Skip to content
Navigation

A month's statement

A calendar month (UTC), whatever the periods of the account's subscription: the parts it is made of (the periods that have hours in it, and the hours in no period, which are the free plan's), each with, for every meter, what was used in it, what its stretch includes, what was past that, the price and the amount, what the lines come to at the prices, what of that the stretch's credit paid and what is left of it, and what is left to pay; each meter's line for the whole month; what the parts add up to, which is what the month's usage takes from the account's balance as far as the balance goes; the credit of the month, granted, used, gone to a plan the account moved up to and lapsed; the fees of the periods that began in the month; which Credits paid, by the kind of lot, what none has paid and is owed, and what none could pay and is written off; what was added to the balance in the month and what lapsed with it; what each project used, to be held against GET /v1/usage (from and to the month's) with that project's key; and what the account held at the month's end. A period that lies in two months has what it owes, and what its credit paid, split between their two statements so that the two add up to it, to the millionth of a dollar. The month that is not over yet is as it stands. A month that is over does not change in what was used and what it came to, unless usage of it comes in afterwards (a node that was away): then it is not closed until what it comes to is taken from the balance, and is closed again within seconds. What it says paid for it changes when something it owed is paid by Credits that came later. A month the account had nothing in has nothing used. Takes read.

GET
https://api.glac.ai/v1/billing/statement

Authorization

  • apiKeyHTTPrequired

Query parameters

  • periodoptionalstring

    The month, YYYY-MM, one that has begun. By default the month it is.

    pattern: ^[0-9]{4}-[0-9]{2}$

Returns

200

The statement.

JSON
  • objectstringrequired
  • account_idstringrequired
  • periodstringrequired
  • fromstringrequired
    format: date-time
  • tostringrequired
    format: date-time
  • endedbooleanrequired
  • hoursintegerrequired

    The hours the calendar month has.

  • linesarray ofobjectrequired

    One line for each meter, of the whole month: cpu, memory, requests, state, egress, storage, logs, drive_writes, drive_cold_reads, object_storage, object_class_a, object_class_b, browsers.

    • itemcpuormemoryorrequestsorstateoregressorstorage+7 morerequired
    • unitstringrequired

      What the quantities are in, as BillingMeter.unit.

    • quantitynumberrequired

      What the account's projects used in the month.

    • billablenumberrequired

      What of it was past what its stretch includes: the parts' added up.

    • unit_price_usdnumberrequired
    • price_pervcpu_hourorgib_hourormillion_requestsorgb_monthorgborsession_hourrequired
    • amount_usdnumberrequired

      The parts' amounts added up.

    • regionsoptionalobject

      Of egress alone: the line region by region (the region of the node the traffic left from).

      • naobjectrequired
        • usedintegerrequired

          Bytes sent from the region's nodes (of a statement's part: in the part).

          format: int64 · minimum: 0
        • billableintegerrequired

          What of them is past what is included.

          format: int64 · minimum: 0
        • unit_price_usdnumberrequired

          The region's price of a gigabyte (10^9 bytes).

        • amount_usdnumberrequired

          What billable comes to at that price, to the nearest millionth.

          minimum: 0
      • euobjectrequired
        • usedintegerrequired

          Bytes sent from the region's nodes (of a statement's part: in the part).

          format: int64 · minimum: 0
        • billableintegerrequired

          What of them is past what is included.

          format: int64 · minimum: 0
        • unit_price_usdnumberrequired

          The region's price of a gigabyte (10^9 bytes).

        • amount_usdnumberrequired

          What billable comes to at that price, to the nearest millionth.

          minimum: 0
      • apobjectrequired
        • usedintegerrequired

          Bytes sent from the region's nodes (of a statement's part: in the part).

          format: int64 · minimum: 0
        • billableintegerrequired

          What of them is past what is included.

          format: int64 · minimum: 0
        • unit_price_usdnumberrequired

          The region's price of a gigabyte (10^9 bytes).

        • amount_usdnumberrequired

          What billable comes to at that price, to the nearest millionth.

          minimum: 0
    • backups_gb_hoursoptionalnumber

      Of the line of state alone: how much of quantity the backups of the account's volumes kept in the object store (GET /v1/usage with kind=backup says it for any range); the rest is what its sleeping sandboxes kept. One meter at one price: what is included and what is billable are of both together.

      minimum: 0
  • partsarray ofobjectrequired

    What the month is made of: the periods of the subscription that have hours in it, the earliest first, and then the hours in no period (left out where the periods cover the month and nothing was used outside them).

    • fromstringrequired

      Where the part begins in the month: the period's beginning, or the month's.

      format: date-time
    • tostringrequired
      format: date-time
    • planfreeorp20orp100orp300orp1000orp2000required
    • periodobject | nullrequired

      The period of the subscription the part is of, from its beginning to its end; null for the hours in no period.

      • fromstringrequired
        format: date-time
      • tostringrequired
        format: date-time
    • hoursintegerrequired

      The hours the stretch has (a period: from the hour it begins in up to the hour it ends in; otherwise the calendar month's): what its storage is counted by.

    • linesarray ofobjectrequired

      One line for each meter: cpu, memory, requests, state, egress, storage, logs, drive_writes, drive_cold_reads, object_storage, object_class_a, object_class_b, browsers.

      • itemcpuormemoryorrequestsorstateoregressorstorage+7 morerequired
      • unitstringrequired

        What the quantities are in, as BillingMeter.unit.

      • quantitynumberrequired

        What was used in the part.

      • earliernumberrequired

        What was used of the same period in the month before; 0 for a part that is of no period, and for a period that began in this month.

      • includednumber | nullrequired

        What the part's stretch includes of the meter, as BillingMeter.included.

      • billablenumberrequired

        What of quantity is past what is included: earlier + quantity past included, less earlier past it. Of storage, what the same part's state line used counts first.

      • billable_earliernumberrequired

        What was past what is included of the same period in the month before.

      • unit_price_usdnumberrequired
      • price_pervcpu_hourorgib_hourormillion_requestsorgb_monthorgborsession_hourrequired
      • units_per_priceintegerrequired

        How many of unit the price is for: 3,600 (seconds, GiB-seconds, seconds of a session awake), 1,000,000 (requests of any class), hours of the part (GB-hours), 10^9 (bytes).

