its own, which is the durable path. Args: sku: Plan SKU in format bh_{plan_slug}_{monthly|annual}. Examples: "bh_site_starter_monthly", "bh_site_pro_annual", "bh_site_managed_monthly", "bh_site_business_annual". Call list_plans() to discover all available plan slugs. Returns: {"id": "uuid", "sku": "bh_site_starter_monthly", "plan_slug": "site_starter", "billing_period": "monthly", "status": "not_ready", "buyer_email": "", "requested_slug": "", "created_at": "iso8601", "checkout_secret": "base64-token"} Errors: VALIDATION_ERROR: Invalid SKU format or unknown plan RATE_LIMITED: Max 10 checkouts per IP per hour

Create a persistent machine and boot its first instance. Start here, then set the machine up however you like (install packages, drivers, models). Everything you do becomes part of the volume the first time you detach or snapshot it. While attached you pay hourly compute; while detached you pay only for stored bytes (CA$0.03/GB/month). Stopping an instance does NOT save money on this provider — detaching is what stops the compute charge. Requires: API key with write scope, and an active subscription. Args: name: Label for the volume, e.g. "trainer" image_id: From list_compute_images, e.g. "UBUNTU_24_04_64BIT". Cannot change later — restores must land on the same OS. instance_type: From list_compute_types, e.g. "lsw.g6.xlarge". CAN change on every later attach. ssh_public_key: Required. Volume instances always boot via cloud-init, so this is the only way in. root_disk_size: GB. Defaults to the type's minimum (or 25). Returns: Volume dict with state "attached". Poll get_compute_volume until instance.state is "running" (~1-3 min). Errors: PAYMENT_REQUIRED: No active subscription LIMIT_EXCEEDED: Volume cap reached NOT_AVAILABLE: Volumes not enabled on this deployment

Create a directory in a site's container. Creates parent directories if they don't exist. Requires: API key with write scope. Args: slug: Site identifier path: Relative path of the directory to create Returns: {"success": true, "path": "uploads/2024", "message": "Directory created"} Errors: NOT_FOUND: Unknown slug FORBIDDEN: Protected system path

Create a domain-addressed billable mailbox. Password returned once; retries omit it.

Create an SFTP account on a site. The account is chrooted to /var/www and lands in home_dir. Password must be at least 8 characters. Username must be lowercase alphanumeric. Requires: API key with write scope. Args: slug: Site identifier username: SFTP username (lowercase, max 32 chars) password: Password (min 8 chars) home_dir: Landing directory inside /var/www. Leave empty to land at /var/www itself, which lists every site directory. Returns: {"success": true, "username": "sftpuser", "home_dir": "/wordpress", "protocol": "sftp"}

Create a mailbox on the site's email domain. Password is generated when omitted and returned ONCE — store it. Each mailbox adds to the subscription's email billing. Requires: API key with write scope. Args: slug: Site identifier local_part: Part before the @ (e.g. "info") display_name: Optional display name password: Optional password (generated if empty) Returns: {"email", "password", "message"}

Issue a temporary mail-services token with no OMA access. Requires email:signon. Use 60, 120, ... 1440 minutes. OpenSRS rejects fractional hours; no rounding up.

Create a local container snapshot (async). Runs in background — returns immediately with status "creating". Poll list_snapshots() to check when status becomes "completed" or "failed". Available for VPS, dedicated, and cloud plans (any plan with max_snapshots > 0). Local snapshots are stored on the host disk and count against disk quota. Requires: API key with write scope. Args: slug: Site identifier description: Optional description (max 200 chars) Returns: {"id": "uuid", "name": "snap-...", "status": "creating", "storage_type": "local", "message": "Snapshot started. Poll list_snapshots() to check status."} Errors: VALIDATION_ERROR: Max snapshots reached or insufficient disk quota

Open a support ticket with the BorealHost team. Use this to escalate platform-side problems you cannot fix with the available tools (billing issues, infrastructure faults, API bugs). A human answers every ticket — poll get_support_ticket for updates. Requires: API key with write scope. Args: subject: Short summary (max 200 chars) message: Full description (max 20000 chars) category: Optional (e.g. "technical", "billing") site: Optional site slug the ticket concerns Returns: {"id", "subject", "status", "message": "Ticket created..."}

Register a webhook endpoint for platform events. Events (backup failures, security notices, hosting incidents, billing) are POSTed as JSON, signed with X-BH-Signature (HMAC-SHA256 of the raw body). The signing secret is returned ONCE. Categories: billing, security, hosting, decommission, general — empty list means all. Endpoints auto-disable after 20 consecutive failures. Requires: API key with write scope. Returns: {"id", "url", "events", "secret", "message"}

Search and replace in WordPress database (e.g. URL migration). Handles serialized data safely. Use dry_run=true first to preview changes. Requires: API key with write scope. Args: slug: Site identifier old: String to search for (e.g. "http://old-domain.com") new: Replacement string (e.g. "https://new-domain.com") dry_run: Preview only without making changes (default: true) Returns: {"replacements": 42, "tables_affected": 5, "dry_run": true}

Delete a site and schedule resource cleanup (7-day grace period). WARNING: This is destructive. The site will be inaccessible immediately. After the grace period, its active service data is deleted. A final backup remains recoverable for 30 days; immutable copies may remain until their retention locks expire. Best practice: create a snapshot before decommissioning. Requires: API key with admin scope. Args: slug: Site identifier Returns: {"success": true, "message": "Site scheduled for deletion", "grace_period_days": 7} Errors: NOT_FOUND: Unknown slug

Permanently anonymize the account. Cancels subscriptions, deactivates keys. WARNING: This is irreversible. The account will be soft-deleted and all personal data anonymized. All sites will be decommissioned. Requires: API key with admin scope. Returns: {"success": true, "message": "Account anonymized"}

Delete an alert rule. Requires: API key with write scope. Args: slug: Site identifier rule_id: UUID of the alert rule to delete Returns: {"deleted": true, "id": "uuid"}

Permanently delete a single backup (metadata + stored snapshot). Irreversible. Requires: API key with admin scope. Returns: {"site", "backup_id", "deleted": true}

Permanently delete a volume and everything stored in it. Irreversible: the instance is released AND the stored data is purged from object storage, so billing genuinely stops. Refuses while an instance is live unless force=True, so a running machine's only copy cannot be destroyed by reflex. Requires: API key with admin scope. Returns: {"id", "state": "deleted"}

Delete a cron job by line number. Get line numbers from list_cron(). Requires: API key with write scope. Args: slug: Site identifier line_number: Line number of the cron entry to delete Returns: {"deleted": true}

Delete a DNS record from a domain. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") record_id: ID of the DNS record to delete (from list_domain_dns) Returns: {"success": true, "message": "DNS record deleted"} Errors: NOT_FOUND: Domain or record not found

Soft-delete a mailbox. confirm must equal email. Provider recovery window: 30 days.

Delete a file or directory from a site's container. Directories are deleted recursively. Protected system paths (e.g. /etc, /usr) cannot be deleted. Requires: API key with write scope. Args: slug: Site identifier path: Relative path to delete Returns: {"success": true, "path": "...", "message": "Deleted"} Errors: NOT_FOUND: Path doesn't exist FORBIDDEN: Protected system path

Delete a mailbox (its mail is destroyed). Requires: API key with write scope. Returns: {"email", "deleted": true}

Delete a redirect rule by source path or id. Requires: API key with write scope. Returns: {"site", "deleted": true}

Delete a snapshot (local or B2). Requires: API key with write scope. Args: slug: Site identifier snapshot_id: UUID of the snapshot to delete Returns: {"success": true, "message": "Snapshot deleted"} Errors: NOT_FOUND: Snapshot not found