      • amount_usdnumberrequired
      • regionsoptionalobject

        Of egress alone: the line region by region (the region of the node the traffic left from), with what of each region was past what is included before the part.

        • naobjectrequired
          • usedintegerrequired

            Bytes sent from the region's nodes in the part.

            format: int64 · minimum: 0
          • billableintegerrequired

            What of them is past what is included.

            format: int64 · minimum: 0
          • billable_earlierintegerrequired

            What of the region's bytes was past what is included of the same stretch before the part (in the month before).

            format: int64 · minimum: 0
          • unit_price_usdnumberrequired

            The region's price of a gigabyte (10^9 bytes).

          • amount_usdnumberrequired

            What billable_earlier and billable cost together at that price, less what billable_earlier costs alone, to the nearest millionth.

            minimum: 0
        • euobjectrequired
          • usedintegerrequired

            Bytes sent from the region's nodes in the part.

            format: int64 · minimum: 0
          • billableintegerrequired

            What of them is past what is included.

            format: int64 · minimum: 0
          • billable_earlierintegerrequired

            What of the region's bytes was past what is included of the same stretch before the part (in the month before).

            format: int64 · minimum: 0
          • unit_price_usdnumberrequired

            The region's price of a gigabyte (10^9 bytes).

          • amount_usdnumberrequired

            What billable_earlier and billable cost together at that price, less what billable_earlier costs alone, to the nearest millionth.

            minimum: 0
        • apobjectrequired
          • usedintegerrequired

            Bytes sent from the region's nodes in the part.

            format: int64 · minimum: 0
          • billableintegerrequired

            What of them is past what is included.

            format: int64 · minimum: 0
          • billable_earlierintegerrequired

            What of the region's bytes was past what is included of the same stretch before the part (in the month before).

            format: int64 · minimum: 0
          • unit_price_usdnumberrequired

            The region's price of a gigabyte (10^9 bytes).

          • amount_usdnumberrequired

            What billable_earlier and billable cost together at that price, less what billable_earlier costs alone, to the nearest millionth.

            minimum: 0
    • list_usdnumberrequired

      The lines' amounts added up: what the part's usage comes to at the list prices.

    • creditrequired

      The credit of the part's stretch (a period of a paid plan): what it was, what of it went to a plan the account moved up to, what of it paid for the period's usage before the part (in the month before) and in it, what is left after the part, and of a period that ends in the part, what lapsed. Null for the hours in no period, and a period of a plan that gives none.

      One of the following:

      • PlanCredit
        • granted_usdnumberrequired

          What the period's plan gives: its fee (credit_usd of GET /internal/control plans), whatever was charged for the period.

          minimum: 0
        • moved_usdnumberrequired

          What of it went to the fee of a plan the account moved up to in the period: what was left of it when that plan's charge was made, which was taken off that fee (Subscription). It pays for nothing here.

          minimum: 0
        • used_earlier_usdnumberrequired

          What of it paid for the period's usage before this part (of a statement: in the month before); 0 in GET /v1/billing and GET /v1/usage, which have the whole period.

          minimum: 0
        • used_usdnumberrequired

          What of it paid for the usage here: the least of what is left of it and what the meters came to at the list prices.

          minimum: 0
        • left_usdnumberrequired

          What is left of it after that.

          minimum: 0
        • lapses_atstring | nullrequired

          When what is left of it lapses: the period's end.

          format: date-time
        • lapsed_usdnumber | nullrequired

          Of a statement's part of a period that ends in the month: what was left of the credit at the end, which lapsed (0 until the end has come: it may still be used). Null where the period does not end in the part, and in GET /v1/billing and GET /v1/usage.

          minimum: 0
      • null
    • usage_usdnumberrequired

      What is left to pay of the part: list_usd less credit.used_usd.

  • earlier_usdnumberrequired
    1. (Of a month in which a store was brought from plans that included use by the month: what the month owed by then, which the lines do not price again.)
  • list_usdnumberrequired

    What the month's lines come to at the list prices: the parts' list_usd added up.

  • credit_used_usdnumberrequired

    What of that the credits of the parts' stretches paid: the parts' credit.used_usd added up.

  • usage_usdnumberrequired

    What the month's usage past what is included (the quantities, and the credit) comes to: the parts' usage_usd added up (with earlier_usd), which is list_usd less credit_used_usd. This is what the month takes from the account's balance, as far as the balance goes.

  • plan_creditobjectrequired

    The credit of the paid plan's periods, of the month: so that what each period was given is seen to be used, moved to a plan's fee, lapsed or left, over the months it lies in.

    • granted_usdnumberrequired

      The credit of the periods that began in the month.

      minimum: 0
    • used_usdnumberrequired

      What credit paid for in the month: credit_used_usd.

      minimum: 0
    • moved_usdnumberrequired

      What of the credit of the periods that ended in the month went to the fee of a plan the account moved up to.

      minimum: 0
    • lapsed_usdnumberrequired

      What was left of the credit of the periods that ended in the month, by the time it was read: it lapsed.

      minimum: 0
  • feesarray ofobjectrequired

    One for each period of the subscription that began in the month; empty where none did.

    • fromstringrequired

      When the period begins.

      format: date-time
    • tostringrequired

      When it ends: earlier than a month on for a period that ended where one of a plan that stands higher began.

      format: date-time
    • planp20orp100orp300orp1000orp2000required
    • charge_idstring | nullrequired

      The charge that paid it; null for a period that was given.

    • plan_fee_usdnumberrequired

      The plan's fee for the period: amount_usd and credit_usd together.

    • credit_usdnumberrequired

      What was taken off the fee, of a period that began when the account moved up from a period it had paid for: what was left of that one's credit when the plan was asked for, in whole cents rounded in the account's favour (see Subscription). 0 otherwise.

    • amount_usdnumberrequired

      What was charged for the period: the fee less the credit; 0 for one that was given.

  • fee_usdnumberrequired

    The fees added up: what was charged to the card for them. It is not in usage_usd.

  • projectsarray ofobjectrequired

    Every project of the account, in the order they were made, with what it used in the month: the totals GET /v1/usage gives that project's key for the month.