Remove a subdomain: its DNS record, nginx vhost and certificate. The inverse of add_subdomain. Removes the DNS record AND the server-side vhost and cert, so the name stops resolving and stops being served. Nothing else on the domain is touched. Requires: API key with write scope. Args: domain_name: Registrable domain linked to a site (e.g. "example.com") subdomain: Subdomain label only, no dots (e.g. "blog") Returns: {"fqdn": "blog.example.com", "domain": "example.com", "removed": ["dns", "vhost", "cert"], "message": "..."} Errors: NOT_FOUND: Domain or subdomain not found VALIDATION_ERROR: Domain not linked to a site, or invalid label

Remove a webhook endpoint. Requires: API key with write scope. Returns: {"id", "deleted": true}

Queue: snapshot the machine, verify it, then destroy the instance. This is how you stop paying for compute while keeping your work. ASYNCHRONOUS. Returns immediately with state "detaching" — it does NOT mean the detach finished. The capture takes minutes (roughly 1 min per 10 GB plus verification), so it runs in a background worker. Poll get_compute_volume until state is "detached" (done) or "error" (failed). Safety: if the snapshot or its verification fails, the instance is left RUNNING and the volume goes to state "error". Your data is never traded for a tidy state machine. Retry the detach once you have fixed the cause. Requires: API key with write scope. Returns: Volume dict with state "detaching". Poll for the outcome.

Disable an empty email domain; refuses active or recoverable accounts.

Get full domain details including DNS and infrastructure status. Requires: API key with read scope. Args: domain_name: Full domain name (e.g. "example.com") Returns: {"domain": "example.com", "status": "active", "expires_at": "iso8601", "auto_renew": true, "nameservers": ["ns1.borealhost.ai", "ns2.borealhost.ai"], "dns_records": [...], "linked_site": "my-site"} Errors: NOT_FOUND: Domain not owned by this account

Update domain settings (auto-renew, WHOIS privacy, registrar lock). Only provided (non-None) fields are updated. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") auto_renew: Optional bool enabling/disabling automatic renewal whois_privacy: Optional bool. False disables saved proxy service. Paid activation via True is refused; request an activation quote through Support. locked: Optional bool enabling/disabling registrar lock (prevents unauthorized transfers) Returns: {"success": true, "domain": "example.com", "auto_renew": true, "whois_privacy": true, "locked": true} Errors: NOT_FOUND: Domain not found or not owned by account

Enable an independent email domain; preserve all other email domains. Requires a verified owned domain and email:write scope. site_slug selects billing when ambiguous. Defaults request 2,000 users and 50,000 aliases.

Enable an SMTP relay for a site's outbound transactional mail. Provisions a mail-send-only credential on the platform relay and configures SPF/DKIM DNS when the domain zone is hosted here. The SMTP password is returned ONCE. Use TLS on port 587, username "apikey". Requires: API key with write scope. Returns: {"relay_id", "domain", "smtp_host", "smtp_ports", "smtp_username", "smtp_password", "dns_auto_configured", "message"}

Route *.domain (every subdomain) to the domain's linked site. Creates a wildcard DNS record and issues a wildcard certificate via ACME DNS-01. SLOW — DNS propagation is part of the challenge, expect 2-5 minutes. Requires the domain to be linked to a site and its DNS hosted by BorealHost. Requires: API key with write scope. Returns: {"domain", "wildcard", "site", "ssl_active", "not_after"}