    • idstringrequired
    • namestringrequired
    • cpu_secondsnumberrequired
    • memory_gib_secondsnumberrequired
    • requestsintegerrequired
    • state_gb_hoursnumberrequired
    • egress_bytesintegerrequired
    • storage_gb_hoursnumberrequired

      What the project's volumes and snapshots kept: what GET /v1/usage?kind=volume and ?kind=snapshot add up to for the month.

    • log_gb_hoursnumberrequired

      What the project's apps printed that their nodes kept, times the hours it was kept: the logs' meter.

    • drive_write_bytesintegerrequired

      What was written to the project's volumes.

    • drive_cold_read_bytesintegerrequired

      What was read of the project's volumes from the object store, and of Drives' snapshots through its sandboxes' read-only mounts.

    • object_storage_gb_hoursnumberrequired

      What the project's buckets held.

    • class_a_requestsintegerrequired
    • class_b_requestsintegerrequired
    • browser_awake_secondsnumberrequired

      How long the project's Browsers sessions were awake: the meter of the sessions.

    • log_bytesintegerrequired

      What the project's apps printed that their nodes kept, in bytes, in the hours it was printed in: no meter's.

    • object_egress_bytesintegerrequired

      What was read out of the project's buckets to the internet: no meter's (it costs nothing, within fair use).

  • pricesobjectrequired

    In US dollars, with at most six digits after the point.

    • vcpu_hour_usdnumberrequired

      A busy vCPU-hour.

    • memory_gib_hour_usdnumberrequired

      A GiB-hour of memory held while awake, or paused in memory (the pause tier).

    • requests_million_usdnumberrequired

      A million requests: into apps, and into sandboxes through their preview URLs.

    • state_gb_month_usdnumberrequired

      A GB-month of what sleeping sandboxes keep, and of what the backups of volumes keep in the object store.

    • egress_gb_usdnumberrequired

      A gigabyte (10^9 bytes) sent to the internet from a node in North America, or from one with no region: traffic is priced by the region of the node it left from: na North America (and a node with no region), eu Europe, ap Asia-Pacific.

    • egress_eu_gb_usdnumberrequired

      A gigabyte sent to the internet from a node in Europe.

    • egress_ap_gb_usdnumberrequired

      A gigabyte sent to the internet from a node in Asia-Pacific.

    • storage_gb_month_usdnumberrequired

      A GB-month of what volumes and snapshots keep: the price of what sleeping sandboxes keep, unless the control plane was started with another (--price-storage-gb-month).

    • logs_gb_month_usdnumberrequired

      A GB-month of what apps print that their nodes keep: the text of each line of output kept, counted as it was printed, for the hours it is kept (--price-logs-gb-month).

    • drive_write_gb_usdnumberrequired

      A gigabyte (10^9 bytes) written to volumes (Drives): the bytes of the write requests their block devices served (--price-drive-write-gb).

    • drive_cold_read_gb_usdnumberrequired

      A gigabyte of volumes read cold: fetched from the object store because their node had not got them (a restore from a backup; a block fetched on demand). What is read from the node's own disk costs nothing (--price-drive-cold-read-gb).

    • object_storage_gb_month_usdnumberrequired

      A GB-month of what buckets hold (--price-object-storage-gb-month). What is read out of them costs nothing, within fair use.

    • object_class_a_million_usdnumberrequired

      A million requests to buckets of class A: what writes, lists or sets (--price-object-class-a-million).

    • object_class_b_million_usdnumberrequired

      A million requests to buckets of class B: what reads (--price-object-class-b-million). What deletes is of neither class and costs nothing.

    • browser_hour_usdnumberrequired

      An hour of a Browsers session awake, by the millisecond, in place of its CPU time and its memory: it includes half a vCPU averaged over each hour it is awake, and its CPU time past that is priced at vcpu_hour_usd; its memory awake is not priced. Asleep, what it keeps is priced as any sleeping sandbox's (state_gb_month_usd, or memory_gib_hour_usd while it is paused in memory) (--price-browser-hour).

    • provisionalbooleanrequired
  • databasesarray ofobjectrequired

    Every database of the account that used anything in the month (a deleted one too), in the order they were made: a line of its own for each (slice DB7).

    • idstringrequired
    • namestringrequired
    • project_idstringrequired
    • cpu_secondsnumberrequired

      Its branches' instances' CPU time.

    • memory_gib_secondsnumberrequired

      Their memory, awake and paused.

    • requestsintegerrequired
    • state_gb_hoursnumberrequired

      What they kept asleep.

    • egress_bytesintegerrequired

      What they sent to the internet.

    • storage_gb_hoursnumberrequired

      What its branches' Drives kept, and its history past its free day (history_gb_hours).

    • log_gb_hoursnumberrequired
    • drive_write_bytesintegerrequired

      What was written to its branches' Drives.

    • drive_cold_read_bytesintegerrequired

      What was read of its branches' Drives from the object store.

    • object_storage_gb_hoursnumberrequired

      What its tiered partitions kept (tiered_gb_hours).

    • class_a_requestsintegerrequired
    • class_b_requestsintegerrequired
    • browser_awake_secondsnumberrequired
    • history_gb_hoursnumberrequired

      Of storage_gb_hours: what its history kept older than its free last day and within the window it keeps (its root branch's window's old versions and its archived WAL), billed at the price of storage.

      minimum: 0
    • tiered_gb_hoursnumberrequired

      Of object_storage_gb_hours: what its tiered partitions kept, by their size before they were moved, billed at the price of Object Storage.

      minimum: 0
    • list_usdnumberrequired

      What its quantities come to at the month's list prices: each meter's priced as a line's amount is, to the nearest millionth (traffic region by region), added up.

      minimum: 0
  • credits_debitednumberrequired

    What the month's usage took from the account's balance: the month's entry of the ledger, which follows usage_usd less written_off_usd and is behind by seconds at the most while the month is not closed.

  • written_off_usdnumberrequired

    What the month's usage came to that no lot could pay and that is owed by nobody: what an account that held nothing used of the meters that are stopped (CPU time, memory, requests, traffic, logs kept, Drive writes and cold reads, Object Storage's class A and B requests) between what the stretch includes running out (a quantity, or the credit) and the stop taking hold. With credits_debited it is usage_usd, once a look has brought the ledger up to the statement.

  • paid_fromobjectrequired

    Which Credits paid for the month's usage, by the kind of lot (Lot.kind), and what none has paid (unpaid: it is owed, and the next Credits pay it first). They add up to credits_debited. A kind that only a store from before plans included quantities has (month_grant, period_grant) is there where something of it paid; and debt_written_off where what was owed for the month was written off when what the account stored had been deleted (it is among what adds up, and nobody paid it).

    • creditnumberrequired
    • topupnumberrequired
    • unpaidnumberrequired
    • debt_written_offoptionalnumber
  • grantedobjectrequired

    The Credits that were granted and bought in the month, by the kind of lot.

    • creditnumberrequired
    • topupnumberrequired
  • lapsedobjectrequired

    What was left of lots that lapsed with the month, by the kind of lot: written off, in entries of this month (expiry).

    • creditnumberrequired
    • topupnumberrequired
  • restoredobjectrequired

    What an operator brought back in the month of lots that had lapsed, in it or before, by the kind of lot (restore entries of this month). What lapsed is said in the month it lapsed with all the same.

    • creditnumberrequired
    • topupnumberrequired
  • taken_backnumberrequired

    What was taken from the balance in the month with top-ups that were taken back (refund entries).

  • credits_balancenumberrequired

    What the account held at the month's end, as the ledger has it: the sum of its entries of this month and of the months before. Of the month it is: what it holds. Below zero when the account owes.

  • closedbooleanrequired

    The month is over, what its usage comes to was taken from the account's balance as this statement has it (credits_debited and written_off_usd are usage_usd), and what was left of the lots that lapsed in it is written off. False for the month it is; false in the seconds after a month's end, until what was used in it is in the books (ten minutes at the most, when a node is not read); and false again while usage of the month that came in later waits to be taken, which is seconds.

400

invalid_field (period: not a month, or one that has not begun), unknown_parameter.
JSON
  • errorobjectrequired
    • typestringrequired
    • codestringrequired
    • messagestringrequired
    • paramstring | nullrequired
    • retryablebooleanrequired
    • request_idstringrequired
    • docs_urlstring | nullrequired
  • move_idoptionalstring

    With already_moving: the move of the sandbox that is under way.

  • upgrade_idoptionalstring

    With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

    pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
  • moveoptionalobject

    With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.

    • objectstringrequired
    • idstringrequired
      pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
    • sandbox_idstringrequired
    • project_idstringrequired
    • fromobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • toobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • epochintegerrequired

      The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.

      minimum: 1
    • stepstringrequired

      Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).

    • whystringrequired

      What made it: the operator's move, an evacuation, a recovery.

    • wakebooleanrequired

      Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.

    • from_storebooleanrequired

      The new node takes it from the object store alone.

    • releaseobject | nullrequired

      What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.

    • takeoverobject | nullrequired

      What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.

    • errorrequired

      Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.

      One of the following:

      • object
      • null
    • attemptsintegerrequired

      How many times the step it is at was asked without an answer that settles it.

      minimum: 0
    • next_attempt_atstring | nullrequired

      When that step is asked again; null where it is not waiting.

      format: date-time
    • batchstring | nullrequired

      The evacuation (evc-…) or recovery (rcv-…) it is of.

    • created_atstringrequired
      format: date-time
    • updated_atstringrequired
      format: date-time
    • ended_atstring | nullrequired
      format: date-time
  • lease_untiloptionalstring

    With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

    format: date-time
  • activeoptionalobject | null

    With standby: the active copy, as the standby last read the lease; null while no copy holds it.

    • namestringrequired
    • urlstringrequired
    • termintegerrequired
      minimum: 1
  • allowed_hostsoptionalarray | null

    With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).

  • problemsoptionalarray ofobject

    With invalid_definition: every problem of the definition, each where it is and what it is.

    • atstringrequired

      Where in the definition, a dotted path (services.web.port); empty for the whole of it.

    • messagestringrequired
  • reportoptionalobject

    With compose_refused: the import's report, which says what is refused, why, and what to change.

    • objectcompose_importrequired
    • namestring | nullrequired

      The model's name: each service's label compose.project. Null: it has none.

    • dry_runbooleanrequired
    • strictbooleanrequired
    • profilesarray ofstringrequired
    • treatmentsobjectrequired

      How many items of the report have each treatment.

      • doneintegerrequired
        minimum: 0
      • adaptedintegerrequired
        minimum: 0
      • ignoredintegerrequired
        minimum: 0
      • refusedintegerrequired
        minimum: 0
    • itemsarray ofobjectrequired

      The model's top-level elements: name, each volume, network, config and secret, extensions.

      • atstringrequired

        Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

      • treatmentdoneoradaptedorignoredorrefusedrequired

        done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

      • whystringrequired
      • changestring | nullrequired

        Of one that is refused: what to change. Null otherwise.

    • servicesarray ofobjectrequired

      The services the import takes, in the model's order.

      • namestringrequired

        The service's name, which is its app's.

      • app_idstring | nullrequired

        Its app. Null: a dry run of a service the project does not have.

        pattern: ^app-
      • statuscreatedorchangedorunchangedrequired

        What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.

      • kindserviceorjobrequired

        job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.

      • statefulbooleanrequired

        It mounts a volume of its own: one instance, which has the volume.

      • versionbooleanrequired

        Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.

      • itemsarray ofobjectrequired
        • atstringrequired

          Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

        • treatmentdoneoradaptedorignoredorrefusedrequired

          done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

        • whystringrequired
        • changestring | nullrequired

          Of one that is refused: what to change. Null otherwise.

      • appobjectrequired

        The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.

        • imagestring | nullrequired

          What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.

        • image_pull_secretstring | nullrequired

          The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.

        • start_commandrequired

          One of the following:

          • StartCommand
          • null
        • start_argsrequired

          What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.

          One of the following:

          • array<string>
          • null
        • portinteger | nullrequired
        • readyobjectrequired

          How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).

          • httpoptionalstring

            A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.

          • tcpoptionaltrue

            The app's port takes a connection.

          • commandoptional

            A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.

            One of the following:

            • string
            • array<string>
        • envmap ofstringrequired
        • secretsmap ofstringrequired

          Names of secrets. No answer has a value.

        • sizeobjectrequired

          What one instance may use at most. It is billed by what it uses.