Run ONE bounded read against a site's database. One statement, beginning with SELECT, SHOW, DESCRIBE or EXPLAIN, with no second statement and no data-modifying clause anywhere in it. The container proves the statement is a read before running it and caps the result: 200 rows by default, 1000 maximum, 2 MB of cell data. `truncated` in the response says whether a cap was reached. ⚠ THIS TOOL CANNOT CHANGE ANYTHING, AND RETRYING WITH DIFFERENT WORDING WILL NOT MAKE IT. Anything that is not a single bounded read is refused with READ_ONLY and nothing runs. To change data or schema, use the tool for the job: optimize_database, database_search_replace, manage_db_user, list_databases, list_tables — and for creating, altering, dropping, importing or exporting tables, the database manager in the control panel, which has no tool here. Requires: API key with write scope (unchanged — the scope is the customer's published permission for this operation, not a claim about what it does). Args: slug: Site identifier database: Database name query: One read statement Returns: {"columns": ["id", "user_email"], "rows": [[1, "a@example.com"], ...], "row_count": 1, "truncated": false, "execution_time_ms": 12.0} Errors: READ_ONLY: Not a single bounded read. The error text carries the explanation and names the operation to use instead.

Look up mailbox/alias/forward/free in an authorized email domain.

Get app installation status and log. Poll this after install_app() to track progress. Requires: API key with read scope. Args: slug: Site identifier app_id: App ID from install_app() response Returns: {"id": "uuid", "app_name": "myapp", "status": "running"|"installing"|"failed", "install_log": "..."} Statuses: "installing", "running", "stopped", "failed", "uninstalled"

Get the backup retention policy for a VPS site. Requires: API key with read scope. Returns: {"site", "retention": {"keep_daily", "keep_weekly", "keep_monthly"}}

Get a Stripe billing portal URL for managing payment methods and invoices. Returns a URL (not a redirect) that the human can open in a browser. Requires: API key with read scope. Args: flow: Optional. Set to "payment_method_update" to go directly to the payment method update page. Returns: {"url": "https://billing.stripe.com/p/session/..."}

Poll a checkout session for status updates. Call this after complete_checkout to track payment and provisioning. Polling strategy: - First 60 seconds: every 5 seconds - After 60 seconds: every 15 seconds - Stop after 10 minutes if not completed Checkout statuses (in order): - "not_ready": Missing required fields (slug) - "ready": All fields set, awaiting payment - "awaiting_payment": Stripe checkout page opened, waiting for human - "in_progress": Payment received, site being provisioned - "completed": Site ready — API key included (shown once, then cleared) - "canceled": Checkout was abandoned - "failed": Payment or provisioning failed Terminal statuses: "completed", "canceled", "failed". Args: checkout_id: Checkout session ID Returns (when completed): {"id": "uuid", "status": "completed", "api_key": "bh_...", "api_key_message": "Store this API key securely...", "api_key_pending": false, "subscription_id": "uuid", "subscription_status": "active", "site": {"slug": "my-site", "status": "active", "url": "https://my-site.borealhost.ai"}, "completed_at": "iso8601"} Immediately after payment `site` may be null with a `provisioning_message` — the site is being built. Poll again in a few seconds. Note: The api_key field appears ONCE in the first poll after completion, then is permanently cleared. `api_key_pending` tells you whether it is still waiting to be collected. Store it immediately.

Get live details for a compute instance (state, public IP, accrued cost). State is synced from the cloud provider on each call. SSH as root once state is "running" and public_ip is set. Requires: API key with read scope. Args: instance_id: Instance UUID from launch_compute_instance / list Returns: {"id", "state", "public_ip", "hourly_price_cad", "accrued_cad", "terminate_after", ...}

Get a volume's live state, its instance, and its monthly storage cost. Requires: API key with read scope. Returns: Volume dict plus "monthly_storage_cad". After attach, poll this until instance.state is "running" — then allow a few more minutes for the restore to finish and the machine to reboot into itself.

Get WordPress database information (size, tables, row counts). Requires: API key with read scope. WordPress sites only. Args: slug: Site identifier Returns: {"database": "wp_mysite", "size_mb": 45.2, "tables": 12, "total_rows": 15432}

Poll one database recovery without waiting for completion. Requires: API key with read scope. Args: slug: Site identifier backup_id: UUID of the source backup recovery_id: UUID returned by ``recover_backup_database``

Read effective OpenSRS limits, counts, connections and public DNS health.