          • vcpusintegerrequired
            minimum: 1
          • memory_bytesintegerrequired

            An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).

            minimum: 134217728
        • volumesarray ofobjectrequired
          • volumestringrequired
          • pathstringrequired
          • read_onlybooleanrequired
          • nocopyoptionalunknown

            There only where it was given as true.

        • kindstringrequired
        • filesarray ofobjectrequired
          • pathstringrequired
          • modeintegerrequired
          • uidintegerrequired
          • gidintegerrequired
          • contentoptionalstring
          • secretoptionalstring
        • userstring | nullrequired
        • working_dirstring | nullrequired
        • stoprequired

          One of the following:

          • ServiceStop
            • signalstring | nullrequired
            • grace_msinteger | nullrequired
          • null
        • hostnamestring | nullrequired
        • regionsarray ofstringrequired

          In the order na, eu, ap.

        • scaleobjectrequired
          • min_instancesintegerrequired

            How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.

            minimum: 0
          • max_instancesinteger | nullrequired

            How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on the free plan, 50 on p20, 200 on p100, 500 on p300, 1,000 on p1000, 2,000 on p2000): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2, 10, 20, 50, 100 and 200), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.

            minimum: 1
          • concurrencyinteger | nullrequired

            A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.

            maximum: 1000 · minimum: 1
          • sleep_after_msintegerrequired

            After how long without a request an instance stops. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.

            maximum: 600000 · minimum: 0
          • sleep_notice_msinteger | nullrequired

            How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).

            maximum: 60000 · minimum: 0
          • sleep_hold_max_msintegerrequired

            How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).

            maximum: 900000 · minimum: 0
          • delete_after_msinteger | nullrequired

            After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.

            maximum: 3600000 · minimum: 1000
          • suspend_after_msoptionalinteger | null

            How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.

            maximum: 86400000 · minimum: 1000
          • wake_daily_atoptionalstring | null

            A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.

            pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
        • keysrequired

          One of the following:

          • object
          • null
        • egressobject | nullrequired

          Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).

          • defaultoptionalallowordenyornull
          • allowoptionalarray | null
          • denyoptionalarray | null
          • httpoptionalarray | null
          • injectoptionalarray | null
          • deny_portsoptionalarray | null

            Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.

        • metadatamap ofstringrequired
        • logsobjectrequired

          What the app's log has, each part as it was given or at its default (AppLogSettings).

          • outputbooleanrequired
          • keepbooleanrequired
          • requestsobjectrequired
            • sample_ratenumberrequired
              maximum: 1 · minimum: 0
            • keep_errorsbooleanrequired
        • publicbooleanrequired

          Whether it answers at its default domain (url).

        • depends_onarray ofobjectrequired
          • servicestringrequired
          • conditionstringrequired
        • networkobjectrequired
          • aliasesarray ofstringrequired
          • endpoint_modestringrequired
        • drivesoptionalarray ofobject

          The Drives its instance mounts (AppCreate.drives): none, [], where it names none.

          • drivestringrequired
          • pathstringrequired
          • modestringrequired
        • key_drivesoptionalarray ofobject

          The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.

          • namestringrequired
          • pathstringrequired
          • size_bytesinteger | nullrequired
            format: int64
          • nocopyoptionalunknown

            There only where it was given as true.

        • runtimeoptional

          Its runtime settings (AppCreate.runtime). null: none.

          One of the following:

          • Runtime
            • ulimitsmap ofRuntimeLimitGivenrequired
            • sysctlsmap ofstringrequired
            • tmpfsarray ofobjectrequired
              • pathstringrequired
              • size_bytesinteger | nullrequired
              • modeintegerrequired
            • dnsobjectrequired
              • serversarray ofstringrequired
              • searcharray ofstringrequired
              • optionsarray ofstringrequired
            • shm_size_bytesinteger | nullrequired
          • null
        • tracesoptionalobject

          What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.

          • sample_ratenumberrequired
            maximum: 1 · minimum: 0
          • trust_incomingbooleanrequired
    • volumesarray ofobjectrequired

      The volumes of the project the services mount.

      • modelstring | nullrequired

        Its name in the model. Null: made for a path a stateful service mounts with no volume named.

      • namestringrequired

        Its name in the project.

      • idstring | nullrequired

        Null: not made yet (to_make).

        pattern: ^vol-
      • sharedbooleanrequired

        Several services mount it, or one with several instances: every instance of each mounts it at once.

      • statusto_makeormadeorthereorexternalrequired

        to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.

      • used_byarray ofstringrequired
    • secretsarray ofobjectrequired

      The secrets of the model that services are granted.

      • modelstringrequired

        Its name in the model.

      • namestringrequired

        The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.

      • therebooleanrequired

        Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.

      • used_byarray ofstringrequired
    • left_outarray ofobjectrequired

      The services of profiles that are not turned on, which the import does not touch.

      • namestringrequired
      • profilesarray ofstringrequired
    • absentarray ofstringrequired

      The project's services that the model does not have: kept as they are.

    • deploystring | nullrequired

      The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.

      pattern: ^dpl-
  • accountsoptionalarray ofobject

    With sole_owner: the accounts the user is the only owner of.

    • idstringrequired
      pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
    • namestringrequired

401

missing_api_key, invalid_api_key, expired_api_key, invalid_token.
JSON
  • errorobjectrequired
    • typestringrequired
    • codestringrequired
    • messagestringrequired
    • paramstring | nullrequired
    • retryablebooleanrequired
    • request_idstringrequired
    • docs_urlstring | nullrequired
  • move_idoptionalstring

    With already_moving: the move of the sandbox that is under way.

  • upgrade_idoptionalstring

    With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

    pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
  • moveoptionalobject

    With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.

    • objectstringrequired
    • idstringrequired
      pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
    • sandbox_idstringrequired
    • project_idstringrequired
    • fromobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • toobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • epochintegerrequired

      The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.

      minimum: 1
    • stepstringrequired

      Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).

    • whystringrequired

      What made it: the operator's move, an evacuation, a recovery.

    • wakebooleanrequired

      Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.

    • from_storebooleanrequired

      The new node takes it from the object store alone.

    • releaseobject | nullrequired

      What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.

    • takeoverobject | nullrequired

      What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.

    • errorrequired

      Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.

      One of the following:

      • object
      • null
    • attemptsintegerrequired

      How many times the step it is at was asked without an answer that settles it.

      minimum: 0
    • next_attempt_atstring | nullrequired

      When that step is asked again; null where it is not waiting.

      format: date-time
    • batchstring | nullrequired

      The evacuation (evc-…) or recovery (rcv-…) it is of.

    • created_atstringrequired
      format: date-time
    • updated_atstringrequired
      format: date-time
    • ended_atstring | nullrequired
      format: date-time
  • lease_untiloptionalstring

    With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

    format: date-time
  • activeoptionalobject | null

    With standby: the active copy, as the standby last read the lease; null while no copy holds it.

    • namestringrequired
    • urlstringrequired
    • termintegerrequired
      minimum: 1
  • allowed_hostsoptionalarray | null

    With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).

  • problemsoptionalarray ofobject

    With invalid_definition: every problem of the definition, each where it is and what it is.

    • atstringrequired

      Where in the definition, a dotted path (services.web.port); empty for the whole of it.

    • messagestringrequired
  • reportoptionalobject

    With compose_refused: the import's report, which says what is refused, why, and what to change.

    • objectcompose_importrequired
    • namestring | nullrequired

      The model's name: each service's label compose.project. Null: it has none.

    • dry_runbooleanrequired
    • strictbooleanrequired
    • profilesarray ofstringrequired
    • treatmentsobjectrequired

      How many items of the report have each treatment.

      • doneintegerrequired
        minimum: 0
      • adaptedintegerrequired
        minimum: 0
      • ignoredintegerrequired
        minimum: 0
      • refusedintegerrequired
        minimum: 0
    • itemsarray ofobjectrequired

      The model's top-level elements: name, each volume, network, config and secret, extensions.

      • atstringrequired

        Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

      • treatmentdoneoradaptedorignoredorrefusedrequired

        done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

      • whystringrequired
      • changestring | nullrequired

        Of one that is refused: what to change. Null otherwise.

    • servicesarray ofobjectrequired

      The services the import takes, in the model's order.

      • namestringrequired

        The service's name, which is its app's.

      • app_idstring | nullrequired

        Its app. Null: a dry run of a service the project does not have.

        pattern: ^app-
      • statuscreatedorchangedorunchangedrequired

        What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.

      • kindserviceorjobrequired

        job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.

      • statefulbooleanrequired

        It mounts a volume of its own: one instance, which has the volume.

      • versionbooleanrequired

        Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.

      • itemsarray ofobjectrequired
        • atstringrequired

          Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

        • treatmentdoneoradaptedorignoredorrefusedrequired

          done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

        • whystringrequired
        • changestring | nullrequired

          Of one that is refused: what to change. Null otherwise.

      • appobjectrequired

        The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.

        • imagestring | nullrequired

          What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.

        • image_pull_secretstring | nullrequired

          The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.

        • start_commandrequired

          One of the following:

          • StartCommand
          • null
        • start_argsrequired

          What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.

          One of the following:

          • array<string>
          • null
        • portinteger | nullrequired
        • readyobjectrequired

          How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).

          • httpoptionalstring

            A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.

          • tcpoptionaltrue

            The app's port takes a connection.

          • commandoptional

            A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.

            One of the following:

            • string
            • array<string>
        • envmap ofstringrequired
        • secretsmap ofstringrequired

          Names of secrets. No answer has a value.

        • sizeobjectrequired

          What one instance may use at most. It is billed by what it uses.

          • vcpusintegerrequired
            minimum: 1
          • memory_bytesintegerrequired

            An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).

            minimum: 134217728
        • volumesarray ofobjectrequired
          • volumestringrequired
          • pathstringrequired
          • read_onlybooleanrequired
          • nocopyoptionalunknown

            There only where it was given as true.

        • kindstringrequired
        • filesarray ofobjectrequired
          • pathstringrequired
          • modeintegerrequired
          • uidintegerrequired
          • gidintegerrequired
          • contentoptionalstring
          • secretoptionalstring
        • userstring | nullrequired
        • working_dirstring | nullrequired
        • stoprequired

          One of the following:

          • ServiceStop
            • signalstring | nullrequired
            • grace_msinteger | nullrequired
          • null
        • hostnamestring | nullrequired
        • regionsarray ofstringrequired

          In the order na, eu, ap.

        • scaleobjectrequired
          • min_instancesintegerrequired

            How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.

            minimum: 0
          • max_instancesinteger | nullrequired

            How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on the free plan, 50 on p20, 200 on p100, 500 on p300, 1,000 on p1000, 2,000 on p2000): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2, 10, 20, 50, 100 and 200), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.

            minimum: 1
          • concurrencyinteger | nullrequired

            A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.

            maximum: 1000 · minimum: 1
          • sleep_after_msintegerrequired

            After how long without a request an instance stops. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.

            maximum: 600000 · minimum: 0
          • sleep_notice_msinteger | nullrequired

            How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).

            maximum: 60000 · minimum: 0
          • sleep_hold_max_msintegerrequired

            How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).

            maximum: 900000 · minimum: 0
          • delete_after_msinteger | nullrequired

            After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.

            maximum: 3600000 · minimum: 1000
          • suspend_after_msoptionalinteger | null

            How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.

            maximum: 86400000 · minimum: 1000
          • wake_daily_atoptionalstring | null

            A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.

            pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
        • keysrequired

          One of the following:

          • object
          • null
        • egressobject | nullrequired

          Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).

          • defaultoptionalallowordenyornull
          • allowoptionalarray | null
          • denyoptionalarray | null
          • httpoptionalarray | null
          • injectoptionalarray | null
          • deny_portsoptionalarray | null

            Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.

        • metadatamap ofstringrequired
        • logsobjectrequired

          What the app's log has, each part as it was given or at its default (AppLogSettings).

          • outputbooleanrequired
          • keepbooleanrequired
          • requestsobjectrequired
            • sample_ratenumberrequired
              maximum: 1 · minimum: 0
            • keep_errorsbooleanrequired
        • publicbooleanrequired

          Whether it answers at its default domain (url).

        • depends_onarray ofobjectrequired
          • servicestringrequired
          • conditionstringrequired
        • networkobjectrequired
          • aliasesarray ofstringrequired
          • endpoint_modestringrequired
        • drivesoptionalarray ofobject

          The Drives its instance mounts (AppCreate.drives): none, [], where it names none.