Email addon status and mailboxes for a site. Requires: API key with read scope. Returns: {"configured": bool, "domain", "mailboxes", "mailbox_list": [...]}

Issue a one-use BorealHost link expiring in 60 seconds. Redemption mints provider SSO. Requires email:signon.

Poll one selected-file recovery without waiting for it to finish. Requires: API key with read scope. Args: slug: Site identifier backup_id: UUID of the source backup recovery_id: UUID returned by ``recover_backup_files`` Returns: {"id": "uuid", "backup_id": "uuid", "status": "running"|"completed"|"failed", "paths": [...], "error": "", ...}

Retrieve container logs (error, access, or PHP). Requires: API key with read scope. Args: slug: Site identifier log_type: "error" (Nginx/Apache errors), "access" (HTTP request log), or "php" (PHP-FPM errors, WordPress sites only) lines: Number of lines to retrieve (1–500, default: 100) search: Optional keyword filter — only lines containing this string Returns: {"log_type": "error", "lines": ["2024-01-15 ... error ...", ...], "count": 42, "truncated": false} Errors: NOT_FOUND: Unknown slug VALIDATION_ERROR: Invalid log_type or lines out of range

Inspect usage, services, aliases count, forwarding/Sieve, autoresponder and label.

Get traffic and performance metrics for a site. Requires: API key with read scope. Args: slug: Site identifier days: Number of days of history (1–90, default: 7) Returns: {"requests": [...], "bandwidth": [...], "errors": [...], "period": {"start": "iso8601", "end": "iso8601"}} Errors: NOT_FOUND: Unknown slug VALIDATION_ERROR: days out of range

Get current resource usage (CPU, memory, disk, load average). Requires: API key with read scope. Args: slug: Site identifier Returns: {"cpu_percent": 12.5, "memory_mb": 384, "memory_total_mb": 512, "disk_used_gb": 3.2, "disk_total_gb": 10, "load_1m": 0.5, "load_5m": 0.3, "load_15m": 0.2}

Read the custom nginx config for a domain on the BorealHost host proxy. Your site sits behind a BorealHost reverse proxy that terminates TLS and forwards to your container. This returns the custom nginx block applied to that proxy for this domain (empty if you have not set one). Requires: API key with read scope. Args: domain_name: Full domain name (e.g. "example.com") Returns: {"domain": "example.com", "content": "location ...", "exists": true} Errors: NOT_FOUND: Domain not found VALIDATION_ERROR: Domain is not linked to a site

Get detailed status of a hosted site including resources, domains, and modules. Requires: API key with read scope. Args: slug: Site identifier (the slug chosen during checkout) Returns: {"slug": "my-site", "plan": "site_starter", "status": "active", "domains": ["my-site.borealhost.ai"], "modules": {...}, "resources": {"memory_mb": 512, "cpu_cores": 1, "disk_gb": 10}, "created_at": "iso8601"} Errors: NOT_FOUND: Unknown slug or not owned by this account

List SMTP relay credentials for a site, with domain-auth status. Requires: API key with read scope. Returns: {"relays": [{"relay_id", "domain", "status", "domain_authenticated"}, ...]}

Get snapshot disk usage and quota info for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"disk_quota_gb": 200, "max_snapshots": 5, "snapshot_count": 2, "local_snapshot_bytes": 1234, "b2_snapshot_bytes": 5678, "can_create": true}

Get SSH connection info for a VPS/dedicated site. Only available for VPS/dedicated plans (not shared hosting). Requires: API key with read scope. Args: slug: Site identifier Returns: {"host": "184.107.x.x", "port": 22, "username": "admin", "ssh_command": "ssh admin@184.107.x.x"} Errors: NOT_FOUND: Unknown slug FORBIDDEN: Plan does not support SSH (shared plans)