          • drivestringrequired
          • pathstringrequired
          • modestringrequired
        • key_drivesoptionalarray ofobject

          The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.

          • namestringrequired
          • pathstringrequired
          • size_bytesinteger | nullrequired
            format: int64
          • nocopyoptionalunknown

            There only where it was given as true.

        • runtimeoptional

          Its runtime settings (AppCreate.runtime). null: none.

          One of the following:

          • Runtime
            • ulimitsmap ofRuntimeLimitGivenrequired
            • sysctlsmap ofstringrequired
            • tmpfsarray ofobjectrequired
              • pathstringrequired
              • size_bytesinteger | nullrequired
              • modeintegerrequired
            • dnsobjectrequired
              • serversarray ofstringrequired
              • searcharray ofstringrequired
              • optionsarray ofstringrequired
            • shm_size_bytesinteger | nullrequired
          • null
        • tracesoptionalobject

          What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.

          • sample_ratenumberrequired
            maximum: 1 · minimum: 0
          • trust_incomingbooleanrequired
    • volumesarray ofobjectrequired

      The volumes of the project the services mount.

      • modelstring | nullrequired

        Its name in the model. Null: made for a path a stateful service mounts with no volume named.

      • namestringrequired

        Its name in the project.

      • idstring | nullrequired

        Null: not made yet (to_make).

        pattern: ^vol-
      • sharedbooleanrequired

        Several services mount it, or one with several instances: every instance of each mounts it at once.

      • statusto_makeormadeorthereorexternalrequired

        to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.

      • used_byarray ofstringrequired
    • secretsarray ofobjectrequired

      The secrets of the model that services are granted.

      • modelstringrequired

        Its name in the model.

      • namestringrequired

        The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.

      • therebooleanrequired

        Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.

      • used_byarray ofstringrequired
    • left_outarray ofobjectrequired

      The services of profiles that are not turned on, which the import does not touch.

      • namestringrequired
      • profilesarray ofstringrequired
    • absentarray ofstringrequired

      The project's services that the model does not have: kept as they are.

    • deploystring | nullrequired

      The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.

      pattern: ^dpl-
  • accountsoptionalarray ofobject

    With sole_owner: the accounts the user is the only owner of.

    • idstringrequired
      pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
    • namestringrequired

403

key_scope: the key does not allow the scope the call takes (the message names it); needs_api_key: the operator's key, or the SSH gateway's; account_held: the account is held for its payments, and every call of its keys but GET /v1/account is refused so, before the scopes are looked at (x-error-codes); installation_key_scope: a key held to an installation of a Managed Application, on a call that is not about that installation's own things. (A sandbox token is passed to its node, which answers what it has no call for with 404 no_such_route.)
JSON
  • errorobjectrequired
    • typestringrequired
    • codestringrequired
    • messagestringrequired
    • paramstring | nullrequired
    • retryablebooleanrequired
    • request_idstringrequired
    • docs_urlstring | nullrequired
  • move_idoptionalstring

    With already_moving: the move of the sandbox that is under way.

  • upgrade_idoptionalstring

    With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

    pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
  • moveoptionalobject

    With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.

    • objectstringrequired
    • idstringrequired
      pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
    • sandbox_idstringrequired
    • project_idstringrequired
    • fromobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • toobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • epochintegerrequired

      The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.

      minimum: 1
    • stepstringrequired

      Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).

    • whystringrequired

      What made it: the operator's move, an evacuation, a recovery.

    • wakebooleanrequired

      Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.

    • from_storebooleanrequired

      The new node takes it from the object store alone.

    • releaseobject | nullrequired

      What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.

    • takeoverobject | nullrequired

      What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.

    • errorrequired

      Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.

      One of the following:

      • object
      • null
    • attemptsintegerrequired

      How many times the step it is at was asked without an answer that settles it.

      minimum: 0
    • next_attempt_atstring | nullrequired

      When that step is asked again; null where it is not waiting.

      format: date-time
    • batchstring | nullrequired

      The evacuation (evc-…) or recovery (rcv-…) it is of.

    • created_atstringrequired
      format: date-time
    • updated_atstringrequired
      format: date-time
    • ended_atstring | nullrequired
      format: date-time
  • lease_untiloptionalstring

    With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

    format: date-time
  • activeoptionalobject | null

    With standby: the active copy, as the standby last read the lease; null while no copy holds it.

    • namestringrequired
    • urlstringrequired
    • termintegerrequired
      minimum: 1
  • allowed_hostsoptionalarray | null

    With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).

  • problemsoptionalarray ofobject

    With invalid_definition: every problem of the definition, each where it is and what it is.

    • atstringrequired

      Where in the definition, a dotted path (services.web.port); empty for the whole of it.

    • messagestringrequired
  • reportoptionalobject

    With compose_refused: the import's report, which says what is refused, why, and what to change.

    • objectcompose_importrequired
    • namestring | nullrequired

      The model's name: each service's label compose.project. Null: it has none.

    • dry_runbooleanrequired
    • strictbooleanrequired
    • profilesarray ofstringrequired
    • treatmentsobjectrequired

      How many items of the report have each treatment.

      • doneintegerrequired
        minimum: 0
      • adaptedintegerrequired
        minimum: 0
      • ignoredintegerrequired
        minimum: 0
      • refusedintegerrequired
        minimum: 0
    • itemsarray ofobjectrequired

      The model's top-level elements: name, each volume, network, config and secret, extensions.

      • atstringrequired

        Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

      • treatmentdoneoradaptedorignoredorrefusedrequired

        done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

      • whystringrequired
      • changestring | nullrequired

        Of one that is refused: what to change. Null otherwise.

    • servicesarray ofobjectrequired

      The services the import takes, in the model's order.

      • namestringrequired

        The service's name, which is its app's.

      • app_idstring | nullrequired

        Its app. Null: a dry run of a service the project does not have.

        pattern: ^app-
      • statuscreatedorchangedorunchangedrequired

        What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.

      • kindserviceorjobrequired

        job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.

      • statefulbooleanrequired

        It mounts a volume of its own: one instance, which has the volume.

      • versionbooleanrequired

        Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.