Get detailed system stack information (OS, PHP, DB, web server versions). Requires: API key with read scope. Args: slug: Site identifier Returns: {"os": "Debian 12", "kernel": "6.1.0", "php": "8.3.4", "mysql": "10.11.6-MariaDB", "nginx": "1.24.0", "wordpress": "6.5"}

Get a support ticket with its full message thread. Requires: API key with read scope. Args: ticket_id: Ticket UUID from list_support_tickets Returns: {"id", "subject", "status", "messages": [...]}

The account's prepaid balance, and what THIS key may spend from it. Two ceilings, and both apply: the balance bounds the ACCOUNT, the allowance bounds this KEY within it. Plan against `spendable_cents`, which is the lower of the two — a $50 balance behind a $5 allowance means $5, and planning against the balance is planning a purchase that gets refused. `can_spend: false` with a non-zero balance is normal and means this key has no budget allocated. That is not a bug: a key with no allowance may not spend the account's money, which is the whole reason allowances exist. Ask the human to allocate one in the panel (Compte → Clés API). Read-only. Money goes in through a human — an agent able to top up its own budget does not have one. Requires: API key with read scope. Returns: {"currency": "CAD", "balance_cents": 5000, "spendable_cents": 500, "can_spend": true, "key_allowance": {"limit_cents": 2000, "spent_cents": 1500, "remaining_cents": 500}} To spend it: complete_checkout(..., payment_method="wallet").

One-time webmail single-sign-on URL for a mailbox. Requires: API key with write scope. Returns: {"email", "url"}

Install an app template on a VPS/Cloud site. Starts a background installation. Poll get_app_status() for progress. Requires: API key with write scope. VPS or Cloud plan only. Args: slug: Site identifier template: App template slug. Available: django, laravel, nextjs, nodejs, nuxtjs, rails, static, wordpress app_name: Short name for the app (2-50 chars, lowercase alphanumeric + hyphens). Used as subdomain: {app_name}.{site_domain} db_type: Database type. "none", "mysql", or "postgresql" (depends on template) domain: Custom domain override (default: {app_name}.{site_domain}) display_name: Human-friendly name (default: derived from app_name) Returns: {"id": "uuid", "app_name": "myapp", "status": "installing", "message": "Installation started. Poll for progress."} Errors: FORBIDDEN: Plan does not support apps (shared plans) VALIDATION_ERROR: Invalid template, app_name, or duplicate name

Launch an on-demand hourly compute instance (Canada, CAD). Billing starts at launch (per minute, 1-hour minimum) and runs until terminate_compute_instance — stopping does NOT stop the charge. Every instance has a hard TTL (max_lifetime_hours, default 72h) after which it is auto-terminated. Usage is metered onto your existing BorealHost subscription; an active subscription is required. Requires: API key with write scope. Args: instance_type: From list_compute_types, e.g. "lsw.c3.large" image_id: From list_compute_images, e.g. "UBUNTU_24_04_64BIT" name: Optional label for the instance ssh_public_key: Public key installed as root access. Mutually exclusive with user_data (provider limitation) — provide exactly one. user_data: cloud-init config (plain text #cloud-config). Use ssh_authorized_keys inside it if you need a key AND user data. root_disk_size: GB (default max(min_disk, 25)) storage_type: "CENTRAL" (redundant) or "LOCAL" (faster I/O) max_lifetime_hours: Hard TTL, 1-336 (default 72) Returns: Instance dict: {"id", "state": "launching", "public_ip", "instance_type", "hourly_price_cad", "terminate_after", ...}. Poll get_compute_instance until state is "running" and public_ip is set (~1-3 min). Errors: PAYMENT_REQUIRED: No active subscription to bill against LIMIT_EXCEEDED: Concurrent instance cap reached SPEND_CAP_EXCEEDED: Monthly compute spend cap reached VALIDATION_ERROR: Bad type/image/disk/TTL, or both/neither of ssh_public_key and user_data