      • itemsarray ofobjectrequired
        • atstringrequired

          Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

        • treatmentdoneoradaptedorignoredorrefusedrequired

          done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

        • whystringrequired
        • changestring | nullrequired

          Of one that is refused: what to change. Null otherwise.

      • appobjectrequired

        The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.

        • imagestring | nullrequired

          What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.

        • image_pull_secretstring | nullrequired

          The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.

        • start_commandrequired

          One of the following:

          • StartCommand
          • null
        • start_argsrequired

          What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.

          One of the following:

          • array<string>
          • null
        • portinteger | nullrequired
        • readyobjectrequired

          How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).

          • httpoptionalstring

            A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.

          • tcpoptionaltrue

            The app's port takes a connection.

          • commandoptional

            A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.

            One of the following:

            • string
            • array<string>
        • envmap ofstringrequired
        • secretsmap ofstringrequired

          Names of secrets. No answer has a value.

        • sizeobjectrequired

          What one instance may use at most. It is billed by what it uses.

          • vcpusintegerrequired
            minimum: 1
          • memory_bytesintegerrequired

            An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).

            minimum: 134217728
        • volumesarray ofobjectrequired
          • volumestringrequired
          • pathstringrequired
          • read_onlybooleanrequired
          • nocopyoptionalunknown

            There only where it was given as true.

        • kindstringrequired
        • filesarray ofobjectrequired
          • pathstringrequired
          • modeintegerrequired
          • uidintegerrequired
          • gidintegerrequired
          • contentoptionalstring
          • secretoptionalstring
        • userstring | nullrequired
        • working_dirstring | nullrequired
        • stoprequired

          One of the following:

          • ServiceStop
            • signalstring | nullrequired
            • grace_msinteger | nullrequired
          • null
        • hostnamestring | nullrequired
        • regionsarray ofstringrequired

          In the order na, eu, ap.

        • scaleobjectrequired
          • min_instancesintegerrequired

            How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.

            minimum: 0
          • max_instancesinteger | nullrequired

            How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on the free plan, 50 on p20, 200 on p100, 500 on p300, 1,000 on p1000, 2,000 on p2000): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2, 10, 20, 50, 100 and 200), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.

            minimum: 1
          • concurrencyinteger | nullrequired

            A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.

            maximum: 1000 · minimum: 1
          • sleep_after_msintegerrequired

            After how long without a request an instance stops. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.

            maximum: 600000 · minimum: 0
          • sleep_notice_msinteger | nullrequired

            How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).

            maximum: 60000 · minimum: 0
          • sleep_hold_max_msintegerrequired

            How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).

            maximum: 900000 · minimum: 0
          • delete_after_msinteger | nullrequired

            After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.

            maximum: 3600000 · minimum: 1000
          • suspend_after_msoptionalinteger | null

            How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.

            maximum: 86400000 · minimum: 1000
          • wake_daily_atoptionalstring | null

            A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.

            pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
        • keysrequired

          One of the following:

          • object
          • null
        • egressobject | nullrequired

          Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).

          • defaultoptionalallowordenyornull
          • allowoptionalarray | null
          • denyoptionalarray | null
          • httpoptionalarray | null
          • injectoptionalarray | null
          • deny_portsoptionalarray | null

            Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.

        • metadatamap ofstringrequired
        • logsobjectrequired

          What the app's log has, each part as it was given or at its default (AppLogSettings).

          • outputbooleanrequired
          • keepbooleanrequired
          • requestsobjectrequired
            • sample_ratenumberrequired
              maximum: 1 · minimum: 0
            • keep_errorsbooleanrequired
        • publicbooleanrequired

          Whether it answers at its default domain (url).

        • depends_onarray ofobjectrequired
          • servicestringrequired
          • conditionstringrequired
        • networkobjectrequired
          • aliasesarray ofstringrequired
          • endpoint_modestringrequired
        • drivesoptionalarray ofobject

          The Drives its instance mounts (AppCreate.drives): none, [], where it names none.

          • drivestringrequired
          • pathstringrequired
          • modestringrequired
        • key_drivesoptionalarray ofobject

          The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.

          • namestringrequired
          • pathstringrequired
          • size_bytesinteger | nullrequired
            format: int64
          • nocopyoptionalunknown

            There only where it was given as true.

        • runtimeoptional

          Its runtime settings (AppCreate.runtime). null: none.

          One of the following:

          • Runtime
            • ulimitsmap ofRuntimeLimitGivenrequired
            • sysctlsmap ofstringrequired
            • tmpfsarray ofobjectrequired
              • pathstringrequired
              • size_bytesinteger | nullrequired
              • modeintegerrequired
            • dnsobjectrequired
              • serversarray ofstringrequired
              • searcharray ofstringrequired
              • optionsarray ofstringrequired
            • shm_size_bytesinteger | nullrequired
          • null
        • tracesoptionalobject

          What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.

          • sample_ratenumberrequired
            maximum: 1 · minimum: 0
          • trust_incomingbooleanrequired
    • volumesarray ofobjectrequired

      The volumes of the project the services mount.

      • modelstring | nullrequired

        Its name in the model. Null: made for a path a stateful service mounts with no volume named.

      • namestringrequired

        Its name in the project.

      • idstring | nullrequired

        Null: not made yet (to_make).

        pattern: ^vol-
      • sharedbooleanrequired

        Several services mount it, or one with several instances: every instance of each mounts it at once.

      • statusto_makeormadeorthereorexternalrequired

        to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.

      • used_byarray ofstringrequired
    • secretsarray ofobjectrequired

      The secrets of the model that services are granted.

      • modelstringrequired

        Its name in the model.

      • namestringrequired

        The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.

      • therebooleanrequired

        Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.

      • used_byarray ofstringrequired
    • left_outarray ofobjectrequired

      The services of profiles that are not turned on, which the import does not touch.

      • namestringrequired
      • profilesarray ofstringrequired
    • absentarray ofstringrequired

      The project's services that the model does not have: kept as they are.

    • deploystring | nullrequired

      The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.

      pattern: ^dpl-
  • accountsoptionalarray ofobject

    With sole_owner: the accounts the user is the only owner of.

    • idstringrequired
      pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
    • namestringrequired

Type to search…

↑↓ navigate↵ selectEsc close