Link a domain to a hosted site. Attaches the domain to the specified site and triggers automatic DNS configuration and SSL provisioning. WARNING: Regenerates this site's nginx vhost on the host from scratch. Any config applied to that vhost by hand is lost, silently — the site keeps serving and only the hand-added behaviour disappears. Config set via the nginx-snippet endpoint is NOT affected: it lives in a separate file the regenerated vhost re-includes, which is what that endpoint is for. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") site_slug: Site identifier to link the domain to Returns: {"success": true, "domain": "example.com", "linked_site": "my-site", "message": "Domain linked"} Errors: NOT_FOUND: Domain or site not found VALIDATION_ERROR: Domain already linked to another site

List user-configurable alert rules for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: [{"id": "uuid", "metric": "disk", "operator": "gt", "threshold": 90, "severity": "warning", "enabled": true, "cooldown_minutes": 30, "notify_email": true}]

List all API keys for the account. Shows key metadata (name, prefix, scopes, last used) but never the full key value. Requires: API key with read scope. Returns: [{"id": "uuid", "name": "My Key", "prefix": "bh_a2...", "scopes": ["read", "write"], "is_active": true, "created_at": "iso8601", "last_used_at": "iso8601"|null, "site_slug": null|"my-site"}]

List installed apps on a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"apps": [{"id": "uuid", "app_name": "myapp", "template_slug": "django", "status": "running", "domain": "myapp.mysite.borealhost.ai"}]}

List all backups for a site (automatic and manual). Requires: API key with read scope. Args: slug: Site identifier Returns: [{"id": "uuid", "backup_type": "auto"|"manual", "status": "completed", "size_bytes": 1234, "size_display": "1.2 Mo", "timestamp": "iso8601", "notes": "..."}]

List checkouts belonging to the authenticated account. Requires: API key. Only checkouts with a recorded owner appear — every checkout created while authenticated, plus every checkout that reached payment. An anonymous checkout whose one-shot secret was lost cannot be listed; create checkouts authenticated to keep them addressable. Args: status: Optional filter — "not_ready", "ready", "awaiting_payment", "completed", "canceled", "failed". Returns: {"checkouts": [{...same shape as get_checkout_status...}], "note": "..."}

List OS images available for on-demand compute instances. Requires: API key with read scope. Returns: {"images": [{"id": "UBUNTU_24_04_64BIT", "name": "Ubuntu 24.04 LTS (x86_64)", "family": "linux", "flavour": "ubuntu"}, ...]}

List your on-demand compute instances with month-to-date spend. Requires: API key with read scope. Returns: {"instances": [...], "month_to_date_spend_cad": 12.34, "monthly_spend_cap_cad": 500.0}

List on-demand compute instance types with hourly CAD prices. On-demand instances are real cloud VMs in Canada (Montreal region), billed per minute (1-hour minimum) post-paid onto your existing BorealHost subscription. Use them for short-lived extra compute (builds, batch jobs, experiments). Requires: API key with read scope. Returns: {"region": "ca-central-1", "currency": "CAD", "billing": "hourly, post-paid; billing runs until the instance is terminated", "types": [{"type": "lsw.c3.large", "vcpu": 2, "memory_gb": 3, "hourly_price_cad": 0.08, "min_disk_gb": 5, "storage_types": ["CENTRAL", "LOCAL"]}, ...]}

List your compute volumes — machines that survive instance termination. A volume is a whole machine (packages, drivers, services, users, data) stored in Canada. Detaching destroys the instance but keeps the machine; attaching restores it onto a fresh instance, optionally of a DIFFERENT type. That is how you move a workload from a small CPU box to a big GPU box without rebuilding it. Requires: API key with read scope. Returns: {"volumes": [{"id", "name", "state", "instance_type", "stored_gb", "has_snapshot", "instance": {...} or null}, ...], "price_cad_per_gb_month": 0.03} state is one of: creating, attached, detaching, detached, attaching, error. Only "attached" has a running instance you can log into.